## 4 Our Construction  
In this section, we provide a concrete construction of certificateless provable group shared data possession protocol supporting comprehensive privacy preservation for cloud storage. We suppose the number of users in the group is z, and ID\({}_{i}\) represent the unique identity of the user \(u_{i}\), in which \(1\leq i\leq z\). Without losing the generality, we set \(u_{1}\) as the group manager who will set up system and generate system parameters and the partial private keys for other users. The group shared data M is split into n blocks, denoted as \(M=\left\{m_{j}\middle|1\leq j\leq n,m_{j}\in Z_{q}^{*}\right\}\). In the Partial-Private-Key-Gen algorithm, we employ short signature [12] and randomization method to produce the partial private key for each user of the group. In the Tag-Gen algorithm, we take the advantage of the idea of certificateless cryptography [31] to construct the tags of the data blocks using the partial private key and the secret value. In the challenge phase, the TPA randomly chooses some indexes of the data blocks and corresponding random values as a challenge to the CSP. In the proof generating phase, the CSP computes a response to the TPA. We utilize the idea of zero knowledge proof [33; 34] to design the details of the interaction between the TPA and the CSP. The details of the proposed protocol are as follows:  
* Setup. This algorithm is run by \(u_{1}\). On input of security parameter \(\lambda\), \(u_{1}\) chooses two cyclic multiplicative groups, \(G_{1}\) and \(G_{2}\), with prime order \(q\), \(\log_{2}q\leq\lambda\). \(g\) is a generator of \(G_{1}\). There exists a bilinear map \(e:G_{1}\times G_{1}\to G_{2}\). \(u_{1}\) selects three secure hash functions \(H_{1},H_{2}:\{0,1\}^{*}\to G_{1}\), \(H_{3}:G_{2}\rightarrow\{0,1\}^{1}\), a pseudo-random permutation (PRP) \(\pi:Z_{q}^{*}\times\{1,\ldots,n\}\rightarrow\{1,\ldots,n\}\), and a pseudo-random function (PRF) \(\phi:Z_{q}^{*}\times Z_{q}^{*}\to Z_{q}^{*}\). \(u_{1}\) initializes a public log file \(LF\), which is used to record the information of the indexes of the data blocks and the information of the corresponding tag generators. \(u_{1}\) randomly chooses \(x\in Z_{q}^{*}\) as master secret key \(msk\) and \(\delta\in Z_{q}^{*}\) as secret value, and computes \(P_{pub}=g^{x}\). \(u_{1}\) keeps the master secret key \(msk\) and \(\delta\) privately, and publishes the system parameters \(params=\left\{G_{1},G_{2},P_{pub},H_{1},H_{2},H_{3},e,g,q,LF,\pi,\phi\right\}\). * Partial-Private-Key-Gen. This algorithm is run by \(u_{1}\). When receiving the identity \(ID_{i}\in\{0,1\}^{*}\) of the user \(u_{i}\), \(u_{1}\) computes the \(u_{i}\)'s partial private key \(psk_{ID_{i}}=\mathrm{H}_{1}(ID_{i}\ +\ \delta)^{x}\) and sends \(psk_{ID_{i}}\) and \(\mathrm{H}_{1}(ID_{i}\ +\ \delta)\) to \(u_{i}\). * Secret-Value-Gen. This algorithm is run by group user. \(u_{i}\) randomly selects \(y_{ID_{i}}\in Z_{q}^{*}\) as the secret value and keeps it privately. * Public-Key-Gen. This algorithm is run by group user. \(u_{i}\) uses the secret value to compute the public key \(Y_{ID_{i}}=g^{y_{ID_{i}}}\). * Tag-Gen. Each user in group can generate tags of data blocks using partial private key and secret value. Suppose user \(u_{i}\ (0<i\leq z)\) generates an authentication tag for data block \(m_{j}\ (0<j\leq n)\). It takes \(u_{i}\)'s partial private key \(psk_{ID_{i}}\), the secret value \(s_{ID_{i}}\), and the data block \(m_{j}\) as inputs and outputs the tag \(\sigma_{j}\) of \(m_{j}\). The equation for computing tag is \(\sigma_{j}=psk_{ID_{i}}^{m_{j}}\cdot H_{2}(\omega_{j})^{y_{ID_{i}}}\), in which \(\omega_{j}=j||fname\), \(j\) is the index of data block \(m_{j}\), and \(fname\) denotes the unique identity of data block \(m_{j}\). Each time the \(u_{i}\) generates a tag for data block \(m_{j}\), \(u_{i}\) will update the information in public log file \(LF\) with the index \(j\) of \(m_{j}\), \(Y_{ID_{j}}\), and \(H_{1}(ID_{i}\ +\ \delta)\).