## 3 Proposed Solution
### Proposed Lightweight Accountable Privacy-Preserving (LAPP) Protocol
#### 3.2.6 Validation Process  
After applying our testing methodology to the labels and the data contents (substantiation phase), we implement a method to check whether or not the data contents have been tampered with by the TPA. We proceed by applying the complete testing process Tpr', data content substantiation process T, secret hash key \(\gamma_{1}\), the secret label key Sk\({}_{o}\), using a sample of the data contents \(D_{ci}\), as inputs. The identifier hash function f(\(h_{i}\)) is calculated first as  
\[\text{f}(h_{i})=\left\{\text{Tpr}^{*}+D_{ci}+\text{ T}+\gamma 1(SK_{o})\right\} \tag{18}\]  
Based on given identifier hash function, we need to determine the tested hash function f(\(h_{t}\)) for all tested data contents. The calculation of the tested hash f(\(h_{t}\)) is given by:\[\mathrm{f}(h_{t})=T(D_{c})+\mathrm{f}(h_{i})\]  
Substitution of tested data contents \(T(D_{c})\) & the identifier hash function \(\mathrm{f}(h_{i})\)  
\[\begin{split}\mathrm{f}(h_{t})=&\left\{\left\{ \sum\limits_{T(D_{c})}Rn*(Sd_{c})k\right\}+\left\{\mathrm{(j,\ Rn),\ j\in\ Tpr,\ Tps}\right\}+\ \left\{\sum\limits_{T(D_{c})}Rn*(Sd_{c})k\right\}\\ &\quad+\left\{\sum\limits_{T(D_{c})}Rn*(Sd_{c})k\right\}\times \prod\limits_{k\in Tpr}dl_{j}^{Rn}+\ \gamma 1(z2\gamma 2\ \in\ Z2)\right\}\end{split} \tag{19}\]  
Since the hash function, defined earlier, \(\mathrm{f}(h)\) has a Boolean output, the validation process can be determined by  
[Data contents not tampered with by TPA if \(\mathbb{T}\). \(\varepsilon[\mathrm{f}(h_{t}),Sk_{o}]=1\)]  
[Data contents tampered with by TPA if \(\mathbb{T}\). \(\varepsilon[\mathrm{f}(h_{t}),Sk_{o}]=0\)]  
After determining the tampering process done by TPA, the possible validation process can be obtained by  
\[\begin{split}\mathbb{T}\). \(\varepsilon[\mathrm{f}(h_{t}),Sk_{o}]&=\ \left\{\sum\limits_{T(D_{c})}Rn*(Sd_{c})k\right\}\\ &\times\prod\limits_{k\in Tpr}dl_{j}^{Rn}\left\{\left\{\sum \limits_{T(D_{c})}Rn*(Sd_{c})k\right\}+\left\{\mathrm{(j,\ Rn),\ j\in\ Tpr,\ Tps} \right\}\\ &+\left\{\sum\limits_{T(D_{c})}Rn*(Sd_{c})k\right\}+\ \left\{\sum\limits_{T(D_{c})}Rn*(Sd_{c})k\right\}\times\prod\limits_{k\in Tpr}dl _{j}^{Rn}\\ &+\gamma 1(z2\gamma 2\ \in\ Z2)\right\},\ z2\gamma 2\ \in\ Z2\ \}\end{split} \tag{20}\]  
where \(\varepsilon\) is a small positive value.  
In this section, the validation of the malicious role of the TPA is described in Algorithm 2.  
```
1.Initialization: {CS\({}_{p}\): Cloud service provider; \(S_{k}\): Secret key; \(C_{c}\): Cloud Client; \(Rn\): Random number; \(A_{np}\): Audit Request; \(T_{pa}\): Third party auditor; \(C_{s}\): Cloud Server; \(K_{varn}\): Key Update Request; \(K_{ures}\): Key Update Response; \(TP_{j}\): Third party auditor legitimate; \(TP_{i}\): Third party auditor illegitimate} Input: {\(A_{np}\)}
2.Output: {\(TP_{i}\); \(TP_{i}\)}
3.\(C_{c}\ \to\ L_{req}\) to \(T_{pa}\)
4. Initiate \(T_{pa}\ \to\ CS_{p}\)
5. Set \(K_{varn}\ \to\ T_{pa}\)
6. \(T_{pa}\ \to\ K_{ures}\) to \(C_{c}\)
7. \(C_{c}\) Checks if \(K_{ures}=\ S_{k}\) & \(Rn\) then
8. \(T_{pa}\ =\ Tp_{i}\)
9. Else if \(T_{pa}=TP_{i}\)
10. End if
11. End Elseif
```  
**Algorithm 2** Validation of the malicious role of TPA.  
Algorithm 2 determines the malicious activity of TPA. In step 1, the initialization process is described. Steps 2-3 show the input and output processes, respectively. In Steps 4-5, the CC initiates the request for the auditing process to the TPA. Once the TPA receives the request of auditing, it starts the auditing process. On the other hand, the CC does not have trust in the TPA, so it wants to send a key update request to ensure that the TPA has similar keys shown in Step 6. Once the TPA receives the key update request, if it is a legitimate TPA, then it sends the key update response to the CC as described in Step 7. When the CC receives the key update response from the TPA, it checks whether the response with a secret key and a random number matches, and the TPA is declared as legitimate; otherwise, the TPA is considered as illegitimate (refer to Steps 8-10).