## Preliminaries
### System Security  
We consider three security properties, namely, completeness, soundness, and comprehensive privacy preservation against the TPA in our CL-PGSDP protocol. * Completeness means the cloud server can pass the possession checking procedure as long as the cloud server properly stores the group shared data. * Comprehensive privacy preservation means that the TPA achieves no information on the data blocks and the user's identity during the integrity checking procedure. * Soundness states that whenever the cloud server convinces a TPA to accept its proof, the cloud server should actually store the challenged data blocks. According to certifiateless cryptography [30; 31], we consider three types of probabilistic polynomial-time (PPT) adversaries, namely, A\({}_{1}\), A\({}_{2}\), A\({}_{3}\), and a challenger C in our security model and define the security of our protocol by three games. The details are as follows:  
**Game 1:** This game is played by challenger C and adversary A\({}_{1}\) who wants to substitute the user's public key with any other value, but [PERSON]\({}_{1}\) cannot access the master key of the system. **Setup:** Challenger C runs the Setup algorithm to obtain the system parameters _params_ and the master secret key _msk_, and forwards _params_ to the adversary A\({}_{1}\), while keeps _msk_ confidential. **Queries:** A\({}_{1}\) can adaptively issue the following queries to C. C maintains the corresponding query lists, which are initially empty, and responds to the queries to A\({}_{1}\) as follows. 1. Hash Query. A\({}_{1}\) makes hash function queries to C for any identity ID, and C responds to the hash values to A\({}_{1}\). 2. Partial Private Key Query. A\({}_{1}\) adaptively chooses different ID and summits it to C for querying the partial private key of the ID. C executes the Partial-Private-Key-Gen algorithm to obtain the partial private key for the ID and sends it to A\({}_{1}\). 3. Secret Value Query. A\({}_{1}\) adaptively chooses different ID and summits it to C for querying the secret value of the ID. C runs the Secret-value-Gen algorithm to generate the secret value for the ID and sends it to A\({}_{1}\). 4. Public Key Query. A\({}_{1}\) adaptively chooses different ID and summits it to C for querying the public key of the ID. C performs the algorithm Public-key-Gen to compute the public key for the ID and sends it to A\({}_{1}\). 5. Public Key Replacement. A\({}_{1}\) can repeatedly select a value to replace the public key of any ID. 6. Tag Query. A\({}_{1}\) adaptively chooses the tuple (ID, \(m\)) and submits it to C for querying the tag of the data block \(m\). C runs Tag-Gen algorithm to generate the tag of data block \(m\) and sends it to A\({}_{1}\). **Forge:** Finally, A\({}_{1}\) outputs a forged tag \(\sigma\) for the \(m\) with the identity \(ID\) and the public key \(pk_{ID}\). If the forged tag \(\sigma\) is valid after the above queries, then [PERSON]\({}_{1}\) wins the game. **Game 2:** This game is played by challenger C and adversary A\({}_{2}\) who is able to get the master key but cannot substitute the group user's public key. **Setup:** Challenger C runs the Setup algorithm to obtain the system parameters _params_ and the master secret key _msk_, and forwards _params_ and _msk_ to the adversary A\({}_{2}\). **Queries:** A\({}_{2}\) can make a number of queries to C adaptively. C maintains the corresponding query lists, which are initially empty, and responds to the queries to A\({}_{2}\) as follows. 1. Hash Query. A\({}_{2}\) makes hash function queries to C for any identity ID, and C responds the hash values to A\({}_{2}\). 2. Secret Value Query. A\({}_{2}\) adaptively chooses different ID and summits it to C for querying the secret value of the ID. C runs the Secret-value-Gen algorithm to generate the secret value for the ID and sends it to A\({}_{2}\). Public Key Query. A\({}_{2}\) adaptively chooses different ID and summits it to C for querying the public key of the ID.