A Blockchain‐Based Flexible Data Auditing Scheme for the Cloud Service

Chinese Journal of ElectronicsVolume 30, Issue 6 p. 1159-1166 Original Research PaperFree Access A Blockchain-Based Flexible Data Auditing Scheme for the Cloud Service FAN Kefeng, Corresponding Author FAN Kefeng fankf@126.com China Electronics Standardization Institute, Beijing, 100007 ChinaSearch for more papers by this authorLI Fei, LI Fei fiona2022@163.com Guangzhou SequoiaDB Co., Guangzhou, 510006 ChinaSearch for more papers by this authorYU Haiyang, YU Haiyang College of Computer Science, Beijing University of Technology, Beijing, 100124 ChinaSearch for more papers by this authorYANG Zhen, YANG Zhen College of Computer Science, Beijing University of Technology, Beijing, 100124 ChinaSearch for more papers by this author FAN Kefeng, Corresponding Author FAN Kefeng fankf@126.com China Electronics Standardization Institute, Beijing, 100007 ChinaSearch for more papers by this authorLI Fei, LI Fei fiona2022@163.com Guangzhou SequoiaDB Co., Guangzhou, 510006 ChinaSearch for more papers by this authorYU Haiyang, YU Haiyang College of Computer Science, Beijing University of Technology, Beijing, 100124 ChinaSearch for more papers by this authorYANG Zhen, YANG Zhen College of Computer Science, Beijing University of Technology, Beijing, 100124 ChinaSearch for more papers by this author First published: 01 November 2021 https://doi.org/10.1049/cje.2021.08.011 This work is support by the National Key Research and Development Program of China (No.2019YFB1405503) and 2019 Public Service Platform of Industrial Technology Foundation of MIIT (2019-00895-2-1). AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Nowdays, cloud storage technology has become a hot topic, and an increasing number of users are concerned with the security of their data in the cloud. Many auditing schemes on the cloud are proposed and the introduction of a third-party auditor to assist users in verifying the integrity of cloud data. As a centralized node, the third-party auditor has to communicate with all cloud users and cloud service providers, which becomes the bottleneck of the whole scheme. To solve this problem, we design a blockchain-based flexible cloud data auditing scheme. In our scheme, a decentralized auditing framework is proposed to eliminate the dependency on the third-party auditor, which increases the stability, security and performance of the whole scheme. Since the cloud service provider can automatically generates auditing proofs, our scheme can relieve the communication burdens of the cloud service provider. The proposed scheme also adapts the Merkle Hash tree to improve the verification performance. Security analysis and experiments show that the proposed scheme is secure and has better stability and verification efficiency. I. Introduction Nowdays, with the continuous development of information technology and network facilities, as well as the intersection of information technology and human life, global data starts to explosively grow. According to statistics, the total amount of global information was 21.6ZB in 2017, and it is expected to reach 44ZB in 2020. The amount of data in various industries and fields such as industry, finance, and retail is increasing everyday. The continuous surge in data has driven the vigorous development of the big data industry. According to the survey, the scale of Chinese big data industry reached 470 billion RMB in 2017, a year-on-year increase of 30%. Big data is widely used in government, finance, industry, transportation and other industries, providing these industries with new tools for supervision, analysis, optimization and forecasting. Faced with the rapid growth of data, the traditional local storage model can not meet the demand. Cloud storage mode is widely used as a better storage scheme. Cloud storage can provide unlimited storage space and flexible expansion strategies. By storing data in the cloud, users can quickly expand storage capacity and reduce the purchase and deployment costs of local storage servers. However, the development of cloud storage services is currently facing many security issues. On the one hand, the vulnerabilities of the software programs in the server, the instability of network signals, malicious attacks and tampering by hackers, and the failure of hardware facilities may cause the integrity of users' data in the server to be corrupted. On the other hand, in practical applications, there is no completely reliable third-party service provider. For example, to protect the company's reputation, Cloud service providers (CSPs) may cover up the security incidents of data loss and data damage on the cloud storage server. In the meantime, considering providing data storage services to a exponential number users, driven by economic benefits, CSP may actively remove some infrequently used data from users to get more storage space. Since there is no local backup of cloud data, users cannot verify the integrity of cloud data by comparing local data with remote cloud data. Therefore, how to securely and efficiently ensure the integrity of remote cloud data is a technical difficulty, which has become a hot issue in academic research. To solve this problem, the design of cloud data auditing schemes is an effective way. Due to the performance limitation of cloud users, a large number of auditing schemes adopted a Third-party auditor (TPA) to assist each user to verify auditing proofs. However, the introduction of TPA also brings some problems. Firstly, although TPA is assumed to be a trusted third-party in existing schemes, in practical applications, users cannot fully trust TPA. It may be bribed to forge auditing results due to its own interests. Secondly, as a centralized node, TPA cannot guarantee long-term stability, which may cause single point of failures. Once the TPA fails due to an attack or system failure, the entire auditing service will fail. Thirdly, during the auditing process, as a central node, TPA must communicate with all users and all CSPs. Considering that there can exist more than millions of CSPs and users, TPA is likely to become the performance bottleneck of the entire auditing scheme. 1. Our work For the above problem, we introduce the blockchain technology to build a decentralized flexible auditing scheme based on the consortium chain. Flexible auditing means that the auditor does not need send auditing requests and communicate with the auditee, and can directly audit the auditee based on its public behavior. When it comes specifically to the blockchain-based cloud auditing scheme, flexible auditing means that the auditor does not need to send auditing challenges and communicate with the CSP, and only needs to achieve verification operations based on the auditing evidence on the chain. The contributions of this work are mainly as follows: 1) We design a decentralized flexible auditing model based on the consortium chain, and build a flexible auditing protocol for cloud data integrity. 2) We extend this construction to support dynamic updates, allowing users to update their data in the cloud. 3) We analyze the security and prove the correctness and unforgeability of the scheme, and show the performance of the scheme through theoretical explanation and effective experiments. 2. Related work In 2007, the author of Ref.[1] designed a Provable data possession (PDP) scheme that can audit the integrity of files stored on a remote server. This scheme uses a probabilistic sampling strategy, and uses RSA signatures to construct Homomorphic verifiable tags (HVTs), which can effectively aggregate verification tags and reduce protocol calculation and communication overhead. Meanwhile, Juels et al.[2] designed a sentinel-based Proofs of retrievability (POR) mechanism. It can check whether the data on the cloud storage server is damaged, and also restore the corrupted data. However, none of these auditing schemes supports dynamic auditing. The user cannot perform any update on the uploaded data. Ateniese et al.[3] then first consider supporting dynamic operations. They designed a PDP scheme that supports partial dynamic data operations. It can support the modification, deletion and addition of data blocks, but does not support the insertion of data blocks. For dynamic oprations, authors of Ref.[4] designed for the first PDP scheme capable of supporting full dynamic operations by using a Skip List to store the dynamic information of data blocks. Wang et al.[5] designed another PDP mechanism that supports dynamic operations, which is based on Merkle Hash tree (MHT). This scheme uses BLS signature[6] to construct the HVT. This scheme removes the index information of the data block in the HVT, and attempts to use the MHT to guarantee the correctness of the index in a data block. However, since MHT itself is not order sensitive, this scheme has the risk of being cheated by CSP during verification. Zhu et al.[7] designed a dynamic PDP scheme for the multi-cloud storage environment by constructing a hierarchical index structure. Their scheme needs to designate a trusted CSP as the combiner to receive and aggregate verification proofs of other CSPs, which is unrealistic in the real application. Yang et al.[8] proposed an efficient auditing scheme that supports multiple clouds and multiple clients based on Ref.[9]. For the integrity verification of multiple copies in the cloud, Curtmola et al.[10] first designed a multi-replica PDP scheme. This scheme can verify the correctness of multiple copies of cloud user stored on multiple servers. But the scheme cannot support dynamic auditing. Mukundan et al.[11] proposed a multi-copy data integrity auditing scheme that supports dynamic auditing. However, due to the lack of index information of the data block in the homomorphic verification tag, this scheme cannot verify the integrity of the position of the data block. Barsoum and Hasan[12] proposed two dynamic multi-copy PDP schemes based on the Merkle tree and the Map-Version Table respectively. The former scheme is an extension of the MHT-based dynamic PDP; the latter scheme introduces a new data structure of the mapping table to eliminate auxiliary authentication information during verification, reducing storage and computing overheads. Zhang et al.[13] proposed a fully dynamic multi-copy data integrity auditing scheme, which modifies the MHT to support location verification. Liu et al.[14] proposed a dynamic multi-copy auditing scheme by organizing all copies of each data block into the same copy subtree, which can reduce the communication overhead of data update and integrity verification. However, this scheme needs to dynamically adjust the MHT after each update. In addition, although the communication overhead is optimized, the size of the auxiliary authentication information still depends on the number of challenge data blocks. When considering exponential data in the cloud, which is impractical. To reduce the burden on users, Wang et al.[5] for the first time introduced an independent third-party auditor into the audit scheme, using third-party auditor to replace users to verify audit evidence. The TPA-based auditing scheme can eliminate the need for users to participate in the auditing process, saving users' computing overhead. In addition, the program can also support batch auditing, which can verify the auditing tasks of multiple users at the same time. However, the plan needs to assume that third-party auditor is completely trusted. At the same time, this scheme has the risk of user data privacy leakage. TPA may derive user's data blocks by challenging the cloud for same data blocks for multiple times. In response to this problem, Wang et al.[9]proposed a TPA-based cloud auditing scheme that supports privacy protection by using random masking technique. At present, third-party auditor has been widely adopted by many auditing schemes. Liang et al.[15] proposed a blockchain-based data provenance system for cloud auditing, which uses blockchain receipt to validate every provenance data entry, but their work does not verify the correctness of the CSP stored data. Huang et al.[16] design a useful system model for the PVFChain's application. They investigate the PVFChain and propose a efficent smart contract method for improving network security and performance of PVFC. The work is started from the viewpoint of econimic and based on the Stackelberg game approach. However, the focus of this work is to ensure the security of the network through the design of smart contracts and does not solve the verification problem of whether the third party stores the data correctly. Li et al.[17] designed an auditing mechanism that involves two entities (CSP and Users), and removes the third parties using data auditing. Instead, their scheme supports the auditing operations based on dynamically choose users from the blockchain network, it reduces the threat of the auditor. But this process requires a lot of computational overhead than the traditional three-entity-based data audit. Liu et al.[18] proposed a secure framework in the MEC system supporting data sharing in blockchain. Their scheme designs an privacy-preserving mechanism to protect the identity of user privacy in data sharing. However, their scheme does not consider the verifiable research on whether the data is stored correctly, other similar studies include Refs.[19-34]. II. System Model and Definition 1. System model The established system model in this work is shown in Fig.1, which is composed of users, a Cloud service provider (CSP) and a third-party auditor. The three entities jointly maintain a consortium chain that supports flexible auditing. Users encrypt files and generate homomorphic verifiable tags, and upload them to the cloud. CSP is responsible for providing massive storage space, regularly generating auditing proofs, and broadcasting it to the blockchain. TPA or users can audit the proofs stored on the chain to verify whether the CSP stores the data correctly. Fig. 1Open in figure viewerPowerPoint Cloud data flexible auditing system model Our scheme includes Setup, TagGen, ProofAutoGen, ProofSync and Verify, which achieve the audit of cloud data. The file F is divided into n data blocks, then generates encrypted data blocks by using an encryption algorithm. To upload fewer data to the blockchain to complete the audit, the encrypted data blocks are again divided into S blocks and calculate the verification label σ for each data block. The user uploads S data blocks and all verification labels σ to the CSP. The CPS generates aggregated data blocks through random sampling and calculates the aggregated homomorphic verification tags to obtain the final verification signature (a collection of aggregated data blocks and homomorphic verification tags). ProofSync function mainly implemented by the blockchain, CPS broadcasts P (verification signature set)to each node on the blockchain, the master node selected by all nodes sorts the collected evidence into blocks and initiates a consensus broadcast to the entire network. If this block is verified by more than 2/3 nodes, the block is connected to the blockchain. When new audit evidence is incorporated into the blockchain, the user or TPA verifies whether the user data is complete. 2. Security model The blockchain-based flexible auditing scheme for cloud data is denoted as S, To enhance the security of the scheme, a game-based security definition (Definition 1) is proposed. The challenger interacts with the adversary. The challenger is the executor of the model in the game. The adversary's input is calculated to output audit evidence to verify the security of the model. Challenger is represented by C, CSP act as an adversary A, who can access the user's information { F , ɸ } stored in the cloud. Definition 1 For a Probabilistic polynomial time (PPT) adversary A, it can successfully win the following games with a non-negligible probability, then the schemes S is secure. Setup: The challenger C generates a public-private key pair ( x , Y ) and public parameters params, and sends the public key Y and parameters params to the adversary A. Queries: The adversary A selects files F and data blocks m i and sends them to the challenger C. For each data block m i , the challenger C calls the label generation algorithm to generate the corresponding label σ i . Finally, all tags ɸ = σ i i ∈ [ 1 , n ] are sent to the adversary A. Output: For the specified file F, the adversary A outputs auditing proof P ' . If P ' can pass the verification equation, then adversary A wins the game. Take the advantage of the attacker to win as his winning probability. III. Preliminaries 1. Merkle Hash tree Merkle Hash tree is derived from a binary tree, each non-leaf node (intermediate node) contains two child nodes. The value of the non-leaf node is the Hash value of its children's values, and the value of the leaf node is the Hash value of the data block. When verifying a certain leaf node, we first need to use the Hash value H ( m ) of the corresponding data block m and Auxiliary authentication information (AAI) to calculate a new root Hash value H R ' , and then verify H ( R ) = H R ' . 2. Blockchain Blockchain is the underlying technology behind cryptocurrencies such as Bitcoin and Ethereum. It is a decentralized, tamper-proof distributed database, maintained by all nodes in the entire network through a consensus mechanism. Blockchains can be divided into three categories: public chains, consortium chains, and private chains, according to usage scenarios. The public chain is mainly for all users, without the control of access and participation restriction. That is, all users can participate in the maintenance and usage of the public chain. In addition, the public chain generally needs an incentive mechanism to encourage all users to participate. Representative projects of the public chain include Bitcoin, Ethereum, EOS, etc. Consortium chain refers to a blockchain system formed by several organizations in a certain industry, and only specific industrial members are allowed to participate in maintenance. Consortium chains generally do not require an incentive mechanism, nor do nodes need to reach a consensus like Proof of work or Proof of stake. A representative project of in consortium chain is Hyperledger fabric. Private chain refers to a blockchain whose access authority is limited to a certain organization. It is usually used to enhance the reliability and data sharing of internal services, usually has a better response speed. IV. Detailed Scheme 1. Auditing scheme This program includes five algorithms: Setup, TagGen, ProofAutoGen, ProofSync and Verify. 1) Setup: A bilinear pairing can be represented as a map e : G 1 × G 1 → G T , where both G 1 and G T are multiplicative cyclic groups and it have the same prime order q. The symbol g is the generator of group G 1 . That is, all elements on the multiplicative cyclic groups G 1 are g k . Hash functions are H 0 : { 0 , 1 } * → G 1 , H 1 : { 0 , 1 } * → { 0 , 1 } 256 and H 2 : { 0 , 1 } * → Z a . Assume f is a pseudo-random function, π is pseudo-random permutation. The user randomly generates a private key x ∈ Z q * and public key Y = g x ∈ G 1 and determines the parameters of the audit sampling z , r 1 , r 2 ∈ Z q * . It also agrees with the CSP on the constraints of public random information used in auditing. The user publishes public parameters p a r a m s = e , H 0 , H 1 , H 2 , Y , f , π , z , r 1 , r 2 . 2) TagGen: The user first divides the file F into n data blocks { m ¯ i } i ∈ [ 1 , n ] and uses AES symmetric encryption algorithm to generate encrypted data blocks { m i } i ∈ [ 1 , n ] . The user further divides each data block intoS data sectors { m ij } i ∈ [ 1 , n ] , j ∈ [ 1 , s ] . User randomly selects u 1 , u 2 , … , u s ∈ G 1 . It calculates the verification tags for each data block σ i = ( H 0 ( I D F ∥ m i ) · ∏ j = 1 s u j m ij ) x , where I D F is the identifier of F. User then uploads data blocks { m ij } i ∈ [ 1 , n ] , j ∈ [ 1 , s ] and all tags ɸ = { σ i } i ∈ [ 1 , n ] to the CSP. 3) ProofAutoGen: CSP first obtains public random information τ ∈ { 0 , 1 } * according to the agreement, and calculates random value k 1 = H 2 ( τ ∥ r 1 ) ∈ Z q * and k 2 = H 2 ( τ ∥ r 2 ) ∈ Z q n . And by calculating i = π k 2 ( l ) l ∈ [ 1 , z ] and v i = f k 2 ( l ) l ∈ [ 1 , z ] , the CSP generates challenge set c h a l = { i , v i } . Then it generates aggregated data blocks μ = { μ j } 1 ≤ j ≤ s , where μ j = ∑ i ∈ c h a l v i · m i , and calculates the aggregated homomorphic verification tags σ = ∏ i ∈ c h a l σ i v i . CSP generates auxiliary authentication information for each challenged data block { H 0 ( I D F ∥ m i ) , Ω i } i ∈ c h a l . In the end, the CSP generates { μ , σ , { H 0 ( I D F ∥ m i ) , Ω i } i ∈ c h a l } . 4) ProofSync: i) CPS signs { μ , σ , { H 0 ( I D F ∥ m i ) , Ω i } i ∈ c h a l } to generate Sig CSP and then broadcasts auditing proof P = 〈 S i g CSP , μ , σ , { H 0 ( I D F ∥ m i ) , Ω i } i ∈ c h a l 〉 . ii) Each node verifies the correctness of the signature and the format of the broadcasted auditing proof, and then collects the proof locally. iii) The master node selected by all nodes sorts the collected proofs into blocks, and broadcasts a consensus proposal to the entire network. If this block is verified and approved by more than 2/3 nodes, the block is appended to the blockchain. Fig.2 shows the data structure of the auditing blockchain based on auditing proofs. 5) Verify: When new auditing proof is included in the blockchain, the user or TPA follows the following steps to verify: i) TPA obtains auditing proof P from the chain, and uses the same method as CSP to generate a challenging set chal = { i , v i } . ii) TPA uses Ω i to calculate the new root Hash value H 1 ( R ' ) of each block and verifies H 1 ( R ' ) = H 1 ( R ) . iii) It then verifies the following equation: e ( σ , g ) = e ∏ i ∈ c h a l H 0 I D F ∥ m i v i · ∏ j = 1 s u j μ j , Y (1) Fig. 2Open in figure viewerPowerPoint Example of the auditing blockchain If the above verification is established, output 1 to indicate that the user data is complete, otherwise output 0 to indicate that the user data has been corrupted. 2. Dynamic auditing In cloud storage, users need to read data on the cloud, and also need to frequently modify and update data. In the case of dynamic updates, the auditing scheme needs to support dynamic auditing to ensure that after the user modified, the TPA can still effectively verify the integrity of the user's data. Many auditing schemes use MHT to support the verification of the dynamic information in data blocks. However, MHT does not support data block index checking. Therefore, Zhang et al.[13]proposed a modified Merkle Hash tree (mMHT), which can effectively support the verification of indexes of data blocks. In our scheme, we improve mMHT to build a Linked Merkle Hash tree (LMHT) to support dynamic updates and improve auditing efficiency. An example of LMHT with 8 leaf nodes as shown in Fig.3. Compared with mMHT, the biggest difference of LMHT is that the Hash value H 0 in HVT is embedded into each leaf node, that is, h i = H 1 ( H 0 ( I D F ∥ m i ) ) . With this improvement, after verifying AAI, the user or TPA can directly use H 0 ( I D F ∥ m i ) when verifying Eq.(1) without recalculation. Fig. 3Open in figure viewerPowerPoint An example of LMHT with 8 nodes When the data block m ¯ i needs to be modified, the user first modifies and encrypts the data block to generate an updated ciphertext data block m i * . Then it calculates and generates the corresponding updated HVT σ i * = H 0 I D F ∥ m i * · ∏ j = 1 s u j m ij * x . Finally, the user sends a modification request 〈 m i * , σ i * , Mod 〉 to the CSP. When the user inserts a new data block before the i-th data block, the user first generates a new ciphertext data block m * . Then generate the HVT σ * = H 0 I D F ∥ m * · ∏ j = 1 s u j m j * x . Finally, the user sends an insert request 〈 m * , σ * , Ins 〉 to the CSP. When the user needs to remove the data block m ¯ i for modification, the user directly sends a delete request 〈 m * , σ * , Ins 〉 to the CSP. After the CSP receives the user's modification request, the CSP replaces the original data block and tag with { m i * , σ i * } . For the insertion request; the CSP inserts { m * , σ * } into the corresponding position. For the deletion request, it directly deletes the corresponding data block m i and the tag σ i . Then CSP updates and adjusts LMHT. The adjustment process is similar to that in Ref.[13], and thus omitted. V. Security Analysis 1. Correctness Theorem 1 If all nodes are honest and correctly execute the algorithm of the proposed scheme, then Eq.(1) holds. Proof. The correctness is proved as follows: e ( σ , g ) = e ∏ i ∈ chal σ i v i , g = e ∏ i ∈ c h a l H 0 I D F ∥ m i · ∏ j = 1 s u j m ij x v i , g = e ∏ i ∈ c h a l H 0 I D F ∥ m i v i · ∏ j = 1 s ∏ i ∈ c h a l u j v i m ij , Y = e ∏ i ∈ c h a l H 0 I D F ∥ m i v i · ∏ j = 1 s u j ∑ i ∈ c h a l v i m ij , Y = e ∏ i ∈ c h a l H 0 I D F ∥ m i v i · ∏ j = 1 s u j μ j , Y 2. Unforgeability Theorem 2 If the CDH problem is difficult under G 1 . Then under the random oracle model, no adversary A can forge auditing proof with a non-negligible probability. Proof. If adversary A can forge auditing proof P = Sig CSP , μ , σ , H 0 I D F ∥ m i , Ω i i ∈ c h a l , challenger C can solve the CDH problem in group G 1 through interaction with adversary A. That is, given g , g α , h ∈ G 1 , output h α . First, the unforgeability of the digital signature Sig CSP can be guaranteed by the current mainstream public key signature algorithm. Secondly, because LMHT can effectively verify the integrity of leaf nodes, the integrity of H 0 I D F ∥ m i , Ω i i ∈ c h a l can be guaranteed, and tampering with any node cannot pass the verification. Therefore, forging auditing proof can be reduced to forging { μ , σ } . We now prove that by following the similar method in Ref.[33]. Suppose that c h a l = i , v i is the challenge set causing the adversary A to win, { μ , σ } is the corresponding correct proof, and μ ' , σ ' is the proof by which the adversary successfully forged and passed the verification. Obviously σ ' ≠ σ , otherwise μ ' ≠ μ , which is obviously inconsistent with the assumption. Let Δ μ j = μ j ' - μ j . It can be seen that at least one Δ μ j is not 0. Since the adversary successfully forged the proof μ ' , σ ' , the challenger can construct a schemes to solve the CDH problem: The challenger sets public keys Y = g α and μ j = g β j · h γ 1 , where β j , γ j are random numbers. For each random oracle query, the challenger sets H 0 I D F ∥ m i = g r i g ∑ j = 1 s β j m ij · h ∑ j = 1 s γ j m ij , where r i is a random number. For each homomorphic verification tag query, the challenger returns σ i = g α r i . Since both { μ , σ } and μ ' , σ ' satisfy the verification Eq.(1), we can obtain: e ( σ , g ) = e ∏ i ∈ c h a l H 0 I D F ∥ m i v i · ∏ j = 1 s u j μ j , Y (2) e σ ' , g = e ∏ i ∈ c h a l H 0 I D F ∥ m i v i · ∏ j = 1 s u j μ j ' , Y (3) Eq.(2) divide by Eq.(3) to get: e σ ' / σ , g = e ∏ j = 1 s u j Δ μ j , Y = e ∏ j = 1 s g β j · h γ j Δ μ j , Y which is e σ ' · σ - 1 · g - ∑ j = 1 s β j Δ μ j , g = e h α ∑ j = 1 s γ j Δ μ j , g In the end, the challenger can find a solution to the CDH problem, namely h α = ( σ ' · σ - 1 · g - ∑ j = 1 β j Δ μ j s ) ( ∑ j = 1 γ j Δ μ j s ) - 1 Since Δ μ j is not all 0, and γ j is invisible to the adversary A, the probability of γ j Δ μ j = 0 mod q is ε = 1 / q , which is negligible. VI. Performance Analysis 1. Scheme comparison This section compares the proposed scheme with other existing auditing schemes, the analysis is done mainly from the perspectives of public auditing, decentralization, flexible auditing and traceability. The detailed comparison results are shown