
==== Front
Heliyon
Heliyon
Heliyon
2405-8440
Elsevier

S2405-8440(24)12304-3
10.1016/j.heliyon.2024.e36273
e36273
Research Article
An improved identity-based public audit protocol for cloud storage
Wang Haoming ab
Zhang Yuanhang b
Wang Xu An wangxazjd@163.com
bc⁎
Yang Xiaoyuan b
a School of Electronic & Information Engineering, Xi'an Jiaotong University, Shaanxi, China
b Engineering University of People's Armed Police, Shaanxi, China
c Xidian University, Shaanxi, China
⁎ Corresponding author. wangxazjd@163.com
20 8 2024
30 8 2024
20 8 2024
10 16 e3627331 5 2024
7 8 2024
13 8 2024
© 2024 The Author(s)
2024
https://creativecommons.org/licenses/by-nc/4.0/ This is an open access article under the CC BY-NC license (http://creativecommons.org/licenses/by-nc/4.0/).
With the rapid development of informatization, a vast amount of data is continuously generated and accumulated, leading to the emergence of cloud storage services. However, data stored in the cloud is beyond the control of users, posing various security risks. Cloud data auditing technology enables the inspection of data integrity in the cloud without the necessity of data downloading. Among these, public auditing schemes have experienced rapid development due to their ability to avoid additional user auditing expenses. However, malicious third-party auditors can compromise data privacy. This paper proposes an improved identity-based cloud auditing scheme that can resist malicious auditors. This scheme is also constructed on an identity-based public auditing scheme using blockchain to prevent malicious auditing. We found the scheme is not secure because a malicious cloud server can forge authentication tags for outsourced data blocks, while our scheme has not these security flaws. Through security proofs and performance analysis, we further demonstrate that our scheme is secure and efficient. Additionally, our scheme has typical application scenarios.

Keywords

Security
Cloud computing
Cloud storage
Public integrity auditing
Blockchain
==== Body
pmc1 Introduction

In recent years, the information age has brought about new technologies like cloud computing, cloud storage, and the Internet of Things. The Internet of Things connects all information entities to the Internet, including computers, wearable smart devices, sensors, and more. On one hand, cloud computing requires significant storage capacity [1] to provide users with powerful computing capabilities. On the other hand, users prefer to store their data in the cloud for convenience, thus raising higher security requirements for cloud storage. Therefore, cloud storage has been developed closely connected with cloud computing, where the former is one of the main services provided by the latter. Although cloud storage offers advantages such as efficient data management, convenient storage expansion, low cost, and ease of use, it has become a focus for malicious attacks due to its openness and the high value of the stored data. Cloud service providers might also damage, delete, or alter the data stored by users to save storage space and steal user secrets. Therefore, users need to audit the data stored in the cloud to ensure that the integrity of cloud data is not compromised. Data integrity auditing [2], [3] pertains to verifying the integrity of cloud-based data without requiring direct access to the original data by the user. This is typically achieved through a specific protocol implemented after the user uploads the original data. The idea behind data integrity auditing is for the cloud storage service provider to compute a signature or proof of data integrity from the user-uploaded original data and return it to the user. Before verification, the user first processes and calculates some characteristic information from the original data and stores it locally; during verification, this information is used to verify the correctness of the proof returned by the cloud, thus ensuring the integrity of the data.

1.1 Motivation

The processing and storage of big data in cloud servers reduce the burden of maintenance costs and local data storage expenses, providing numerous conveniences for enterprises. Additionally, enterprises conduct integrity audits of data stored on cloud servers through third-party auditors. Generally, auditors cannot access or replicate data contents, but this assumes that the third party is a trustworthy entity. However, third parties could potentially be malicious, possibly providing audit results that pass without expending resources or colluding with cloud servers for certain benefits, fabricating audit results, or even gaining access to user-uploaded data contents. Therefore, to safeguard the security of data stored on cloud servers, designing a cloud data auditing scheme that is resilient to malicious auditors is essential. Moreover, identity-based auditing schemes can solve the inefficiencies linked with certificate management in auditing processes based on public key infrastructure.

1.2 Our contribution

Identity-based cloud auditing schemes have drawn significant attention from researchers due to their ability to avoid the inefficiencies associated with traditional certificate management. Recently, Xue et al. [4] proposed an identity-based public auditing scheme using blockchain to prevent malicious auditing. However, it has been discovered that a malicious cloud server is capable of forging authentication tags for outsourced data blocks. Consequently, such a malicious cloud server can fabricate evidence of possessing outsourced data to pass the audit by the TPA. Based on Xue et al.'s scheme, we propose an improved identity-based cloud auditing scheme that can resist malicious auditors. Our protocol can withstand tag forgery attacks and is efficient.

1.3 Organization

This article is composed of ten sections. In Section 1, we clarify our motivations and contributions. The related work is introduced in Section 2. In Section 3, we present the System model, Definition and Preliminary knowledge. A review of the original scheme is provided in Section 4. In Section 5, we analyze attacks on the original scheme. Section 6 provides a detailed description of the improvement scheme. Section 7 conducts a security analysis of the enhanced approach. In Section 8 and Section 9, a performance evaluation of our scheme is presented and an application scenario is introduced. Finally, we conclude our work in Section 10.

2 Related work

To achieve secure cloud storage, a large number of schemes for auditing the integrity of cloud data have been proposed by researchers. Ateniese et al. [5] introduced a PDP (provable data possession) model, which allows clients to verify whether an untrusted server possesses the original data. In the same year, Juels et al. [6] defined and explored POR (proofs of retrievability). POR schemes enable archival or backup services (provers) to generate succinct proofs that users (verifiers) can retrieve, demonstrating the retention and reliable transmission of enough data for users to fully restore the file data of target file F. In 2008, Shacham et al. [7] presented the first proof of retrievability scheme. Concurrently, Ateniese et al. [8] introduced the concept of third-party auditors (TPAs) and proposed a dynamic auditing scheme for data. Wang et al. [9] introduced a secure cloud storage system that facilitates privacy-preserving public auditing, allowing Third-Party Auditors (TPAs) to conduct efficient audits across multiple users simultaneously. Yang et al. [10] devised an auditing framework for cloud storage systems and introduced an efficient, privacy-preserving auditing protocol, thereby diminishing the computational burdens on auditors. Wang et al. [11] introduced a groundbreaking public auditing mechanism to ensure the integrity of shared data, all the while considering efficient user revocation. Yu et al. [12] presented a fresh identity-based remote data integrity checking scheme. In the scheme proposed by Supraja et al. [13], the identities of the signers for each block within the shared data remain confidential from the third-party auditor (TPA), yet the TPA can still publicly verify the integrity of the shared data without needing to retrieve the entire file. In 2014, Armknecht et al. [14] introduced the first data integrity scheme against malicious auditors, utilizing proof-of-work mechanisms based on time-related pseudo-randomness in a secure dependent blockchain. Following the work of Armknecht et al., Zhang et al. [15] proposed a data auditing scheme that simultaneously supports resistance against malicious auditors and certificate-less public verification. Sookhak et al. conducted an extensive investigation into the security of data storage [16], outlining some significant trends for researchers in the field. In 2019, Xue et al. [4] designed an identity-based cloud auditing scheme. In 2020, Mao and Zhang [17] designed a hybrid verification scheme for cloud data integrity, where static verification uses a BLS signature-based verification method, and dynamic verification uses a multi-branch path-based verification method. In the same year, Yang et al. [18] proposed a multi-user and multi-replica public data audit scheme for cloud data, based on secret sharing technology and a multi-branch path tree, to meet users' security revocation needs, introducing a re-signing algorithm. Furthermore, Xian et al. [19] proposed a cloud storage data deduplication scheme that does not require TPA's online participation, ensuring that plaintext information is not disclosed during popularity surveys. Zhang et al. [20] utilized blockchain technology to propose the first certificateless public verification scheme against procrastinating auditors. In 2022, Yang et al. [21] designed a cloud audit scheme without bilinear pairing, using the Schnorr algorithm and blockchain technology, generating only the labels of the audited data to reduce overhead. For specific auditors, Wang et al. [22] designed an anonymous authorization mechanism, where only designated TPAs can decrypt the user's identity and perform auditing tasks. TPAs can check the integrity of outsourced ciphertexts containing specific keywords. Recently, Gan et al. [23] proposed a cloud auditing scheme that allows TPAs to conduct online and offline audits with strong key exposure resilience.

However, we acknowledge that there are security issues in Xue et al.'s scheme [4]. This scheme utilizes blockchain to select random numbers for challenge messages, enabling users to perform batch verification of audit results provided by TPAs, thus further confirming data integrity. However, adversaries can forge proofs to compromise the integrity verification. Our work makes improvements to this scheme, remedying the shortcomings of the original.

3 System model, definition and preliminary knowledge

Here we give the system model and definition of an identity-based secure public auditing scheme against malicious auditors [4].

3.1 System model

The system model, as shown in Fig. 1, includes four components: User, Cloud Server (CS), Third-Party Auditor (TPA), and Private Key Generator (PKG). The Private Key Generator is a trusted entity that generates parameters and creates private keys for users. The Cloud Server offers cloud storage services but may become malicious due to vested interests. Users own the data. The TPA is accountable for auditing the integrity of outsourced data. Malicious auditors might provides falsified validation results or even steal users' data for various reasons. Users upload local data to the CS and delegate the TPA to conduct integrity audits on the cloud data. The TPA uploads log files to the blockchain, allowing users to audit the log files stored on the blockchain when connected to the internet.Figure 1 System model.

Figure 1

3.2 Definition

The identity-based secure public auditing scheme against malicious auditors includes the following seven algorithms:

Setup(k)→(Para,s). With a secure parameter k, the PKG establishes public parameter Para and a master key s.

Keyextr(Para,s,ID)→(sPU,0,sPU,1). Based on the User's ID, the PKG generates the User's private key (sPU,0,sPU,1) and a state parameter ω.

Store(Para,F,(sPU,0,sPU,1))→ϕ. Using the public parameter Para, the User employs his or her private key (sPU,0,sPU,1) to generate authentication tags ϕ for file F.

Challen(Para,t)→D. With the public parameter Para and the time t, challenge message D is generated by the TPA.

Proofgen(Para,D)→C. Based on the challenge message D, the CS generates proof information C.

Audit(Para,C)→0/1. Based on the public parameter Para and proof C, the TPA conducts data integrity audit and outputs the audit results.

Checklog(Para,Lf)→0/1. User outputs the checking result based on the auditor's log files Lf.

3.3 Preliminary knowledge

Definition 1 (CDH Problem): Let P as a generator in an additive group G1 with large prime order q, and P, aP and bP as inputs, the CDH problem is to calculate abP∈G1, where a,b∈Zq⁎.

Definition 2 (CDH Assumption): If for any polynomial-time algorithm and the running time is at most t′, the advantage ε′ of solving the CDH problem can be considered negligible, and we say the CDH assumption holds.

4 Review of Xue et al.'s scheme

In this section, we review the details Xue et al.'s scheme, which we refer to as IBPA for short. IBPA is divided into two phases: the Setup phase and the Audit phase, involving interactions between the User, PKG, CS, and TPA.

Setup phase.

(1) Setup. The PKG utilizes security parameter k, selects two cyclic groups G1 and G2 of the same order p, where p is a large prime, and then chooses a bilinear mapping e:G1×G1→G2. It chooses random s∈Zp as the master key for the PKG and computes the public key Q=sP, where P is a generator of group G1. Besides, it also defines the hash functions h:G1→Zp, H:{0,1}⁎→Zp, H1,H2:{0,1}⁎→G1. The public parameter is Para={G1,G2,e,H1,H2,h,H}.

(2) Keyextr. The PKG receives the User's ID, and calculates PU,0=H1(ID,0), PU,1=H1(ID,1). The PKG sends the User's private key (sPU,0, sPU,1) and parameter ω to the User.

(3) Store. User divides the file F into m1||m2||⋯||mn, mj∈Zp,j∈[1,n]. Then, User selects a random r∈Zp and a name for file and calculates (Sj,Tj)=(rH2(ω||j)+H(name||j)sPU,0+mjsPU,1,rP) for each block mj. The User sends the authentication tag set ϕ={(Sj,Tj)}j∈[1,n] and file F to CS and then deletes the data.

Audit phase.

(1) Challen. The TPA finds the nonce in the corresponding blockchain block based on the specified time t and randomly selects a subset with l elements in [1,n] through nonce and k. For each j∈J, it chooses a random vj∈Zp and sends the challenge message D={j,vj}j∈J to the CS.

(2) Proofgen. After the CS receives D, it selects a random x∈Zp and calculates y=xPU,1∈G1, μ=x−1(∑j=a1almjvj+h(y))∈Zp, (S,T)=(∑j=a1alvjSj,∑j=a1alvjTj). The CS generates a proof C={S,T,μ,y} and sends it to TPA.

(3) Audit. The TPA performs an integrity audit on the challenged data block by verifying the following equatione(S,P)=?e(∑j=a1alH2(ω||j)vj,rP)⋅e(∑j=a1alH(name||j)vjPU,0+μy−h(y)PU,1,Q)

If true, the output is 1; otherwise, the output is 0. Then TPA creates a record (t,nonce,D,(S,T,μ,y),0/1) and all such documents are stored in the log file in chronological order. TPA calculates the hash value Ai=H(ti,noncei,Di,(Si,Ti,μi,yi),0/1), generates the blockchain transaction TXi and uploads it to the blockchain.

(4) Checklog. User checks the log file and verifies the correctness of auditing results. User randomly select a subset B={b1,b2,…,bl′} of challenge message D and select the log file {S(B),T,μ,y} for verification, where S(B)=∑j=b1bl′vjSj. The user verifies that the equatione(S(B),P)=?e(∑j=b1bl′H2(ω||j)vj,rP)⋅e(∑j=b1bl′H(name||j)vjPU,0+μy−h(y)PU,1,Q)

If the output verification result is 0, the user refuses to store cloud data and the cloud data is not safe.

5 Our attack

It can be deduced from the IBPA scheme that the scheme is reliable if the user uploads only a single file. However, in most cases, users don't upload just one file, as doing so would defeat the purpose of using cloud storage. When users upload many different files to the cloud server and each file is divided into numerous small data blocks, users calculate an authentication tag corresponding to each data block and then upload the data blocks and authentication tags to the cloud server. Through analysis, it can be observed that there is a drawback in the IBPA cloud storage auditing scheme, namely the reuse of the same file block index as the input for the hash function. Exploiting this flaw, it is possible to demonstrate the insecurity of the tag generation algorithm in the Store algorithm through linear transformation. This is critical because the tag generation algorithm is a core part of the scheme. Once tags are forged, the security objectives of the entire scheme will be severely compromised. Specifically, malicious cloud service providers, upon obtaining multiple authentication tags, can forge authentication tags for any data block. These malicious cloud can tamper with or delete the user's outsourced data, and provide false evidence to pass TPA audits, thus deceiving users.

5.1 Attacks on the store algorithm

The diagram of the attack is shown in the Fig. 2. The detailed attacks are as follows1. The malicious cloud server can obtain the following equation by observing a sufficient number of authentication tags and querying the user:(Sj1,Tj1)=(r1H2(ω‖j)+H(name1‖j)sPu,0+mj1sPu,1,r1P)

(Sj2,Tj2)=(r2H2(ω‖j)+H(name2‖j)sPu,0+mj2sPu,1,r2P)

(Sj3,Tj3)=(r3H3(ω‖j)+H(name3‖j)sPu,0+mj3sPu,1,r3P)

⋯⋯⋯

(Sjt,Tjt)=(rtH2(ω‖j)+H(namet‖j)sPu,0+mjtsPu,1,rtP)

Here, the malicious cloud has obtained t different files with different names and possessed their authentication tags.

2. The malicious cloud server can calculate H2(ω||j) and H(name||j), because it possesses {F,ϕ} and Para. Only r, sPU,0 and sPU,1 are unknown. Here we set H2(ω||j)=C, sPU,0=A, sPU,1=B, and obtain the following equation:(1) (r1C+H(name1‖j)A+mj1B,r1P)

(2) (r2C+H(name2‖j)A+mj2B,r2P)

3. The malicious cloud calculates (1)⋅H(name2‖j)−(2)⋅H(name1‖j) and gets(3) ((r1H(name2||j)−r2H(name1||j))C+(mj1H(name2||j)−mj2H(name1||j))B,(r1H(name2||j)−r2H(name1||j))P)

4. The malicious cloud calculates the equation (1)⋅mj2−(2)⋅mj1 and gets(4) ((r1mj2−r2mj1)C+(mj2H(name1||j)−mj1H(name2||j))A,(r1mj2−r2mj1)P)

5. The malicious cloud performs a linear transformation on equation (3) and equation (4) to forge (Sj3,Tj3)=(r3H2(ω||j)+H(name3||j)sPU,0 +mj3sPU,1,r3P) that is, forging (r3C+H(name3||j)A+mj3B,r3P). It calculatesM=H(name3‖j)⋅(mj2H(name1||j)−mj1H(name2||j))−1

N=mj3⋅(mj1H(name2||j)−mj2H(name1||j))−1

(4)⋅M+(3)⋅N,gets

(((r1mj2−r2mj1)M+(r1H(name2||j)−r2H(name2||j))N)C+H(name3||j)A+mj3B,((r1mj2−r2mj1)M+(r1H(name2||j)−r2H(name2||j))N)P)

The malicious cloud forges the authentication tags for the file named name3 without knowing r3, sPU,0 and sPU,1.

6. According to a similar method, the malicious cloud can forge any authentication tag (Sj′,Tj′) of any file F′=m1′||m2′||⋯||mn′, which compromises the security of the entire scheme.

Figure 2 Our attack on the Store algorithm.

Figure 2

5.2 Attacks on the IBPA scheme

The malicious cloud can delete or modify any data block and provide correct cloud data integrity evidence during auditing, indicating that the IBPA scheme is insecure. The specific attack is as follows:1. The malicious cloud, by observing a sufficient number of authentication tags and querying the user, can compute and forge authentication tags for any data block. Consequently, when the User continues to send files and tag sets, the malicious cloud deletes the files and tag sets directly.

2. To audit the integrity of cloud data, TPA sends challenges D={j,vj}j∈J to the CS. Getting the nonce corresponding to the time t, TPA selects a random set J={a1,a2,…,al} of l elements from [1,n] based on the nonce and k, and chooses randomly vj∈Zp for each j∈J.

3. Upon receiving the challenge information, the malicious cloud selects x∈Zp and randomly chooses data block mj′, where j∈J. It then recalculates (Sj′,Tj′)=(rH2(ω||j)+H(name||j)sPU,0+mj′sPU,1,rP), y=xPU,1∈G1, μ′=x−1(∑j=a1almj′vj+h(y))∈Zp, (S′,T′)=(∑j=a1alvjSj′,∑j=a1alvjTj′) and sents C={S′,T′,μ′,y} to the TPA.

4. The TPA verifies the equatione(S′,P)=?e(∑j=a1alH2(ω||j)vj,rP)⋅e(∑j=a1alH(name||j)vjPU,0+μ′y−h(y)PU,1,Q)

If the verification passes, it outputs 1 to indicate acceptance; otherwise, it outputs 0 to indicate rejection. The specific analysis is as follows:e(S′,P)=e(∑j=a1alvjSj′,P)=e(∑j=a1alvj(rH2(ω‖j)+H(name‖j)sPU,0+mj′sPU,1),P)=e(∑j=a1alvjrH2(ω‖j),P)⋅e(∑j=a1alvjH(name‖j)sPU,0+∑j=a1alvjmj′sPU,1,P)=e(∑j=a1alH2(ω‖j)vj,rP)⋅e(∑j=a1alH(name‖j)vjPU,0+μ′y−h(y)PU,1,Q)

The malicious cloud, by forging the proof of data integrity, can pass the TPA's verification equation, which compromises the security of the IBPA cloud storage auditing scheme.

5.3 Remark

The reason a malicious cloud can perform forgery attacks is that certain parts of the data block tags for different files are the same. Specifically, H2(ω||j), sPU,0 and sPU,1 for the same block of different files are fixed. The malicious cloud can view these three as fixed points and use linear transformations on their coefficients to forge tags for other files. The next idea is to concatenate the element (ω||j) with the name of different files and then perform a hash mapping to G1. The H2(ω||j||name) for different files will be different, and rH2(ω||j||name) will be unknown. The aforementioned linear transformation will not hold. This change can effectively prevent forgery attacks by the malicious cloud.

6 Improved scheme

In this section, we give our improved identity-based cloud auditing scheme that can resist malicious auditors, which is based on Xue et al.'s scheme.

6.1 Construction of improved scheme

The process and algorithms involved in the improved scheme are shown in Fig. 3. Specifically, our protocol is as follows:Figure 3 Our improved scheme.

Figure 3

(1) Setup. The PKG utilizes security parameter k, selects two cyclic groups G1 and G2 of the same order p, where p is a large prime, and then chooses a bilinear mapping e:G1×G1→G2. It chooses random s∈Zp as the master key for the PKG and computes the public key Q=sP, where P is a generator of group G1. Besides, it also defines the hash functions h:G1→Zp, H:{0,1}⁎→Zp, H1,H2:{0,1}⁎→G1. The public parameter is Para={G1,G2,e,H1,H2,h,H}.

(2) Keyextr. The PKG receives the User's ID, and calculates PU,0=H1(ID,0), PU,1=H1(ID,1). The PKG sends the User's private key (sPU,0, sPU,1) and parameter ω to the User.

(3) Store. User divides the file F into m1||m2||⋯||mn, mj∈Zp,j∈[1,n]. Then, User selects a random r∈Zp and a name for file and calculates (Sj,Tj)=(rH2(ω||j||name)+H(name||j)sPU,0+mjsPU,1,rP) for each block mj. The User sends the authentication tag set ϕ={(Sj,Tj)}j∈[1,n] and file F to CS and then deletes the data.

(4) Challen. The TPA finds the nonce in the corresponding blockchain block based on the specified time t and randomly selects a subset with l elements in [1,n] through nonce and k. For each j∈J, it chooses a random vj∈Zp and sends the challenge message D={j,vj}j∈J to the CS.

(5) Proofgen. After the CS receives D, it selects a random x∈Zp and calculates y=xPU,1∈G1, μ=x−1(∑j=a1almjvj+h(y))∈Zp, (S,T)=(∑j=a1alvjSj,∑j=a1alvjTj). The CS generates a proof C={S,T,μ,y} and sends it to TPA.

(6) Audit. The TPA performs an integrity audit on the challenged data block by verifying the following equatione(S,P)=?e(∑j=a1alH2(ω||j||name)vj,rP)⋅e(∑j=a1alH(name||j)vjPU,0+μy−h(y)PU,1,Q)

If true, the output is 1; otherwise, the output is 0. Then TPA creates a record (t,nonce,D,(S,T,μ,y),0/1) and all such records are stored in the log file in chronological order. TPA calculates the hash value Ai=H(ti,noncei,Di,(Si,Ti,μi,yi),0/1), generates the blockchain transaction TXi and upload it to the blockchain.

(7) Checklog. User checks the log file and verifies the correctness of auditing results. User randomly select a subset B={b1,b2,…,bl′} of challenge message D and select the log file {S(B),T,μ,y} for verification, where S(B)=∑j=b1bl′vjSj. The user verifies that the equatione(S(B),P)=?e(∑j=b1bl′H2(ω||j||name)vj,rP)⋅e(∑j=b1bl′H(name||j)vjPU,0+μy−h(y)PU,1,Q)

If the output verification result is 0, the user refuses to store cloud data and the cloud data is not safe.

6.2 Correctness analysis

In the improved cloud auditing scheme, only the correct responses from both the TPA and the CS can pass the integrity audit.

Proof According to the improved scheme, during the audit phase, if the information exchanged between the TPA and CS is correct, then the following equation can be satisfied.e(S,P)=e(∑j=a1alvjSj,P)=e(∑j=a1alvj(rH2(ω‖j‖name)+H(name‖j)sPU,0+mjsPU,1),P)=e(∑j=a1alvjrH2(ω‖j‖name),P)⋅e(∑j=a1alvjH(name‖j)sPU,0+∑j=a1alvjmjsPU,1,P)=e(∑j=a1a1H2(ω‖j‖name)vj,rP)⋅e(∑j=a1ajH(name‖j)vjPU,0+μy−h(y)PU,1,Q)

7 Security proof for improved scheme

Theorem 1 Our improved scheme is unforgeable against adaptive selected file block attacks, assuming the (t′,ε′) CDH assumption holds.

Proof Assuming that challenger C has a CDH instance, (P, sP, P′). To output sP′, C interacts with the adversary A by a random oracle.

Setup. The private key generator (PKG) gets parameters Para by the Setup algorithm. It sets Q=sP as the public key and takes s as the master private key.

Query. A performs adaptive queries to Hash Query and TagGen Query. C responds with the following results.

Hash Query. C retains the hash list LH={ID,name,j,H2(ω||j||name), H(name||j),PU,0,PU,1} and initializes it to empty. When A performs a Hash query for (ID,name,j), C checks (ID,name,j) in LH. If it does, the corresponding hash value is returned; otherwise, H2(ω||j||name)=τP, H(name||j), PU,1=mP+nP′ and PU,0 are computed as the return value, and {ID,name,j,H2(ω||j||name),H(name||j),PU,1,PU,0} is inserted into LH.

TagGen Query. C retains a list LT={ID,name,mj,Sj,Tj} and initializes it to empty. When A performs a TagGen query for a file's mj, C checks (ID,name,mj) in LT. If it does, the corresponding tag (Sj,Tj) is returned. Otherwise, C computes the tag Sj,Tj and inserts (ID,name,mj,Sj,Tj) into LT.

Forgery. Finally, A forges proof C′={S′,T′,μ′,y} afetr receiving D′={j,v′j}j∈J′. Furthermore, C′={S′,T′,μ′,y} can be verified through the TPA. Challenger C searches for LH and obtains H2(ω||j||name), H(name||j), PU,1,PU,0, where j∈J′. This way, challenger C obtains e(S′,P)=e(τT′+s(∑j=a1alH(name||j)vjPU,0+μ′y−h(y)PU,1),P). Moreover, challenger C possesses a valid response C={S,T,μ,y}, challenger C obtains e(S,P)=e(τT+s(∑j=a1alH(name||j)vjPU,0+μy−h(y)PU,1),P). According to e(S′,P) and e(S,P), challenger C obtainsS′−S=τ(T′−T)+s(μ′−μ)xPu,1=τ(T′−T)+s(μ′−μ)xmP+s(μ′−μ)xnP′=τ(T′−T)+(μ′−μ)xmQ+(μ′−μ)nxsP′

Thus, challenger C can compute sP′, solving the CDH problem.

Theorem 2 The TPA is unable to retrieve relevant data based on the proof information C={S,T,μ,y} sent by the CS.

Proof To respond to the challenge request, the CS generates proof information C={S,T,μ,y}. Then, the proof is sent to TPA for verification. The challenge information determines the challenge data, and the CS blinds the challenged data using random number x. If TPA obtains x−1 through μ=x−1(∑j=a1almjvj+h(y))∈Zp, it can access the challenged data. In fact, x is the secret information kept by the CS. If a malicious TPA obtains the challenged data, it only receives the blinded data information. Thus, the TPA cannot retrieve the challenged data based on the proof C={S,T,μ,y} sent by CS.

Theorem 3 Our scheme can resist the forgery attack given above.

Proof The mentioned forgery attacks exploit the weakness that certain parts of the data block tags for different files are identical, thus devising attack strategies. To reduce storage overhead, the CS can fabricate data tags without storing the data by utilizing these vulnerabilities. The improved scheme proposes a method to address this weakness. During the storage phase, for each data block, H2(ω||j) is replaced with H2(ω||j||name). H2(ω||j||name) is closely related to the file name, and the data block's authentication tag with the same index from different files has different hash values. The aforementioned attack no longer holds. The overall storage phase proceeds as follows: Users randomly select r∈Zp, the file name and compute (Sj,Tj)=(rH2(ω||j||name)+H(name||j)sPU,0+mjsPU,1,rP) as the authentication tag. Users send it to the cloud server, and then delete the local data. With improvements, the attack outlined in section 5.1 is no longer valid, and the improved scheme can withstand the aforementioned forgery attacks.

8 Performance analysis

In this section, we analyze and compare the performance of our proposed scheme with the original scheme and other schemes in terms of computational overhead and features. Our auditing scheme was implemented on a personal computer (MSI with an I7-9750H 2.60 GHz processor, 8 GB memory, and Windows 10 operating system) using the JPBC library and JAVA. The settings we used were |p| = 512 bits and |q| = 160 bits.

For simplicity, we use |Zp| to represent the size of elements in Zp, |G1| to represent the size of elements in G1, n to denote the number of data blocks, and c to denote the number of challenged data blocks. We give the notation to denote the operations used in our proposal in Table 1.Table 1 Notation of operations.

Table 1Symbols	Meanings	
MulG	One group operation in G1	
ExpG	One exponentiation operation in G1	
PairG	One pairing operation in G1	
MulZp	One multiplication operation in Zp	
AddZp	One additional operation in Zp	
HashZp	One hash operation in {0,1}⁎ → Zp	
HashG	One hash operation {0,1}⁎ → G1	
Cf	One pseudorandom function f(⋅)	

In Table 2, we compare the computational overhead of our scheme with schemes SCLPV and CPVPA during the tag generation, proof generation, and auditing phases. Specifically, in the tag generation phase, the computational overhead for scheme CPVPA is (3n+3)⋅ExpG+(2n+2)⋅MulG+(n+2)⋅HashG+(n+1)⋅HashZp, whereas for our scheme it is (3n+1)⋅ExpG+2n⋅MulG+n⋅HashG+n⋅HashZp. In the auditing phase, scheme SCLPV requires 4⋅PairG+(2c+4)⋅ExpG+(2c+2)⋅MulG+5⋅HashG+2c⋅HashZp+2c⋅MulZp for computational overhead, whereas our scheme requires 3⋅PairG+(2c+3)⋅ExpG+(2c+1)⋅MulG+DivG+c⋅MulZp+c⋅HashG+(c+1)⋅HashZp. Therefore, compared to schemes SCLPV and CPVPA, our scheme has lower computational overhead.Table 2 Computation cost comparison.

Table 2Schemes	TagGen	Proofgen	Audit	
SCLPV [15]	(4n+2)⋅ExpG+(2n+2)⋅MulG+3⋅HashG+n⋅HashZp	2c⋅ExpG+2c⋅MulG+c⋅MulZp+c⋅AddZp	4⋅PairG+(2c+4)⋅ExpG+(2c+2)⋅MulG+5⋅HashG+2c⋅HashZp+2c⋅MulZp	
CPVPA [20]	(3n+3)⋅ExpG+(2n+2)⋅MulG+(n+2)⋅HashG+(n+1)⋅HashZp	c⋅ExpG+c⋅MulG+c⋅MulZp+c⋅AddZp+2c⋅Cf	4⋅PairGT+(3c+2)⋅ExpG+3c⋅MulG+(c+4)⋅HashG+(2c+3)⋅HashZp+2c⋅MulZp+2c⋅Cf	
IBPA [4]	(3n+1)⋅ExpG+2n⋅MulG+n⋅HashG+n⋅HashZp	(2c+1)⋅ExpG+2c⋅MulG+(c+1)⋅MulZp+(c+1)⋅AddZp+HashZp	3⋅PairG+(2c+3)⋅ExpG+(2c+1)⋅MulG+DivG+c⋅MulZp+c⋅HashG+(c+1)⋅HashZp	
Our scheme	(3n+1)⋅ExpG+2n⋅MulG+n⋅HashG+n⋅HashZp	(2c+1)⋅ExpG+2c⋅MulG+(c+1)⋅MulZp+(c+1)⋅AddZp+HashZp	3⋅PairG+(2c+3)⋅ExpG+(2c+1)⋅MulG+DivG+c⋅MulZp+c⋅HashG+(c+1)⋅HashZp	

We set the number of data blocks to 100, 200, 300, 400, 500, and 600, and implemented our scheme on the computer. The running times for different stages are shown in Fig. 4(a). We used functions from the JPBC library to convert binary data into point elements in the cyclic group, which took a certain amount of time. As can be seen from the figure, when the number of data blocks is around 500, the Proofgen time and Audit time are almost constant. From [5], we can deduce that to detect 1% of erroneous data with 99% confidence, a constant number of 460 blocks needs to be challenged. The number of challenged blocks is set to n or 460, depending on whether n is less than 460. Therefore, when n<460, the running time for the Proofgen and Audit phases varies significantly.Figure 4 (a) The calculation cost of each phases; (b) The calculation cost comparison in the Store stage.

Figure 4

In Fig. 4(b), we compare the overhead of the Store stage between our scheme and the original scheme. It can be seen that as the number of data blocks increases, the running time also increases, but the difference between the two schemes is not significant. Our improved scheme addresses changes to the hash values mapped to points, which has a negligible impact on the computational overhead of the Store stage. We achieve greater security while maintaining a relatively modest computational overhead.

In Table 3, we compare the functionalities of Data privacy, Resistance against malicious auditors, and Auditing soundness with other schemes. The Y indicates that the scheme possesses the corresponding security feature, while the N indicates otherwise. From the comparison results, our proposal shares some intriguing attributes with the IBPA scheme proposed by Xue et al., such as data privacy for the TPA and resistance against malicious auditors. However, our scheme offers enhanced security, capable of resisting tag forging attacks, thus providing superior security measures.Table 3 Feature comparison.

Table 3Schemes	Data privacy	Resistance against malicious auditors	Auditing soundness	
SCLPV [15]	N	Y	Y	
CPVPA [20]	N	Y	Y	
IBPA [4]	Y	Y	N	
Our scheme	Y	Y	Y	

9 Application

Taking the field of surveillance video as an example, it is widely known that surveillance video files are usually large and require a lot of storage space to be stored locally, and with time, local storage may face the situation of insufficient storage space. Therefore, cloud storage provides a better solution for solving this problem. The application scenario of our designed scheme is shown in Fig. 5.1. The user chunks the surveillance video files, generates tags for each video file chunk, and uploads the video file chunks and the corresponding tags to the cloud server, e.g. the traffic management department uploads the surveillance video files to the cloud server.

2. Cloud server saves and manages surveillance video files for users.

3. Based on the user's auditing requirements, the TPA randomly selects some blocks of data to challenge the cloud server. The cloud server generates proof in response to TPA's challenges.

4. The TPA verifies that the video file is complete with the proof returned by the cloud server and uploads the interactions during the audit to the blockchain.

5. Users check the integrity of surveillance videos and the legal compliance of TPA and the cloud server based on information from the blockchain.

Figure 5 Application in surveillance video.

Figure 5

10 Conclusion

Cloud data auditing technology is crucial for safeguarding the security of cloud data. While numerous meaningful cloud auditing schemes have been proposed and designed, some protocols exhibit certain security issues. The IBPA scheme offers an identity-based approach to resist malicious auditors. However, it faces certain security challenges during the auditing process. We have identified this issue and proposed an improved cloud data auditing scheme to counteract malicious auditors. The enhanced scheme utilizes new a tag generation algorithm in the Store phase, providing heightened security while enabling resistance against malicious auditors. Through security analysis, our proposed scheme indeed demonstrates resilience against tag-forging attacks. Performance analysis indicates that our scheme incurs minimal changes in computational overhead. The results demonstrate that our proposal is not only safe but also effective.

CRediT authorship contribution statement

Haoming Wang: Methodology. Yuanhang Zhang: Writing – original draft. Xu An Wang: Writing – review & editing. Xiaoyuan Yang: Supervision.

Declaration of Competing Interest

The authors declare the following financial interests/personal relationships which may be considered as potential competing interests: The corresponding author Xu An Wang is an Advisory Board Member of Information Science Section at Heliyon.

Data availability

Data will be made available on request.

Acknowledgements

The first author and the second author contribute equally to this paper.
==== Refs
References

1 Chen Kai Hu Chengchen Zhang Xin Zheng Kai Chen Yan Vasilakos Athanasios V. Survey on routing in data centers: insights and future directions IEEE Netw. 25 4 2011 6 10
2 Deswarte Yves Quisquater Jean-Jacques Saidane Ayda Remote Integrity Checking 2004 Springer US Boston, MA 1 11
3 Oprea Alina Reiter Michael K. Yang Ke Space-efficient block storage integrity NDSS 2005
4 Xue Jingting Xu Chunxiang Zhao Jining Ma Jianfeng Identity-based public auditing for cloud storage systems against malicious auditors via blockchain Sci. China Inf. Sci. 62 2019 1 16
5 Ateniese Giuseppe Burns Randal Curtmola Reza Herring Joseph Kissner Lea Peterson Zachary Song Dawn Provable data possession at untrusted stores Proceedings of the 14th ACM Conference on Computer and Communications Security 2007 598 609
6 Juels Ari Kaliski Burton S. Jr. Pors: proofs of retrievability for large files Proceedings of the 14th ACM Conference on Computer and Communications Security 2007 584 597
7 Shacham Hovav Waters Brent Compact proofs of retrievability J. Cryptol. 26 3 2013 442 483
8 Ateniese Giuseppe Di Pietro Roberto Mancini Luigi V. Tsudik Gene Scalable and efficient provable data possession Proceedings of the 4th International Conference on Security and Privacy in Communication Netowrks 2008 1 10
9 Wang Cong Chow Sherman S.M. Wang Qian Ren Kui Lou Wenjing Privacy-preserving public auditing for secure cloud storage IEEE Trans. Comput. 62 2 2011 362 375
10 Yang Kan Jia Xiaohua An efficient and secure dynamic auditing protocol for data storage in cloud computing IEEE Trans. Parallel Distrib. Syst. 24 9 2012 1717 1726
11 Wang Boyang Li Baochun Li Hui Panda: public auditing for shared data with efficient user revocation in the cloud IEEE Trans. Serv. Comput. 8 1 2013 92 106
12 Yu Yong Au Man Ho Ateniese Giuseppe Huang Xinyi Susilo Willy Dai Yuanshun Min Geyong Identity-based remote data integrity checking with perfect data privacy preserving for cloud storage IEEE Trans. Inf. Forensics Secur. 12 4 2016 767 778
13 Wang Boyang Li Baochun Li Hui Oruta: privacy-preserving public auditing for shared data in the cloud IEEE Trans. Cloud Comput. 2 1 2014 43 56
14 Armknecht Frederik Bohli Jens-Matthias Karame Ghassan O. Liu Zongren Reuter Christian A. Outsourced proofs of retrievability Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security 2014 831 843
15 Zhang Yuan Xu Chunxiang Yu Shui Li Hongwei Zhang Xiaojun Sclpv: secure certificateless public verification for cloud-based cyber-physical-social systems against malicious auditors IEEE Trans. Comput. Soc. Syst. 2 4 2015 159 170
16 Sookhak Mehdi Gani Abdullah Talebian Hamid Akhunzada Adnan Khan Samee U. Buyya Rajkumar Zomaya Albert Y. Remote data auditing in cloud computing environments: a survey, taxonomy, and open issues ACM Comput. Surv. 47 4 2015 1 34
17 Mao Xiangjie Zhang Pin Hybrid verification scheme for data integrity of cloud platform Comput. Eng. 46 10 2020 46 51
18 Yang Xiaodong Pei Xizhen Chen Guilan Multi-user and multi-replica public data audit scheme supporting user revocation Comput. Eng. 46 12 2020 150 157
19 Xian Hequn Liu Hongyan Zhang Shuguang Verifiable secure data deduplication method in cloud storage J. Softw. 31 2 2020 455 470
20 Zhang Yuan Xu Chunxiang Lin Xiaodong Shen Xuemin Blockchain-based public integrity verification for cloud storage against procrastinating auditors IEEE Trans. Cloud Comput. 2021
21 Yang Haibin Li Ruifeng Yi Zhengge Efficient cloud storage data auditing scheme without bilinear pairing J. Xidian Univ. 49 1 2022 47 54
22 Wang Xin Zhang Xiaojun Zhang Xinpeng Miao Yinbin Xue Jingting Enabling anonymous authorized auditing over keyword-based searchable ciphertexts in cloud storage systems IEEE Trans. Serv. Comput. 2023
23 Gan Qingqing Wang Xiaoming Huang Daxin Li Jianwei Wang Changji Liu Zhen Online/offline remote data auditing with strong key-exposure resilience for cloud storage Comput. Stand. Interfaces 2024
