# Public Integrity Auditing of Shared Encrypted Data within Cloud Storage Group

Authors: Chunxia Han; Linjie Wang
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

The pandemic of COVID-19 has posed a severe challenge to the traditional on-site centralized development projects; people therefore have to share data in a group by the cloud storage server and develop projects at home. The cloud server is untrustworthy, although it supplies the powerful computing capability and abundant storage space; so far wide research has been proposed to verify data integrity. Therefore, how to leverage the cloud server and ensure the integrity of the data (especially the encrypted data) stored on the remote cloud devices remains an issue for the clients. To address this issue, we utilize the technique of homomorphic hash function to implement reencryption ciphertext blocks and introduce a certificateless signature scheme for the integrity verification of encrypted data shared within a group. A detailed challenge-and-response game represents that the proposed scheme can preserve encrypted data blocks integrity against the internal/external attacker and malicious cloud service servers. We give the theoretical and experimental performance analysis of the scheme and exhibit that the scheme is efficient and practical.


---

## Body

## 1. Introduction

To date, cloud storage service has been an efficient paradigm for storing and sharing data information and a cooperation platform for staff to collaborate in many companies. Once a project manager can upload tasks to the server, each project participant can access, download, and modify the corresponding files through the network without any geographical restriction. Especially with the travel restrictions caused by the COVID-19 pandemic, people can only stay in their own homes and work through the Internet; thereby the use of cloud services for task cooperation and sharing has become particularly important. In the real world, Dropbox for Business [1], TortoiseSVN [2], and Google Drive already have become cloud service platforms for employees to share and collaborate online.However, the prerequisite for this type of application to facilitate many company staff to work together is whether the cloud server provider (CSP) can make sure that the data is retained intact. In the field of cloud services, there is a multitude of inevitable internal and external attacks [3], as a slice of examples, the failure of software or hardware, illegal access, and deliberate deletion or corruption of the outsourced data, resulting in unreliable cloud services. Owing to the existence of these above attacks, the integrity of data is destroyed, which will inevitably reduce the availability and storage significance of data. This paper focuses on the integrity of data stored in the cloud.For decades, to address the integrity verification of data, an army of studies on remote data integrity checking have been proposed by papers [4–16], and these schemes give efficient approaches to verify the integrity of outsourced data on cloud server without downloading them. However, all the above solutions are focused on the integrity auditing for individual data without involving the situation of sharing data in a group. How to verify the integrity of the shared data in a group is an interesting and essential task in the cloud server, which is also another item for the cloud service.Remote data integrity verification is a technology that, for the data stored in the virtual cloud server, there is no need to download the entire file locally to check the integrity of data. When a project with data attached to it is uploaded to a cloud server and shared among multiple engineers, some new challenges emerge and these challenges cannot be solved well with existing individual data integrity verification solutions. According to the above scenario, the project with data attached is divided into blocks and sent to the engineers of the project group, and different engineers will output different block tags in the same block. When a block is modified by the engineers of the project group, the new block tags will be regenerated. In a project group, all engineers will either online or offline compile their tasks, but no matter which kind they are required to store the results of the day’s tasks in the cloud server and generate block tags for checking. To ensure that each engineer is honest to compile the project with the given data, the project manager must act as a verifier to verify the integrity of the data from time to time. When the verifier wants to audit the integrity of raw data, it needs to aggregate all tags with the engineer’s identity information. The process of verification is more complicated and brings a significant volume of calculation [17–24]; these protocols thereby are not valid for the case of data sharing in a group.When the data is shared among the engineers in the project group, also other challenges appear where some engineers in the group maybe withdraw from the group due to some special circumstances, such as being transferred to another project group or misbehaving. As a result of the above situations, the tags generated by the revoked user are invalid and need to be renewed by the other legitimate members. In addition, the data in the shared group also needs to be updated frequently, which also leads the tags to be changed constantly. For security reasons, if the identity of an engineer is revoked, all data as well as the corresponding tags, which belong to the revoked members previously, still have to be renewed by the existing user in the group. According to common sense, when an engineer exits the project, then its task will be transferred to other engineers, and its identity information in the project will be revoked; that is, its public/private key for participating in the project will become invalid. Considering the fact that the shared data is not stored on local devices, the traditional way is to download all data previously generated by the revoked engineer and ask an existing engineer to renew the tags and finally upload the new tags to the cloud server again. This operation can safely transfer the task to the engineer existing in the task, but it may significantly increase the existing engineer communication cost and calculation resources, especially when a considerable volume of the blocks needs to frequently change and update. To overcome the above drawbacks, the execution of the verification operations should be outsourced to CSP instead of execution by the existing engineers. Besides, integrity verification of shared data can be verified not only by the members of the shared data group but also by everyone who wants to leverage the data blocks in the cloud service. As a result, it is of tremendous significance that the scheme to be proposed can meet the public verification with the help of CSP.At present, plenty of integrity verification schemes for shared data in this group have been put forward. Most of them [25–29] focus on the PKI technology based on the trustworthiness of certificate authority (CA), where it is difficult to find a trusted CA. Others are identity-based [28, 30] remote data integrity verification protocols, which rely on the private key generator (PKG) to generate all private keys. However, this approach suffers from a key escrow problem. Therefore, how to efficiently verify the integrity of outsourced data in a shared group by a public verifier and transfer the revoked members’ data to existing members without downloading the data from the cloud service, as well as solving the key escrow and certificate management issues, is a challenging task.Reviewing the existing protocol solutions, we mainly focus on the integrity verification for the encrypted shared data in a group. In this paper, we assume that there is an encrypted business project, which is divided into numerous encrypted subprojects, and it needs plenty of engineers to participate in development. A project manager, who invites the engineers to a temporary project group, takes charge of the system parameters and encrypts the raw project. Then the project blocks encrypted with public keys of specified members in the group are uploaded to the cloud service so that the engineers within the group can modify and upload subprojects compiled online or offline. If this is a big project with plenty of engineers in the project group, there are some issues to be addressed efficiently, for example, the integrity verification after legitimate changes to subprojects under development, the members revocation problem, and the entry of new members.


### 1.1. Contributions

To overcome the disadvantages of previous schemes and address the aforementioned issues, we propose a new remote data possession checking scheme for encrypted shared data group. The contributions of the proposed scheme are presented as follows:(i)
We propose a new remote data possession checking scheme to audit encrypted shared data in each group, in which the certificateless public key system is utilized as an underlying encryption mechanism, and the homomorphism hash approach is used to regenerate the ciphertext to improve the efficiency of member revocation scheme.(ii)
We then construct a public auditing scheme for verifying the integrity of encrypted data in the cloud service provider based on the corresponding certificateless authentication tag aggregation.(iii)
We design a ciphertext conversion scheme which leverages a homomorphic hash function to convert the ciphertext of the revoked member into the ciphertext of the existing member. The scheme has been implemented and the results are more efficient compared to state-of-the-art protocols.(iv)
We have proven the security of the proposed scheme which is based on the stability of CDH and DL assumptions by simulating a challenge-and-response game involving two players: a challenger and an adversary.


### 1.2. Organization

The rest of this paper is organized as follows. Section2 discusses the prior work done in verifying the integrity of group shared data. Section 3 introduces the preliminaries and Section 4 defines the problem statement which includes system model, design goals, outline of the scheme, and the secure model. The detailed construction of our scheme is presented in Section 5. The proposed scheme is simulated and a challenge-and-response secure model is formalized in Section 6, and we assess the efficiency of the proposed scheme in Section 7 based on the computation cost of tag generation and verification, communication cost analysis, and vocation analysis compared with the existing schemes. The conclusion of this paper is presented in Section 8.


## 1.1. Contributions

To overcome the disadvantages of previous schemes and address the aforementioned issues, we propose a new remote data possession checking scheme for encrypted shared data group. The contributions of the proposed scheme are presented as follows:(i)
We propose a new remote data possession checking scheme to audit encrypted shared data in each group, in which the certificateless public key system is utilized as an underlying encryption mechanism, and the homomorphism hash approach is used to regenerate the ciphertext to improve the efficiency of member revocation scheme.(ii)
We then construct a public auditing scheme for verifying the integrity of encrypted data in the cloud service provider based on the corresponding certificateless authentication tag aggregation.(iii)
We design a ciphertext conversion scheme which leverages a homomorphic hash function to convert the ciphertext of the revoked member into the ciphertext of the existing member. The scheme has been implemented and the results are more efficient compared to state-of-the-art protocols.(iv)
We have proven the security of the proposed scheme which is based on the stability of CDH and DL assumptions by simulating a challenge-and-response game involving two players: a challenger and an adversary.


## 1.2. Organization

The rest of this paper is organized as follows. Section2 discusses the prior work done in verifying the integrity of group shared data. Section 3 introduces the preliminaries and Section 4 defines the problem statement which includes system model, design goals, outline of the scheme, and the secure model. The detailed construction of our scheme is presented in Section 5. The proposed scheme is simulated and a challenge-and-response secure model is formalized in Section 6, and we assess the efficiency of the proposed scheme in Section 7 based on the computation cost of tag generation and verification, communication cost analysis, and vocation analysis compared with the existing schemes. The conclusion of this paper is presented in Section 8.


## 2. Related Work

Since Deswarte et al. [4] first proposed a scheme for checking the integrity of data stored on remote virtual cloud servers; so far, a number of auditing schemes have been proposed. Among the proposed schemes, they can be generally divided into two directions: Provable Data Possession (PDP) [5] and Proofs of Retrievability (POR) [23].The PDP scheme is proposed by Ateniese et al. [5] based on RSA signature and sampling strategies to improve the efficiency of integrity checking without retrieving the whole file. However, there is a limitation for this scheme; that is, it is only suitable for the auditing of static data files. To overcome this limitation, Ateniese et al. [31] presented the revised version of PDP based on symmetric encryption to efficiently address the dynamic checking issues instead of handling the insertion operation. Erway et al. [18] gave a dynamic provable data possession (DPDP) scheme, which supports full data dynamic operations to solve the insertion operation and improve the verification efficiency by leveraging the authenticated skip list.To support fully dynamic data, Wang et al. [32], Erway et al. [18], and Zhu et al. [33] successively proposed schemes to construct auditing mechanisms supporting fully dynamic data, respectively. To realize public verification and dynamic data operation, Liu et al. [34] gave a dynamic public auditing scheme based on the Merkle Hash Tree (MHT), in which the block tags are generated by the data owners, and this incurs the increase of communication and calculation cost. To overcome this drawback, a scheme [35] to solve the heavy calculation burden on the data owner side at the expense of data owner’s privacy has been proposed, in which both tag generation and integrity verification are implemented by the cloud server. The issue of privacy-preserving in public auditing has been addressed, in which the data blocks are blinded by a data owner before generating signatures by the third party [36]. In another related research, to avoid the certificate management problem of PKI, some PDP schemes based on Identity-Based Signature (IBS) [37, 38] were proposed. The major problem of IBS is the key escrow, which is solved by a certificateless-based signatures PDP scheme [39].Similar to PDP, the POR is another approach introduced by Juels et al. [23] to audit the integrity of remote data stored on the cloud service. An improved POR scheme is given by Wang et al. [10] to authenticate block tags, in which a security proof is revised in their previous work. Based on the previous works of Erway et al. [18] and Ateniese et al. [5], a generic framework DPOR is proposed by Etemad et al. [40] to store call updated information in the logs. Apart from the aforementioned protocols, some other publicly verifiable protocols are published. Hao et al. [41] gave a public verification without including a TPA, and Shen et al. [42] solved the loss of private key for auditing issue. Wu et al. [43] introduced a time encapsulated POR protocol that could check the integrity of data and timestamp by verifier.All schemes mentioned above mainly devote themselves to verifying the integrity of individual data. Since Wang et al. [44] proposed a scheme for auditing the integrity of data shared in a group in 2012, a succession of verification schemes for sharing data in a group have been proposed [7, 26–29, 45]. Among these schemes, [26, 27, 29, 45] represented PDP schemes for group data based on the signatures, respectively, and all of these schemes are more or less deficient in efficiency and revocation. To solve the multiuser modification problem of blocks, [28] based on PKI mechanism proposed a PDP scheme of polynomial authentication tags, which led to a heavy burden of certificate management. Recently, Li et al. [7] based on certificateless mechanism proposed a public integrity checking of group shared data on cloud storage, which changes the data tags of the revoked member into the existing member’s tags. However, the data within the group in the scheme is all plaintext, which cannot satisfy the situation that the shared data in the group is ciphertext. According to all references mentioned above, although there are numerous schemes that can solve the problems of user adding and revocation in a shared group, on the premise of integrity auditing, there is no verification research on the integrity of encrypted data in a shared group. Therefore, we devote to designing a scheme for the integrity verification of encrypted data group in cloud service, which not only satisfies the member addition and revocation but also decreases the computational burden of challenge proof on the client side with the help of CSP.


## 3. Preliminaries

### 3.1. Bilinear Maps

LetG1 and G2 be two multiplicative cyclic groups of prime order p, and let g be a generator of G1. A bilinear map e:G1×G1⟶G2 has the following properties:(1)
Computability: there exists an efficient algorithm to compute mape.(2)
Bilinearity: for allu,v∈G1 and a,b∈Zp, eua,vb=eu,vab.(3)
Nondegeneracy: there exists a pointg such that eg,g≠1.


### 3.2. Complexity Assumptions

In our scheme, the security is based on the following security assumptions.Definition 1.
(Computational Diffie-Hellman (CHE) Problem). Leta,b∈Zp∗; given the tuple g,ga,gb∈G1 as input, output gab∈G1.Assumption 2.
(Computational Diffie-Hellman (CHE)). For any probabilistic polynomial time (PPT) algorithmA, PrAg,ga,gb⟶gab is negligible, where g,ga,gb←G1.Definition 3.
(Discrete Logarithm (DL) Problem). Letg be a generator of G1; given the tuple g,ga as input, output a∈Zp∗.Assumption 4.
(Discrete Logarithm (DL)). For any probabilistic polynomial time (PPT) algorithmA, PrAg,ga⟶a is negligible, wherea←Zp∗.


### 3.3. Homomorphic Hash Function

For a finite fieldFn and a multiplicative group Zp of orderp, a family of homomorphic hash functions are a collection ℋ=hi:Fn⟶Zq, where i is the index yielded by an efficient algorithm. A homomorphic hash function [46] consists of the following properties:(1)
One way: givenx∈Fn and an index i, there is no polynomial time adversary which can find a hi−1x.(2)
Collision resistance: given an indexi, it is hard (computationally infeasible) to find two vectors x,y∈Fnx≠y for which hix=hiy.(3)
Homomorphism: given an indexi and any x,y∈Fnx≠yhix∘y=hix∘hiy, “∘” is either a “⋅” or a “+.”


## 3.1. Bilinear Maps

LetG1 and G2 be two multiplicative cyclic groups of prime order p, and let g be a generator of G1. A bilinear map e:G1×G1⟶G2 has the following properties:(1)
Computability: there exists an efficient algorithm to compute mape.(2)
Bilinearity: for allu,v∈G1 and a,b∈Zp, eua,vb=eu,vab.(3)
Nondegeneracy: there exists a pointg such that eg,g≠1.


## 3.2. Complexity Assumptions

In our scheme, the security is based on the following security assumptions.Definition 1.
(Computational Diffie-Hellman (CHE) Problem). Leta,b∈Zp∗; given the tuple g,ga,gb∈G1 as input, output gab∈G1.Assumption 2.
(Computational Diffie-Hellman (CHE)). For any probabilistic polynomial time (PPT) algorithmA, PrAg,ga,gb⟶gab is negligible, where g,ga,gb←G1.Definition 3.
(Discrete Logarithm (DL) Problem). Letg be a generator of G1; given the tuple g,ga as input, output a∈Zp∗.Assumption 4.
(Discrete Logarithm (DL)). For any probabilistic polynomial time (PPT) algorithmA, PrAg,ga⟶a is negligible, wherea←Zp∗.


## 3.3. Homomorphic Hash Function

For a finite fieldFn and a multiplicative group Zp of orderp, a family of homomorphic hash functions are a collection ℋ=hi:Fn⟶Zq, where i is the index yielded by an efficient algorithm. A homomorphic hash function [46] consists of the following properties:(1)
One way: givenx∈Fn and an index i, there is no polynomial time adversary which can find a hi−1x.(2)
Collision resistance: given an indexi, it is hard (computationally infeasible) to find two vectors x,y∈Fnx≠y for which hix=hiy.(3)
Homomorphism: given an indexi and any x,y∈Fnx≠yhix∘y=hix∘hiy, “∘” is either a “⋅” or a “+.”


## 4. Problem Statement

In this section, we show the system model and secure model and illustrate the design goals and the outline of our proposed scheme.


### 4.1. System Model

Similar to [7, 27, 29], we combine the cloud architecture with an example of sharing and developing encrypted files by the staffs of a company that are in the same group or department. The system model consists of three major entities: project group (i.e., members involved in the project), cloud service provider (CSP), and public verifier, and the relationship and the interaction situation among them are represented in Figure 1.Figure 1
System model.Project group consists of a volume of project members and a project manager that rents the cloud service platform. In the given example, a project manager is the original owner of the project file and takes charge of dividing the file into encrypted blocks, system parameters generation, member joining/revocation, and sharing the blocks in the project group through a cloud service provider. All project members can access, download, and modify the specified, encrypted data blocks.Cloud service provider offers a wealth of storage services and powerful computing abilities by charging a certain fee. Referring to the research in [7], CSP can honestly implement the scheme but may try to gain the content of stored files and return an incorrect result to the verifier to get some extra benefits. Therefore, we assume that the CSP is semitrusted, encrypting all file blocks stored in the CSP, and generate tags corresponding to the project members.The verifier can be any member of the project group that checks the integrity of encrypted data blocks kept in the CSP. Once a verifier sends an integrity auditing request, the CSP generates and returns the verification information. The verifier then checks the correctness of the auditing proof and reports the verification result.


### 4.2. Design Goals

To efficiently and securely verify shared encrypted data with a volume of members in a project group, our proposed scheme should be designed to achieve the following properties:(i)
Correctness: Based on the challenged proof generation, the verifier is able to correctly detect the integrity of challenging blocks.(ii)
Unforgeability: Only the specified member in the project group can yield valid verification information on the encrypted data blocks.(iii)
Identity privacy: During the integrity of auditing, the CSP cannot distinguish the identity of tag generator on each randomly picked block in the shared project group.(iv)
Tag-updating: When the identity of some members in the project group is revoked or new members are added, the corresponding ciphertext tags should be updated efficiently and securely.(v)
Verifiability: Random verifier is able to verify the integrity of ciphertext attached tags by the challenged proof calculated by the CSP.


### 4.3. Outline of the Scheme

The scheme consists of eight steps:(1)
Setup1κ⟶params,msk: Taking a security parameter κ as input, the project manager implements this step and outputs the master key msk and all system parameters params.(2)
PartialKeyGenIDi,params,msk⟶Di: Taking the member’s identity IDi, the master key msk, and the parameters params as input, the project manager executes this step and outputs member ui’s partial key Di.(3)
KeyGenDi,params⟶sski,spki: Taking the member’s partial key Di and the parameters params as input, the project member runs this step and returns pairing private/public key sski,spki.(4)
Encryptmi,spki⟶σi: Taking the file blocks mi and member’s public key spki as input, the project manager executes this step and generates a ciphertext σi.(5)
TagGenσi,sski⟶Ti: Taking the ciphertext σi and a private sski as input, the project member leverages this step to generate a tag Ti attached to the ciphertext block σi when uploading to CSP.(6)
Challengec⟶chal,Fid: Taking the count of challenged block c as input, the verifier runs this step to output a challenge information chal appending the block name Fid for the integrity querying of the data file.(7)
ProofGenchal,F∗,Ti|i∈n⟶P: Taking the challenge information chal, the challenged encrypted block set F∗, and tag set Ti|i∈n as input, CSP runs this step and responds with the integrity proof P.(8)
Verify ProofP,chal,params⟶0,1: Taking the integrity proof P, the challenge information chal, and the public parameters params as input, the verifier implements this step and returns 1 if result P passes the verification; otherwise, it returns 0.Note that, in addition to the above steps, there are two other steps:JoinGen andRevGen. Step JoinGen is executed by the project members, which invites some other members who are not in the project group, and step RevGen is also implemented by the project members, and the procedure is divided into two scenarios depending on whether the revoked member has invited members to participate in the project group.


### 4.4. Secure Model

Since the certificateless cryptography [47] is the underlay of our new scheme, and referring to the security model of data integrity auditing protocols represented in papers [30, 39, 48], we consider the security requirement and adversary model of the encrypted shared scheme against a fully-adaptive chosen ciphertext attacker (IND-CCA) [47, 49] which involves a challenger C and four types of adversaries, namely ,A1, A2, A3, andA4. Among the four adversary types, although adversaries A1 andA2 both execute the tag-forge attacks, they have different attack capabilities. Type A3 implements the ciphertext integrity proof attack to cheat the verifier, and type A4 tries to generate a forgery of regenerated ciphertext and passes the verification of ciphertext receiver. We give the four following games to illustrate the security model in detail.


#### 4.4.1. Setup

There are two parties, adversaryAi for Ai and challenger C that keeps the private keys and the master key security and sends the public system parameters toAi. Challenger C interacts with adversary Aj for j∈1,2 in this game. In order to generate a forgery of tag in a security game, Aj needs to execute the following different queries: hash query, key query, public key query, public key replacement, encryption query, and tag query.


#### 4.4.2. Common Queries

Aj gives the polynomial times different queries to C which responds to the following queries:(1)
Hash query is adaptively made byAj and the hash values are responded by C.(2)
Key query is adaptively run byAj to submit different target identity ID (first running the step PartialKeyGen byC for ID if necessary) to C for querying the key, and then a key pairing for ID is responded to Aj by C performing the step KeyGen.(3)
Encrypt query is adaptively implemented byAj to submit different plaintext m to C, and then a ciphertext σ with both the randomly picked value r and the public key spkID is responded to Aj by C.(4)
Tag query is adaptively executed byAj to query the tag of any ciphertext block σ with the corresponding member’s identity ID, and then a tag Tag is returned by C running the step TagGen.


#### 4.4.3. Game1

In this game, adversaryA1 not only executes the Common Queries above but also runs the following specialized queries:(1)
Partial key query: is adaptively implemented byA1 to submit different target identity ID to C, and then the partial key for the ID is responded to A1 by C running the step PartialKeyGen.(2)
Public key replacement: According to the assumed capability ofA1, it can replace the public key sskID of any ID with random value sskID′ multiple times if necessary.


#### 4.4.4. Forgery

Eventually, there are two scenarios on the forgery tagTag′ output by adversary A1. One is that A1 outputs a forgery tag Tag′ for the ciphertext block σ encrypted by the public keysskID, and the tag is generated with the public key sskID′ and the identity ID′. The other one is that A1 outputs a forgery tag Tag′ for ciphertext block σ′ encrypted by public key sskID′, and the tag is generated with the public key sskID′ and the identity ID′. In both scenarios, such adversary A1 does not have access to the master key of system, but it can request the public key and has the capability to replace the member’s public key and make the tag queries for all identities of its random choice. However, if A1 wants to win the game, there are several natural restrictions on adversary A1 as discussed below:(1)
A1 cannot request a query on the private key for identity ID′ at any time.(2)
A1 cannot both query the partial key for ID′ and substitute the public key of identity ID′ at the same time.(3)
A1 cannot make a tag query for the encrypted target data block σ′ with the identityID′ and the public key sskID′.(4)
In addition to the above limitations,A1 can forge a valid tag for the encrypted data block σ′ with the identity ID′ and the public key sskID′, and it also can forge a valid tag for the ciphertext block σ encrypted with the legitimate public key sskID, where the tag is generated by the replaced public key sskID′ and the identity ID′.


#### 4.4.5. Game2

In this game, adversaryA2 only executes the Common Queries above and then forges the tag Tag′ for the ciphertext σ′ with the identity ID′.


#### 4.4.6. Forgery

In this process of forgery, adversaryA2 is unable to replace the member’s public key, but it has the capability to access the master key of system. However, there are also two scenarios on the forgery tag Tag′ output by adversary A2. One is that A2 outputs a forgery tag Tag′ for ciphertext block σ encrypted by the public key sskID, and the tag is generated with the public key sskID′ and the identity ID′. The other one is that A2 outputs a forgery tag Tag′ for ciphertext block σ′ encrypted by public key sskID′, and the tag is generated with the public key sskID′ and the identity ID′. In addition, if A2 wants to win the game, it is subject to the following restrictions:(1)
A2 can neither query the private key nor replace the public key for ID′ at any point.(2)
A2 cannot make a tag query for the encrypted target data block σ′ with the identity ID′.(3)
In addition to the above limitations,A2 can forge a valid tag Tag′ for the encrypted data block σ′ with the identityID′, as well as the legitimate public key sskID.Definition 5.
The scheme is semantically secure against the single tag forged attack of the ciphertext block if adversaryA1 or A2 in polynomial probability time has a negligible advantage to win Game1 and Game2.


#### 4.4.7. Game3

In terms of Definition5, an adversary cannot forge a legitimate label for a single ciphertext block without accessing the right private key. In this game, we consider that adversary A3 that acts as the untrusted CSP in the system attempts to persuade the verifier to pass the integrity verification of corrupted data. Inspired by [7], challenger C plays two roles, that is, the honest CSP and an integrity checker, and the operation of Game3 is executed as follows:Tag query: The target tupleID,m is adaptively selected by A3 and sent to C, which responds with the querying tag which is generated with the ciphertext σ and the identity ID by the step TagGen.Challenge: ChallengerC, which acts as the verifier, generates and sends a random challenge information chal to A3, which is requested to respond with the corresponding data possession proof P for chal.Forgery: Once receiving the challenge information chal, A3 acts as the CSP, generates a proof P, and responds toC. The premise for A3 to win the game is that the miscalculated block information in proof P can pass the integrity verification successfully.Definition 6.
The scheme is semantically secure against forging the integrity proof on incorrect data if adversaryA3 in polynomial probability time has a negligible advantage to win Game3.


#### 4.4.8. Game4

In this game, the specified member acts as adversaryA4 that interacts with challenger C. Here, the revoked member and CSP are regarded as the trusted parties. If the reencrypted data has been corrupted, A4 tries to cheat the verifier that the tag generated by reencrypted data can pass the integrity verification. In terms of Definitions 5 and 6, we know that any adversary cannot pass the tag verification on a single block without accessing the private key and correct data. Therefore, the focus of this game is on whether adversary A4 can forge the integrity proof of reencrypted data to pass the verification. Inspired by [7, 29], challenger C plays two roles, that is, the honest CSP and a revoked member, and the operation of Game4 is executed as follows:Reencrypt key query:A4 adaptively picks an identity ID and submits it to challenger C for querying the reencrypting key of ID. C runs the reencrypting key subroutine in step RevGen and returns the reencrypting key rA↔C.Tag query: The target tupleσ,ID is adaptively selected by A4 and sent to C for querying the tag for the reencrypting ciphertext σ′. According to the step RevGen, C responds the tag generated by ciphertext σ′ and ID to adversaryA4.


#### 4.4.9. Forgery

Eventually,A4 outputs a forgery tag Tag′ for the target ciphertext σ with the identity ID.Definition 7.
The scheme is semantically secure against forging the integrity proof without both correct identity and reencryption key if adversaryA4 in polynomial probability time has a negligible advantage to win the aforementioned Game4.


## 4.1. System Model

Similar to [7, 27, 29], we combine the cloud architecture with an example of sharing and developing encrypted files by the staffs of a company that are in the same group or department. The system model consists of three major entities: project group (i.e., members involved in the project), cloud service provider (CSP), and public verifier, and the relationship and the interaction situation among them are represented in Figure 1.Figure 1
System model.Project group consists of a volume of project members and a project manager that rents the cloud service platform. In the given example, a project manager is the original owner of the project file and takes charge of dividing the file into encrypted blocks, system parameters generation, member joining/revocation, and sharing the blocks in the project group through a cloud service provider. All project members can access, download, and modify the specified, encrypted data blocks.Cloud service provider offers a wealth of storage services and powerful computing abilities by charging a certain fee. Referring to the research in [7], CSP can honestly implement the scheme but may try to gain the content of stored files and return an incorrect result to the verifier to get some extra benefits. Therefore, we assume that the CSP is semitrusted, encrypting all file blocks stored in the CSP, and generate tags corresponding to the project members.The verifier can be any member of the project group that checks the integrity of encrypted data blocks kept in the CSP. Once a verifier sends an integrity auditing request, the CSP generates and returns the verification information. The verifier then checks the correctness of the auditing proof and reports the verification result.


## 4.2. Design Goals

To efficiently and securely verify shared encrypted data with a volume of members in a project group, our proposed scheme should be designed to achieve the following properties:(i)
Correctness: Based on the challenged proof generation, the verifier is able to correctly detect the integrity of challenging blocks.(ii)
Unforgeability: Only the specified member in the project group can yield valid verification information on the encrypted data blocks.(iii)
Identity privacy: During the integrity of auditing, the CSP cannot distinguish the identity of tag generator on each randomly picked block in the shared project group.(iv)
Tag-updating: When the identity of some members in the project group is revoked or new members are added, the corresponding ciphertext tags should be updated efficiently and securely.(v)
Verifiability: Random verifier is able to verify the integrity of ciphertext attached tags by the challenged proof calculated by the CSP.


## 4.3. Outline of the Scheme

The scheme consists of eight steps:(1)
Setup1κ⟶params,msk: Taking a security parameter κ as input, the project manager implements this step and outputs the master key msk and all system parameters params.(2)
PartialKeyGenIDi,params,msk⟶Di: Taking the member’s identity IDi, the master key msk, and the parameters params as input, the project manager executes this step and outputs member ui’s partial key Di.(3)
KeyGenDi,params⟶sski,spki: Taking the member’s partial key Di and the parameters params as input, the project member runs this step and returns pairing private/public key sski,spki.(4)
Encryptmi,spki⟶σi: Taking the file blocks mi and member’s public key spki as input, the project manager executes this step and generates a ciphertext σi.(5)
TagGenσi,sski⟶Ti: Taking the ciphertext σi and a private sski as input, the project member leverages this step to generate a tag Ti attached to the ciphertext block σi when uploading to CSP.(6)
Challengec⟶chal,Fid: Taking the count of challenged block c as input, the verifier runs this step to output a challenge information chal appending the block name Fid for the integrity querying of the data file.(7)
ProofGenchal,F∗,Ti|i∈n⟶P: Taking the challenge information chal, the challenged encrypted block set F∗, and tag set Ti|i∈n as input, CSP runs this step and responds with the integrity proof P.(8)
Verify ProofP,chal,params⟶0,1: Taking the integrity proof P, the challenge information chal, and the public parameters params as input, the verifier implements this step and returns 1 if result P passes the verification; otherwise, it returns 0.Note that, in addition to the above steps, there are two other steps:JoinGen andRevGen. Step JoinGen is executed by the project members, which invites some other members who are not in the project group, and step RevGen is also implemented by the project members, and the procedure is divided into two scenarios depending on whether the revoked member has invited members to participate in the project group.


## 4.4. Secure Model

Since the certificateless cryptography [47] is the underlay of our new scheme, and referring to the security model of data integrity auditing protocols represented in papers [30, 39, 48], we consider the security requirement and adversary model of the encrypted shared scheme against a fully-adaptive chosen ciphertext attacker (IND-CCA) [47, 49] which involves a challenger C and four types of adversaries, namely ,A1, A2, A3, andA4. Among the four adversary types, although adversaries A1 andA2 both execute the tag-forge attacks, they have different attack capabilities. Type A3 implements the ciphertext integrity proof attack to cheat the verifier, and type A4 tries to generate a forgery of regenerated ciphertext and passes the verification of ciphertext receiver. We give the four following games to illustrate the security model in detail.


### 4.4.1. Setup

There are two parties, adversaryAi for Ai and challenger C that keeps the private keys and the master key security and sends the public system parameters toAi. Challenger C interacts with adversary Aj for j∈1,2 in this game. In order to generate a forgery of tag in a security game, Aj needs to execute the following different queries: hash query, key query, public key query, public key replacement, encryption query, and tag query.


### 4.4.2. Common Queries

Aj gives the polynomial times different queries to C which responds to the following queries:(1)
Hash query is adaptively made byAj and the hash values are responded by C.(2)
Key query is adaptively run byAj to submit different target identity ID (first running the step PartialKeyGen byC for ID if necessary) to C for querying the key, and then a key pairing for ID is responded to Aj by C performing the step KeyGen.(3)
Encrypt query is adaptively implemented byAj to submit different plaintext m to C, and then a ciphertext σ with both the randomly picked value r and the public key spkID is responded to Aj by C.(4)
Tag query is adaptively executed byAj to query the tag of any ciphertext block σ with the corresponding member’s identity ID, and then a tag Tag is returned by C running the step TagGen.


### 4.4.3. Game1

In this game, adversaryA1 not only executes the Common Queries above but also runs the following specialized queries:(1)
Partial key query: is adaptively implemented byA1 to submit different target identity ID to C, and then the partial key for the ID is responded to A1 by C running the step PartialKeyGen.(2)
Public key replacement: According to the assumed capability ofA1, it can replace the public key sskID of any ID with random value sskID′ multiple times if necessary.


### 4.4.4. Forgery

Eventually, there are two scenarios on the forgery tagTag′ output by adversary A1. One is that A1 outputs a forgery tag Tag′ for the ciphertext block σ encrypted by the public keysskID, and the tag is generated with the public key sskID′ and the identity ID′. The other one is that A1 outputs a forgery tag Tag′ for ciphertext block σ′ encrypted by public key sskID′, and the tag is generated with the public key sskID′ and the identity ID′. In both scenarios, such adversary A1 does not have access to the master key of system, but it can request the public key and has the capability to replace the member’s public key and make the tag queries for all identities of its random choice. However, if A1 wants to win the game, there are several natural restrictions on adversary A1 as discussed below:(1)
A1 cannot request a query on the private key for identity ID′ at any time.(2)
A1 cannot both query the partial key for ID′ and substitute the public key of identity ID′ at the same time.(3)
A1 cannot make a tag query for the encrypted target data block σ′ with the identityID′ and the public key sskID′.(4)
In addition to the above limitations,A1 can forge a valid tag for the encrypted data block σ′ with the identity ID′ and the public key sskID′, and it also can forge a valid tag for the ciphertext block σ encrypted with the legitimate public key sskID, where the tag is generated by the replaced public key sskID′ and the identity ID′.


### 4.4.5. Game2

In this game, adversaryA2 only executes the Common Queries above and then forges the tag Tag′ for the ciphertext σ′ with the identity ID′.


### 4.4.6. Forgery

In this process of forgery, adversaryA2 is unable to replace the member’s public key, but it has the capability to access the master key of system. However, there are also two scenarios on the forgery tag Tag′ output by adversary A2. One is that A2 outputs a forgery tag Tag′ for ciphertext block σ encrypted by the public key sskID, and the tag is generated with the public key sskID′ and the identity ID′. The other one is that A2 outputs a forgery tag Tag′ for ciphertext block σ′ encrypted by public key sskID′, and the tag is generated with the public key sskID′ and the identity ID′. In addition, if A2 wants to win the game, it is subject to the following restrictions:(1)
A2 can neither query the private key nor replace the public key for ID′ at any point.(2)
A2 cannot make a tag query for the encrypted target data block σ′ with the identity ID′.(3)
In addition to the above limitations,A2 can forge a valid tag Tag′ for the encrypted data block σ′ with the identityID′, as well as the legitimate public key sskID.Definition 5.
The scheme is semantically secure against the single tag forged attack of the ciphertext block if adversaryA1 or A2 in polynomial probability time has a negligible advantage to win Game1 and Game2.


### 4.4.7. Game3

In terms of Definition5, an adversary cannot forge a legitimate label for a single ciphertext block without accessing the right private key. In this game, we consider that adversary A3 that acts as the untrusted CSP in the system attempts to persuade the verifier to pass the integrity verification of corrupted data. Inspired by [7], challenger C plays two roles, that is, the honest CSP and an integrity checker, and the operation of Game3 is executed as follows:Tag query: The target tupleID,m is adaptively selected by A3 and sent to C, which responds with the querying tag which is generated with the ciphertext σ and the identity ID by the step TagGen.Challenge: ChallengerC, which acts as the verifier, generates and sends a random challenge information chal to A3, which is requested to respond with the corresponding data possession proof P for chal.Forgery: Once receiving the challenge information chal, A3 acts as the CSP, generates a proof P, and responds toC. The premise for A3 to win the game is that the miscalculated block information in proof P can pass the integrity verification successfully.Definition 6.
The scheme is semantically secure against forging the integrity proof on incorrect data if adversaryA3 in polynomial probability time has a negligible advantage to win Game3.


### 4.4.8. Game4

In this game, the specified member acts as adversaryA4 that interacts with challenger C. Here, the revoked member and CSP are regarded as the trusted parties. If the reencrypted data has been corrupted, A4 tries to cheat the verifier that the tag generated by reencrypted data can pass the integrity verification. In terms of Definitions 5 and 6, we know that any adversary cannot pass the tag verification on a single block without accessing the private key and correct data. Therefore, the focus of this game is on whether adversary A4 can forge the integrity proof of reencrypted data to pass the verification. Inspired by [7, 29], challenger C plays two roles, that is, the honest CSP and a revoked member, and the operation of Game4 is executed as follows:Reencrypt key query:A4 adaptively picks an identity ID and submits it to challenger C for querying the reencrypting key of ID. C runs the reencrypting key subroutine in step RevGen and returns the reencrypting key rA↔C.Tag query: The target tupleσ,ID is adaptively selected by A4 and sent to C for querying the tag for the reencrypting ciphertext σ′. According to the step RevGen, C responds the tag generated by ciphertext σ′ and ID to adversaryA4.


### 4.4.9. Forgery

Eventually,A4 outputs a forgery tag Tag′ for the target ciphertext σ with the identity ID.Definition 7.
The scheme is semantically secure against forging the integrity proof without both correct identity and reencryption key if adversaryA4 in polynomial probability time has a negligible advantage to win the aforementioned Game4.


## 4.4.1. Setup

There are two parties, adversaryAi for Ai and challenger C that keeps the private keys and the master key security and sends the public system parameters toAi. Challenger C interacts with adversary Aj for j∈1,2 in this game. In order to generate a forgery of tag in a security game, Aj needs to execute the following different queries: hash query, key query, public key query, public key replacement, encryption query, and tag query.


## 4.4.2. Common Queries

Aj gives the polynomial times different queries to C which responds to the following queries:(1)
Hash query is adaptively made byAj and the hash values are responded by C.(2)
Key query is adaptively run byAj to submit different target identity ID (first running the step PartialKeyGen byC for ID if necessary) to C for querying the key, and then a key pairing for ID is responded to Aj by C performing the step KeyGen.(3)
Encrypt query is adaptively implemented byAj to submit different plaintext m to C, and then a ciphertext σ with both the randomly picked value r and the public key spkID is responded to Aj by C.(4)
Tag query is adaptively executed byAj to query the tag of any ciphertext block σ with the corresponding member’s identity ID, and then a tag Tag is returned by C running the step TagGen.


## 4.4.3. Game1

In this game, adversaryA1 not only executes the Common Queries above but also runs the following specialized queries:(1)
Partial key query: is adaptively implemented byA1 to submit different target identity ID to C, and then the partial key for the ID is responded to A1 by C running the step PartialKeyGen.(2)
Public key replacement: According to the assumed capability ofA1, it can replace the public key sskID of any ID with random value sskID′ multiple times if necessary.


## 4.4.4. Forgery

Eventually, there are two scenarios on the forgery tagTag′ output by adversary A1. One is that A1 outputs a forgery tag Tag′ for the ciphertext block σ encrypted by the public keysskID, and the tag is generated with the public key sskID′ and the identity ID′. The other one is that A1 outputs a forgery tag Tag′ for ciphertext block σ′ encrypted by public key sskID′, and the tag is generated with the public key sskID′ and the identity ID′. In both scenarios, such adversary A1 does not have access to the master key of system, but it can request the public key and has the capability to replace the member’s public key and make the tag queries for all identities of its random choice. However, if A1 wants to win the game, there are several natural restrictions on adversary A1 as discussed below:(1)
A1 cannot request a query on the private key for identity ID′ at any time.(2)
A1 cannot both query the partial key for ID′ and substitute the public key of identity ID′ at the same time.(3)
A1 cannot make a tag query for the encrypted target data block σ′ with the identityID′ and the public key sskID′.(4)
In addition to the above limitations,A1 can forge a valid tag for the encrypted data block σ′ with the identity ID′ and the public key sskID′, and it also can forge a valid tag for the ciphertext block σ encrypted with the legitimate public key sskID, where the tag is generated by the replaced public key sskID′ and the identity ID′.


## 4.4.5. Game2

In this game, adversaryA2 only executes the Common Queries above and then forges the tag Tag′ for the ciphertext σ′ with the identity ID′.


## 4.4.6. Forgery

In this process of forgery, adversaryA2 is unable to replace the member’s public key, but it has the capability to access the master key of system. However, there are also two scenarios on the forgery tag Tag′ output by adversary A2. One is that A2 outputs a forgery tag Tag′ for ciphertext block σ encrypted by the public key sskID, and the tag is generated with the public key sskID′ and the identity ID′. The other one is that A2 outputs a forgery tag Tag′ for ciphertext block σ′ encrypted by public key sskID′, and the tag is generated with the public key sskID′ and the identity ID′. In addition, if A2 wants to win the game, it is subject to the following restrictions:(1)
A2 can neither query the private key nor replace the public key for ID′ at any point.(2)
A2 cannot make a tag query for the encrypted target data block σ′ with the identity ID′.(3)
In addition to the above limitations,A2 can forge a valid tag Tag′ for the encrypted data block σ′ with the identityID′, as well as the legitimate public key sskID.Definition 5.
The scheme is semantically secure against the single tag forged attack of the ciphertext block if adversaryA1 or A2 in polynomial probability time has a negligible advantage to win Game1 and Game2.


## 4.4.7. Game3

In terms of Definition5, an adversary cannot forge a legitimate label for a single ciphertext block without accessing the right private key. In this game, we consider that adversary A3 that acts as the untrusted CSP in the system attempts to persuade the verifier to pass the integrity verification of corrupted data. Inspired by [7], challenger C plays two roles, that is, the honest CSP and an integrity checker, and the operation of Game3 is executed as follows:Tag query: The target tupleID,m is adaptively selected by A3 and sent to C, which responds with the querying tag which is generated with the ciphertext σ and the identity ID by the step TagGen.Challenge: ChallengerC, which acts as the verifier, generates and sends a random challenge information chal to A3, which is requested to respond with the corresponding data possession proof P for chal.Forgery: Once receiving the challenge information chal, A3 acts as the CSP, generates a proof P, and responds toC. The premise for A3 to win the game is that the miscalculated block information in proof P can pass the integrity verification successfully.Definition 6.
The scheme is semantically secure against forging the integrity proof on incorrect data if adversaryA3 in polynomial probability time has a negligible advantage to win Game3.


## 4.4.8. Game4

In this game, the specified member acts as adversaryA4 that interacts with challenger C. Here, the revoked member and CSP are regarded as the trusted parties. If the reencrypted data has been corrupted, A4 tries to cheat the verifier that the tag generated by reencrypted data can pass the integrity verification. In terms of Definitions 5 and 6, we know that any adversary cannot pass the tag verification on a single block without accessing the private key and correct data. Therefore, the focus of this game is on whether adversary A4 can forge the integrity proof of reencrypted data to pass the verification. Inspired by [7, 29], challenger C plays two roles, that is, the honest CSP and a revoked member, and the operation of Game4 is executed as follows:Reencrypt key query:A4 adaptively picks an identity ID and submits it to challenger C for querying the reencrypting key of ID. C runs the reencrypting key subroutine in step RevGen and returns the reencrypting key rA↔C.Tag query: The target tupleσ,ID is adaptively selected by A4 and sent to C for querying the tag for the reencrypting ciphertext σ′. According to the step RevGen, C responds the tag generated by ciphertext σ′ and ID to adversaryA4.


## 4.4.9. Forgery

Eventually,A4 outputs a forgery tag Tag′ for the target ciphertext σ with the identity ID.Definition 7.
The scheme is semantically secure against forging the integrity proof without both correct identity and reencryption key if adversaryA4 in polynomial probability time has a negligible advantage to win the aforementioned Game4.


## 5. Our Scheme

Without loss of generality, there is a project manager namedu0 in the group which is in charge of the generation of system parameters and other engineers’ partial secret keys. Suppose that the project F is divided into n project blocks as the following M=m1,m2,⋯,mn. u0 invites z engineers in one group to execute this project, and each engineer ui has a unique identity represented as IDi for 1≤i≤z. In order to keep the security of each block, all project blocks stored on the CSP should be encrypted by the public key of the corresponding developing engineer; namely, C∗=σ1,σ2,⋯,σn, in which σi represents the ciphertext of ith subproject mi. The scheme consists of the following steps:Setup1κ: u0 takes as input a security parameterκ and outputs the public parameters including two multiplicative cyclic groups G1 and G2 and a bilinear map e:G1×G1⟶G2, where the orders of G1 and G2 are both the big prime q and g is a generator of G1. It sets two collision-resistant hash functions H1:0,1∗⟶G1∗ andH2:0,1∗⟶G1∗. Two pseudorandom generators π and ϕ are selected, where π:Zq∗×1,2,⋯,n⟶Zq∗ and ϕ:Zq∗×1,2,⋯,n⟶1,2,⋯,n are used to generate the pseudorandom value and pseudorandom permutation, respectively. u0 selects a master key msk=s∈Zq∗ and calculates the public key P0=gs. All the parameters params=q,g,G1,G2,e,P0,H1,H2,ϕ,π are published.PartialKeyGen: When receiving the identity IDi of the participant engineer ui, the project manager u0 returns Di=H1IDis by secure channel as the partial private key of ui.KeyGen: IDi randomly selects secret value xi∈Zq∗ as a partial private key and constructs IDi’s private/public key pairs sski,spki as sski=Dixi,xi and spki=Xi,Yi, where Xi=gxi and Yi=P0xi.Encrypt: The project manager u0 randomly picks a value ri∈Zq∗ and encrypts l project blocks (engineer ui could be assigned l project blocks)mi1,⋯,mil intoσi1,⋯,σil leveraging ui’s public key spki and uploads them to the CSP, where mij∈Zq, σij=σij1,σij2 forσij1=mij⊕H2eH1IDi,Yiri,σij2=gri, andj∈1,l. Note that u0 only executes this step once, encrypting the corresponding project blocks by utilizing every engineer’s public key, and later this step is mainly implemented by the engineers involved in the project.TagGen: Since each block has a unique file name Fid, a tag will be generated for all the encrypting blocks of file F. Suppose that the project engineer ui wants to generate tags for each uploaded encrypted block σi′. It randomly picks a parameter ri′∈Zq∗1≤i≤z, first encrypts its developed project blocks mik′1≤k≤l into σik′=σik1′,σik2′, and then generates tags Tik=H2ωik⋅σik2′xi⋅Diσik1′ for the ciphertexts, whereωik=Fidk‖n‖ik. Then, project engineer ui uploads σik′,Tik|k∈1,l to the CSP. Then, the CSP utilizes the public parameters and the data provided by the user to construct an (1) to check the correctness of all ui’s tags:(1)e∏k=1lTik,g=eσi2′l⋅∏k=1lH2ωik,Xi⋅eH1IDi∑k=1lσik1′,P0,where σi2′=gxi.Challenge: Anyone as a verifier can check the integrity of group data stored in CSP. The verifier randomly picks the challenged block count c1≤c≤n and two valuesk1,k2∈Zq∗. Then the challenged information chal=c,k1,k2 appending the file name Fid is sent to CSP.ProofGen: Once the CSP receives chal=c,k1,k2, the challenge information set I=vi′,ai is calculated, in which ai=πk1,i is the regenerated parameter by the pseudorandom generatorπ, and the subset vi′|i∈1,c (for vi′=ϕk2,i) of 1,2,⋯,n is a new index permutation of challenge block regenerated by the pseudorandom generatorϕ. Without loss of generality, suppose that the challenge block set consists of encrypted blocks σv1′,σv2′,⋯,σvc′ and letC denote σv1′,σv2′,⋯,σvc′. Let the challenge block subsets Cl1=σv1,⋯,σvj, Cl2=σvj+1,⋯,σvt⋯, Clz′=σvu+1,⋯,σvc belong to engineers ul1, ul2, ⋯, ulz′, respectively, where the permutation v1,⋯,vj,⋯,vu+1,⋯,vc is the rearrangement of permutation v1′,v2′,⋯,vc′. We can obtain C=Cl1∪Cl2∪⋯∪Clz′ and Clk∩Clk′=∅ for k≠k′, where the set l1,l2,⋯,lz′ is the subset of permutation1,2,⋯,z and Cl1+Cl2+⋯+Clz′=c. The CSP calculates two sets T=T¯1,⋯,T¯z′ and F=F¯1,⋯,F¯z′, where T¯k=∏vj∈ClkTvjaj and F¯k=∑vj∈Clkajσvj1′. Finally, the proof P=T,F is sent to the verifier.VerifyProof: Upon receiving proof P, the verifier utilizes the precalculated values set vi′,ai to generate a set of challenge blocks. According to the tag generation rules, the verifier obtains ωvi to generate all the tags Tviai of participating challenge blocks. Then it takes all above proof information as input to check whether (2) holds, where lk′=Clk:(2)e∏k=1z′T¯k,g=∏k=1z′e∏vj∈ClkH2ωvj⋅σvj2′lk′,Xlkaj⋅e∏k=1z′H1IDlkF¯k,P0.If this equation holds, it outputs either1 (”accept“) or 0 (”reject“). The correctness of this scheme can be checked by the following equality:(3)e∏k=1z′T¯k,g=∏k=1z′eTk,g=∏k=1z′e∏vj∈CkTvjaj,g=∏k=1z′e∏vj∈ClkH2ωvj⋅σvj2′xvj⋅Dvjσik1′aj,g=∏k=1z′e∏vj∈ClkH2ωvjxvjaj⋅σvj2′xvjaj,g⋅e∏vj∈ClkDvjσik1′aj,g=lk′=Clk∏k=1z′e∏vj∈ClkH2ωvj⋅σvj2′lk′,gxvjaj⋅eH1IDvj∑σik1′aj,P0=∏k=1z′e∏vj∈ClkH2ωvj⋅σvj2′lk′,Xlkaj⋅e∏k=1z′H1IDlkF¯k,P0.


### 5.1. Invite to Join

If engineerui invites another engineer uj to participate in its subproject, ui first sends an identity concatenation IDj‖IDi to u0, and then u0 responds a partial private key Dji=H1IDj||IDis to uj by secure channel. uj randomly chooses xji∈Zq∗ to generate its secure key sskji=Djixji,xji and public key spkji=Xji,Yji, where Xji=gxji and Yji=P0xji.Whileuj successfully joins the project and wants to editui’s some block (named mik′), the specified file ciphertext block σik1′ needs to converted to a block encrypted by uj’s public key. The reencryption key ri↔j is generated and the ciphertext σik1′ turns into σjik1′ which is encrypted by uj’s private key and parameter ri randomly picked by u0. Note that the reencryption key ri↔j is bidirectional; that is, it can be utilized to transfer the ciphertext from uj to u0 and vice versa.JoinGenIDi,IDj⟶ri↔j: When receiving the identity IDj, ui calculates the reencryption key ri↔j=H2eH1IDi,Yiri⊕eH1IDj‖IDi,Yjiri and sends it touj. Then uj calculates ciphertext σjik1′ for block mik′ as σjik1′=σik1′⊕ri↔j=mik′⊕H2eH1IDi,Yiri⊕H2eH1IDi,Yiri⊕eH1IDj‖IDi,Yjiri=mij′⊕H2eH1IDi,Yiri⊕H2eH1IDi,Yiri⊕H2eH1IDj‖IDi,Yjiri=mik′⊕H2eH1IDj‖IDi,Yjiri=mik′⊕H2eDjixji,gri..


### 5.2. Revoke a Participant

Once an engineerui leaves the project, the project manager u0 should claim the private/public key pairings of u0 to be invalid. At the same time, the contents consisting of the ciphertext, tags, and so forth of the file block associated with the revoked engineer ui are also changed. Otherwise, there are some secure risks on the ciphertext and tags which are executed by ui; thereby the integrity of the ciphertext cannot be checked either. In this process, there are two situations to be considered: one is that the revoked user ui has invited engineers in the project, and, in this case, any inviter (named uj) can be required to replace the tag and ciphertext of the revoked user. In the other case, ui does not invite any users to participate in the project, so the project manager needs to convert the ciphertext and tags for ui. We represent the detailed implementation as follows:RevGen: Assume that ui is the revoked project member, and uj is the member who continues the project in place of ui. In this section, CSP is used to check the correctness of regenerated tags by uj. In addition, suppose that ui, uj, and CSP are all online simultaneously during this procedure.Without loss of generality, let memberuj as a specified recipient take charge of all blocks of the revoked engineerui. ui utilizes the step JoinGen to regenerate the ciphertext of uj, and the block tag is yielded by uj.(1)
ui calculates ri↔j and sends it to uj, where ri↔j=H2eH1IDi,Yiri⊕eH1IDj⋅Yjri.(2)
Leveraging the keyri↔j, uj calculates σjk1′=ri↔j⊕σik1′=mik′⊕H2eH1IDj,Yjri andσjk2′=σik2′=gri and publishes the regenerated ciphertext σjk′=σjk1′,σjk2′ of block mik′ for 1≤k≤l. Then, uj calculates the tag Tjk=H2ωjk⋅σjk2′xj⋅Djσjk1′ to CSP forωjk=Fidk‖n‖ik.(3)
While receiving the tupleσjk′,Tjk, CSP verifies (1) to ensure the validity of the tags.


## 5.1. Invite to Join

If engineerui invites another engineer uj to participate in its subproject, ui first sends an identity concatenation IDj‖IDi to u0, and then u0 responds a partial private key Dji=H1IDj||IDis to uj by secure channel. uj randomly chooses xji∈Zq∗ to generate its secure key sskji=Djixji,xji and public key spkji=Xji,Yji, where Xji=gxji and Yji=P0xji.Whileuj successfully joins the project and wants to editui’s some block (named mik′), the specified file ciphertext block σik1′ needs to converted to a block encrypted by uj’s public key. The reencryption key ri↔j is generated and the ciphertext σik1′ turns into σjik1′ which is encrypted by uj’s private key and parameter ri randomly picked by u0. Note that the reencryption key ri↔j is bidirectional; that is, it can be utilized to transfer the ciphertext from uj to u0 and vice versa.JoinGenIDi,IDj⟶ri↔j: When receiving the identity IDj, ui calculates the reencryption key ri↔j=H2eH1IDi,Yiri⊕eH1IDj‖IDi,Yjiri and sends it touj. Then uj calculates ciphertext σjik1′ for block mik′ as σjik1′=σik1′⊕ri↔j=mik′⊕H2eH1IDi,Yiri⊕H2eH1IDi,Yiri⊕eH1IDj‖IDi,Yjiri=mij′⊕H2eH1IDi,Yiri⊕H2eH1IDi,Yiri⊕H2eH1IDj‖IDi,Yjiri=mik′⊕H2eH1IDj‖IDi,Yjiri=mik′⊕H2eDjixji,gri..


## 5.2. Revoke a Participant

Once an engineerui leaves the project, the project manager u0 should claim the private/public key pairings of u0 to be invalid. At the same time, the contents consisting of the ciphertext, tags, and so forth of the file block associated with the revoked engineer ui are also changed. Otherwise, there are some secure risks on the ciphertext and tags which are executed by ui; thereby the integrity of the ciphertext cannot be checked either. In this process, there are two situations to be considered: one is that the revoked user ui has invited engineers in the project, and, in this case, any inviter (named uj) can be required to replace the tag and ciphertext of the revoked user. In the other case, ui does not invite any users to participate in the project, so the project manager needs to convert the ciphertext and tags for ui. We represent the detailed implementation as follows:RevGen: Assume that ui is the revoked project member, and uj is the member who continues the project in place of ui. In this section, CSP is used to check the correctness of regenerated tags by uj. In addition, suppose that ui, uj, and CSP are all online simultaneously during this procedure.Without loss of generality, let memberuj as a specified recipient take charge of all blocks of the revoked engineerui. ui utilizes the step JoinGen to regenerate the ciphertext of uj, and the block tag is yielded by uj.(1)
ui calculates ri↔j and sends it to uj, where ri↔j=H2eH1IDi,Yiri⊕eH1IDj⋅Yjri.(2)
Leveraging the keyri↔j, uj calculates σjk1′=ri↔j⊕σik1′=mik′⊕H2eH1IDj,Yjri andσjk2′=σik2′=gri and publishes the regenerated ciphertext σjk′=σjk1′,σjk2′ of block mik′ for 1≤k≤l. Then, uj calculates the tag Tjk=H2ωjk⋅σjk2′xj⋅Djσjk1′ to CSP forωjk=Fidk‖n‖ik.(3)
While receiving the tupleσjk′,Tjk, CSP verifies (1) to ensure the validity of the tags.


## 6. Security Proof

In this section, we give the secure proof of the proposed scheme via the following properties.


### 6.1. Security Analysis

Theorem 1.
If a polynomial probability time adversaryA1 has an advantageε to win Game1 described in Section 4.4 within time t after executing the most qH1 Hash-1 queries, qK key queries, qR Public Key Replace, qE encryption queries, and qH2 Hash-2 queries and requesting at most qT times tag queries, then there exists a ε′,t-simulator ℬ that can address the CDH problem with ε′≥ε/1+qp+qT⋅et′≤t+qH1+qp+3qK+3qH2+2qTte+3tmqT+qR+qE, where one exponentiation costs time te onG1, one scalar multiplication operation costs time tm inG1, and e is the base of natural logarithm.Proof.
On inputg,ga,gb in G1, if adversary A1 is able to forge a tag with the identityID and the replaced public key in Game1, then algorithm ℬ has capability to address CDH problem; that is, it can calculategab. Given g,ga, and gb, simulator ℬ simulates each step of interaction with A as follows:
Setup.A1 launches a query-respond game. ℬ sets P0=ga with the master key a which is security picked and then outputs and returns the system parameters params=q,g,G1,G2,e,P0,H1,H2,ϕ,π to A1.
Hash-1 Query.A1 adaptively requests the Hash-1 query results for any identity ID∗ in terms of its capability. In order to facilitate the management of all the query results, ℬ establishes a tuple list L1=ID,r,Q,τ to record all query data. If a certain ID∗ has been recorded in the list, ℬ directly returns its corresponding tuple ID∗,r∗,Q∗,τ∗ to A1. Otherwise, ℬ selects a random value r∗∈Zq∗ and tosses a coin τ∈0,1. Assume that the coin represents 1 with a probability of γ, and vice versa, 1−γ. If τ shows 0, ℬ sets Q∗=H1ID∗=gr∗∈G1; if τ shows 1, ℬ setsQ∗=H1ID∗=gbr∗∈G1. Then the result Q∗ is returned to A1 and the tuple ID∗,Q∗,∗,∗ is inserted to list L1, where the symbol ∗ indicates that the position is empty and has no value, which may be generated in a subsequent query.
Partial key query. In order to obtain the partial key of any identityID∗, A1 adaptively implements partial key query. ℬ firstly checks whetherID∗ corresponding tuple ID∗,r∗,Q∗,τ∗ exists in L1. If not, ℬ executes the Hash-1 query and inserts the result in L1. Notably, another new tuple list L2 is established by ℬ to manage the newly queried data during this process, where L2=ID,DID,spkID,sskID,σID. If τ shows 1 in L1, ℬ returns⊥ for ID∗ and then records the tuple value ID∗,⊥,∗,∗,∗ in L2. Otherwise, ℬ responds the partial key query as follows.(1)
IfID∗ is stored in listL2, ℬ checks whether the location of DID∗ is a symbol⊥ or not. If it is not ⊥, ℬ returns it directly to A. Otherwise, ℬ reexecutes the coin tossing step in Hash-1 query. When the coin tosses τ=0, ℬ returns the value DID∗=Q∗a=gar∗ to A1 and then updates the values Q∗, τ in L1, andDID∗ in L2 on the corresponding identity ID∗, respectively; otherwise, τ=1, and ℬ aborts.(2)
IfID∗ is not stored in list L2, ℬ determines the value of DID∗ according to τ in list L1. If τ=0, ℬ returns DID∗=gar∗ to A1; otherwise, τ=1, and ℬ aborts.
Note that the tuple inL1 and L2 has such a characteristic: the value of τ in the tuple ID,Q,r,τ of L1 corresponding to the tuple ID,⊥,∗,∗,∗ of L2 is 1; the value of τ in the tuple ID,Q,r,τ of L1 corresponding to the tuple ID,DID∗,spkID∗,sskID∗,σID∗ inL2 is 0.
Key query.A1 adaptively requests the key query for any identityID∗. ℬ searches list L2 for the tuple ID,DID∗,spkID∗,sskID∗,σID∗.(1)
If the tupleID,DID∗,spkID∗,sskID∗,σID∗ is stored in L2, ℬ first checks whether the position of DID∗ is ⊥ or not. IfDID∗=⊥, ℬ turns to execute Hash-1 query and partial key query in turn. Otherwise, ℬ checks whether the position of spkID∗ in this tuple is the symbol ∗. If spkID∗=∗, ℬ selects xID∗∈Zq∗ at random and setssskID∗=DID∗xID∗,xID∗ and spkID∗=XID∗,YID∗=gxID∗,P0xID∗. ℬ updates the tuple ID,DID∗,∗,∗,∗ into L2 and sends the key pairing spkID∗,sskID∗ to A1.(2)
If the tupleID,DID∗,spkID∗,sskID∗,σID∗ is not stored in L2, ℬ turns to execute Hash-1 query and partial key query in turn. Once the value ofDID∗ has been obtained after the Hash-1 query and partial key query, ℬ randomly selectsxID∗∈Zq∗ and sets sskID∗=DID∗xID∗,xID∗ and spkID∗=XID∗,YID∗=gxID∗,P0xID∗. ℬ inserts the tuple ID,DID∗,spkID∗,sskID∗,σID∗ into L2 and returns spkID∗,sskID∗ to A1. On the other hand, if DID∗=⊥, the tuple ID,⊥,∗,∗,∗ is inserted intoL2, and ℬ aborts.
Public Key Replace. According to the assumption, adversaryA1 has capability to replace the public key. A1 adaptively implements the Public Key Replace for the target memberID∗ with the substitution public key spkID∗′.(1)
If the tupleID∗,DID∗,spkID∗,sskID∗,∗ is stored inL2, ℬ modifies the tuple as ID∗,DID∗,spkID∗′,∗,∗ in terms of A1’s request, where spkID∗′=XID∗′,YID∗′.(2)
If the tupleID∗,DID∗,spkID∗,sskID∗,∗ is not contained inL2, ℬ adds the tuple ID∗,∗,spkID∗′,∗,∗ to L2 in terms ofA1’s request, where spkID∗′=XID∗′,YID∗′.
Hash-2 query. In order to facilitate the management of Hash-2 query, a listL3=VID,σID2,ωID,λ,h is still established by ℬ to record the participating tuple. As required, A1 runs the Hash-2 query on the identity ID∗, partial public key YID∗, and Hash-1 query Q∗. ℬ randomly picks a tuple value λ∗,h∗ and calculates VID∗=H2eQ∗,YID∗′λ∗, σID2∗=gλ∗, and H2ωID∗=gh∗ and then sends VID∗,σID2∗ and H2ωID∗ to A1. The new tuple VID∗,σID2∗,ωID∗,λ∗,h∗ is added in L3.
Encrypt query. For any plaintextm, A1 adaptively requests the encrypt query with identityID∗. ℬ searches list L2 for the tupleID∗,DID∗,spkID∗,sskID∗,σID∗. If the tuple ID∗,DID∗,spkID∗,sskID∗,σID∗ is stored in L2, ℬ returns σID∗ directly toA1. Otherwise, whether the tuple is ID∗,⊥,∗,∗,∗ or ID∗,∗,spkID∗′,∗,∗, ℬ calculates the ciphertext σID∗′ with the replaced key spkID∗′, in which σID∗′=σID1∗′,σID2∗′ andσID1∗′=mID∗⊕VID∗. Then, ℬ updates the tuple ID,⊥,spkID∗′,∗,σID∗′ and ID∗,∗,spkID∗′,∗,σID∗′ in L2, respectively.
Tag query.A1 adaptively requests the tag on any identityID∗ and plaintext block mID∗ by submitting the result ofσID∗. Based on the result of tossing the coin in L1; if τ∗=1, ℬ aborts. Otherwise, based on the values of H2ωID∗ in L3 and both DID∗ andσID∗ inL2, ℬ generates the tag for the tuple DID∗,σID∗,H2ωID∗ by step TagGen and returns it to A1.
Forgery. Eventually, a forgery tagT′, which is relevant to plaintext m′ on the identityID′ with the public key spkID′, is forged by A1. If τ=0, ℬ aborts. Otherwise, based on the aforementioned operations, ℬ holds the following values: H1ID′=gbr′, σID2′=gλ′, P0=ga, and H2ωID′=gh′, σID1′, andXID′, and then it can output gab=T′/XID′λ+h1/r′σID′ solving the proposed CDH problem.
Analysis. Now, we analyze the probability thatℬ can guess the correct query of the target data block by simulating operation. Similar to the analysis and proof of [48, 50], ℬ only halts two queries on partial key query and tag query; therefore the probability of ℬ implementing the queries is higher than 1−γqp+qT. Assume that the probability of occurrence of output of the right value of gab for ℬ is ε⋅γ⋅1−γqp+qT.
Let(4)ε′=ε⋅γ⋅1−γ.
In order to find the minimum value ofε′, let us take the derivatives of both sides of (4) with respect to γ:(5)dε′dγ=dε⋅γ⋅1−γqp+qTdγ=ε⋅1−γqp+qT−ε⋅γ⋅qp+qT⋅1−γqp+qT−1=ε⋅1−γqp+qT−1⋅1−γ⋅qp+qT+1.
Replacedε′/dγ=0; that is,(6)ε⋅1−γqp+qT−1⋅1−γ⋅qp+qT+1.
We can obtainγopt=1/1+qp+qT. Thereby (4) becomes(7)ε′=ε⋅γ⋅1−γqp+qT≥ε⋅11+qp+qT⋅1−11+qp+qTqp+qT.
According to the formulalimitn⟶∞1+1/nn=e for n∈N, equation (7) becomes(8)ε′≥ε/1+qp+qT⋅e.
Further, simulatorℬ can solve the CDH problem in polynomial time t′ which satisfies t′≤t+qH1+qp+3qK+3qH2te+3tm+2te⋅qT+qR+qE.Theorem 2.
If a PPT adversaryA2 has an advantageε to win Game2 described in Section 4.4 within time t after implementing the mostqH1 Hash-1 queries, qK key queries, qE encryption queries, and qH2 Hash-2 queries and requesting at most qT times tag queries, then there exists a ε′,t-simulator ℬ that can address the CDH problem withε′≥ε/1+qK+qT+qE⋅e,t′≤t+qH1+qp+3qK+3qH2⋅te+3tm+2te⋅qT+qR+qE, where one exponentiation costs time te onG1, one scalar multiplication operation costs time tm in G1, and e is base of natural logarithm.Proof.
On inputg,ga,gb in G1, the CDH algorithm ℬ has capability to simulate a data-integrity-verifying security game and output gab by interacting with adversaryA2 as follows:
Setup.ℬ chooses the master keys at random and outputs the system parametersparams. Then, both s andparams are returned to A2 by ℬ.
Hash-1 query.A2 requests the Hash-1 query results for any identityID∗ in terms of its capability. A tuple list L1=ID,Q,r is established to record all query data by ℬ. If a certain ID∗ has been stored in L1, ℬ returns gar∗ to A2. Otherwise, ℬ selects a random value r∗∈Zq∗ and responds to A2 with Q∗=gar∗ and then stores ID∗,Q∗,r∗ in L1.
Key query. According to the assumption that adversaryA2 has an ability to access the master keys, it directly initiates the key query of the public/private key pairing spkID,sskID. A list L2=ID,spkID,sskID,σID,τ is established by ℬ for recording the results of key query.(1)
IfID∗ is not stored in list L2, ℬ picks a value of x∗ at random and tosses a coinτ∈0,1. Let γ denote the probability of τ∗=0; thus 1−γ represents the probability of τ∗=1. If τ∗=1, ℬ sets sskID∗=Q∗x∗,x∗ and spkID∗=XID∗,YID∗=gbx∗,gsx∗ and inserts ID∗,spkID∗,sskID∗,∗,τ∗ into L2 but halts and returns ⊥. If τ∗=0, ℬ sets sskID∗=Q∗x∗,x∗ and spkID∗=XID∗,YID∗=gx∗,gsx∗ and records ID∗,spkID∗,sskID∗,∗,τ∗ into L2 and then returns x∗ to A1.(2)
IfID∗ is stored in listL2, ℬ checks whether the value of τ∗ is 1 or 0. If τ∗=1, ℬ halts and returns⊥. Otherwise, assuming that sskID∗ is already inL2, ℬ directly returns it to A2.
Notably, sinceA2 can access the master key to get the private key, there is no partial key query.
Hash-2 query. As required,A2 runs the Hash-2 query for the target value ωID∗. In order to record the participating tuple, ℬ establishes a listL3=VID,σID2,ωID,λ,h for Hash-2 query. If ωID∗ is stored in L3, ℬ returns the value H2ωID∗=gh∗ to A2. Otherwise, ℬ randomly picks a tuple value λ∗,h∗ and calculates VID∗=H2eQ∗,YID∗λ∗, σID2∗=gλ∗, andH2ωID∗=gh∗ and then returns H2ωID∗ to A2. The new tuple VID∗,σID2∗,ωID∗,λ∗,h∗ is added inL3.
Encrypt query. For any plaintextm, A1 adaptively requests the encrypt query with identityID∗. ℬ searches list L2 for the tupleID∗,spkID∗,sskID∗,σID∗,τ∗.(1)
If the tupleID∗,spkID∗,sskID∗,σID∗,τ∗ cannot be found in listL2, ℬ first requests the Hash-1 query and key query until the tuple ID∗,Q∗,r∗ and the tossing coin value τ∗ become existent in L1 and L2, respectively. Then ℬ calculates the ciphertextσID1∗=mID∗⊕VID∗ and updates the tuple ID∗,spkID∗,sskID∗,σID∗,τ∗ in L2, where σID∗=σID1∗,σID2∗. If τ∗=1, ℬ halts and returns⊥; otherwise, ℬ outputs σID∗ to A1.(2)
If the tupleID∗,spkID∗,sskID∗,σID∗,τ∗ is stored in L2 and τ∗=0, then ℬ directly returns σID∗ to A1; otherwise, ℬ halts and returns⊥.
Tag query. For ciphertextσID∗ associated with plaintext m∗, adversary A1 adaptively performs the tag query with ωID∗,σID∗,ID∗. ℬ first checks the value of τ∗ in L2; if τ∗=1, ℬ halts and outputs⊥. Otherwise, based on the values of ωID∗ in L3 and σID∗ in L2, ℬ calculates DID∗ to generate the tag for the tuple ωID∗,σID∗,ID∗ by step TagGen and then returns it to A2.
Forgery. Eventually, a forgery tagT′, which is relevant to plaintext m′ on identityID′ with the private keysskID′, is forged by A2. If τ=0, ℬ halts and outputs⊥. Otherwise, based on the aforementioned operations, ℬ holds the following values: P0=gs, H1ID′=gar′, H2ωID′=gh′, XID′=gbx′, and σID2′=gλ′, σID1′, and then it can output gab=T′1/λ′+h′x′r′sσID1′ solving the proposed CDH problem.
Analysis. In this game, there are three times of aborting forℬ on key query, encrypt query, and tag query. Thereby, the probability of ℬ implementing the queries for A2 without abortion is higher than 1−γqK+qT+qE. Thus, the probability of occurrence of output of the right value of gab for ℬ is ε′≥ε⋅γ⋅1−γqK+qT+qE≥ε/1+qK+qT+qE⋅e. Running time of algorithm ℬ generating the forgery tag ist′≤t+2qT+qKte+2qT+2qH1+4qK+3qH2⋅te+qE.Theorem 3.
As long as the DL assumption holds, the probability that adversaryA3 wins Game3, that is, to forge the tag and pass the verification in the scheme, is computationally negligible.Proof.
IfA3 wants to win the game, it has to generate the forged integrity proof P′=T′,F′ according to the challenge informationchal=c,k1,k2 and satisfy the following equations with the nonnegligible probability:(9)e∏k=1z′T¯′k,g=∏k=1z′e∏vj∈ClkH2ωvj⋅σvj2′lk′,Xlkaj⋅e∏k=1z′H1IDlkF¯′k,P0,where z′ denotes the count of the group member participating in the challenge and lk′ represents the number of encrypted data blocks participating in the challenge.
On the other hand, assuming thatP=T,F is also a set of legitimate integrity proofs generated according to challenge informationchal=c,k1,k2, tuple P is also verified using the above equation; that is, e∏k=1z′T¯k,g=∏k=1z′e∏vj∈ClkH2ωvj⋅σvj2′lk′,Xlkaj⋅e∏k=1z′H1IDlkF¯k,P0. According to the rules of Game3, the two different integrity proofs P′ andP generated, respectively, by adversaryA3 and the legitimate member on the same challenge information chal=c,k1,k2 have the following relationship: T¯=T¯′ and F¯≠F¯′. According to the above inequality, we can get the same formula as that in [29]: ∏k=1z′H1IDkF¯′k≠∏k=1z′H1IDkF¯k. Then we can get ∏k=1z′H1IDkF¯′k−F¯k=1.
Randomly givenαk∈Zq∗ andh a generator ofG1, H1IDk can be denoted asH1IDk=hαk. Then we can get an approach to solve the DL problem by turning above formula into 1=h∑k=1z′αkΔF¯k; that is, ∑k=1z′αkF¯′k−F¯k=0. In terms of the assumption in the game, there must be at least one tuple F¯′k,F¯k that satisfies F¯′k≠F¯k, and therefore at least one of the corresponding αk is 0. Based on the analysis of αk, there is at least one component αk=01≤k≤z′ in the vector α1,α2,⋯,αz′, so the count of vectors satisfying the condition is at most qz′−1. Clearly, we can find that the probability of ∑k=1z′αkF¯′k−F¯k=0 is less than qz′−1/qz=1/q, which is negligible for a large prime q. We can find that the probability of solving the DL problem is a nonnegligible probability 1−1/q; thereby adversary A3 wins Game3 at the negligible probability.Theorem 4.
The adversary cannot pass the integrity proof by leveraging forged ciphertext.Proof: .
IfA4 wants to win the game, it tries to generate the forged ciphertext σ′=σID1′,σID2′ with the forgery identity ID′ and legitimate ciphertext σ in the revoke a participant phase. Suppose that adversaryA4 generates its parameters for its identity ID′ through the aforementioned games, for example, H1ID′, the private key sskID′=DID′x′,x′, the public key spkID′=XID′,YID′, andH2ωID′. If the tag generating by A4 utilizing these parameters still passes the integrity proof by CSP, then adversaryA4 wins this game. Otherwise, it fails.(1)
Assume that the revoked memberui calculates the reencryption key ri↔j=H2eH1IDi,Yiri⊕eH1IDj,Yjri withA4’s identity ID′ and its public key spkID′ and then returns ri↔j to A4.(2)
A4 calculates reencrypted ciphertext σID′=σID1′,σID2′, where σID1′=σi1⊕ri↔j=mi⊕H2eH1ID′,YID′ri andσID2′=σi2=gri. Then A4 randomly picks xID′ as the partial key and outputs the forgery tag TID′=H2ωID′⋅σID2′x′⋅DID′σID1′.
Through the aforementioned operations, the forgery tag is generated by attackerA4. If the tag passes the integrity proof, the equation eTID′,g=eH2ωID′⋅σID′2,XID′⋅eH1ID′σID′1,P0 holds. However, Theorems 1 and 2 have pointed that the tag with the forged private/public key pairing has a negligible probability to win Game1 and Game2; thereby, without the real ciphertext reencrypted by the legitimate private key, the adversary could output the correct integrity proof only with negligible probability.


## 6.1. Security Analysis

Theorem 1.
If a polynomial probability time adversaryA1 has an advantageε to win Game1 described in Section 4.4 within time t after executing the most qH1 Hash-1 queries, qK key queries, qR Public Key Replace, qE encryption queries, and qH2 Hash-2 queries and requesting at most qT times tag queries, then there exists a ε′,t-simulator ℬ that can address the CDH problem with ε′≥ε/1+qp+qT⋅et′≤t+qH1+qp+3qK+3qH2+2qTte+3tmqT+qR+qE, where one exponentiation costs time te onG1, one scalar multiplication operation costs time tm inG1, and e is the base of natural logarithm.Proof.
On inputg,ga,gb in G1, if adversary A1 is able to forge a tag with the identityID and the replaced public key in Game1, then algorithm ℬ has capability to address CDH problem; that is, it can calculategab. Given g,ga, and gb, simulator ℬ simulates each step of interaction with A as follows:
Setup.A1 launches a query-respond game. ℬ sets P0=ga with the master key a which is security picked and then outputs and returns the system parameters params=q,g,G1,G2,e,P0,H1,H2,ϕ,π to A1.
Hash-1 Query.A1 adaptively requests the Hash-1 query results for any identity ID∗ in terms of its capability. In order to facilitate the management of all the query results, ℬ establishes a tuple list L1=ID,r,Q,τ to record all query data. If a certain ID∗ has been recorded in the list, ℬ directly returns its corresponding tuple ID∗,r∗,Q∗,τ∗ to A1. Otherwise, ℬ selects a random value r∗∈Zq∗ and tosses a coin τ∈0,1. Assume that the coin represents 1 with a probability of γ, and vice versa, 1−γ. If τ shows 0, ℬ sets Q∗=H1ID∗=gr∗∈G1; if τ shows 1, ℬ setsQ∗=H1ID∗=gbr∗∈G1. Then the result Q∗ is returned to A1 and the tuple ID∗,Q∗,∗,∗ is inserted to list L1, where the symbol ∗ indicates that the position is empty and has no value, which may be generated in a subsequent query.
Partial key query. In order to obtain the partial key of any identityID∗, A1 adaptively implements partial key query. ℬ firstly checks whetherID∗ corresponding tuple ID∗,r∗,Q∗,τ∗ exists in L1. If not, ℬ executes the Hash-1 query and inserts the result in L1. Notably, another new tuple list L2 is established by ℬ to manage the newly queried data during this process, where L2=ID,DID,spkID,sskID,σID. If τ shows 1 in L1, ℬ returns⊥ for ID∗ and then records the tuple value ID∗,⊥,∗,∗,∗ in L2. Otherwise, ℬ responds the partial key query as follows.(1)
IfID∗ is stored in listL2, ℬ checks whether the location of DID∗ is a symbol⊥ or not. If it is not ⊥, ℬ returns it directly to A. Otherwise, ℬ reexecutes the coin tossing step in Hash-1 query. When the coin tosses τ=0, ℬ returns the value DID∗=Q∗a=gar∗ to A1 and then updates the values Q∗, τ in L1, andDID∗ in L2 on the corresponding identity ID∗, respectively; otherwise, τ=1, and ℬ aborts.(2)
IfID∗ is not stored in list L2, ℬ determines the value of DID∗ according to τ in list L1. If τ=0, ℬ returns DID∗=gar∗ to A1; otherwise, τ=1, and ℬ aborts.
Note that the tuple inL1 and L2 has such a characteristic: the value of τ in the tuple ID,Q,r,τ of L1 corresponding to the tuple ID,⊥,∗,∗,∗ of L2 is 1; the value of τ in the tuple ID,Q,r,τ of L1 corresponding to the tuple ID,DID∗,spkID∗,sskID∗,σID∗ inL2 is 0.
Key query.A1 adaptively requests the key query for any identityID∗. ℬ searches list L2 for the tuple ID,DID∗,spkID∗,sskID∗,σID∗.(1)
If the tupleID,DID∗,spkID∗,sskID∗,σID∗ is stored in L2, ℬ first checks whether the position of DID∗ is ⊥ or not. IfDID∗=⊥, ℬ turns to execute Hash-1 query and partial key query in turn. Otherwise, ℬ checks whether the position of spkID∗ in this tuple is the symbol ∗. If spkID∗=∗, ℬ selects xID∗∈Zq∗ at random and setssskID∗=DID∗xID∗,xID∗ and spkID∗=XID∗,YID∗=gxID∗,P0xID∗. ℬ updates the tuple ID,DID∗,∗,∗,∗ into L2 and sends the key pairing spkID∗,sskID∗ to A1.(2)
If the tupleID,DID∗,spkID∗,sskID∗,σID∗ is not stored in L2, ℬ turns to execute Hash-1 query and partial key query in turn. Once the value ofDID∗ has been obtained after the Hash-1 query and partial key query, ℬ randomly selectsxID∗∈Zq∗ and sets sskID∗=DID∗xID∗,xID∗ and spkID∗=XID∗,YID∗=gxID∗,P0xID∗. ℬ inserts the tuple ID,DID∗,spkID∗,sskID∗,σID∗ into L2 and returns spkID∗,sskID∗ to A1. On the other hand, if DID∗=⊥, the tuple ID,⊥,∗,∗,∗ is inserted intoL2, and ℬ aborts.
Public Key Replace. According to the assumption, adversaryA1 has capability to replace the public key. A1 adaptively implements the Public Key Replace for the target memberID∗ with the substitution public key spkID∗′.(1)
If the tupleID∗,DID∗,spkID∗,sskID∗,∗ is stored inL2, ℬ modifies the tuple as ID∗,DID∗,spkID∗′,∗,∗ in terms of A1’s request, where spkID∗′=XID∗′,YID∗′.(2)
If the tupleID∗,DID∗,spkID∗,sskID∗,∗ is not contained inL2, ℬ adds the tuple ID∗,∗,spkID∗′,∗,∗ to L2 in terms ofA1’s request, where spkID∗′=XID∗′,YID∗′.
Hash-2 query. In order to facilitate the management of Hash-2 query, a listL3=VID,σID2,ωID,λ,h is still established by ℬ to record the participating tuple. As required, A1 runs the Hash-2 query on the identity ID∗, partial public key YID∗, and Hash-1 query Q∗. ℬ randomly picks a tuple value λ∗,h∗ and calculates VID∗=H2eQ∗,YID∗′λ∗, σID2∗=gλ∗, and H2ωID∗=gh∗ and then sends VID∗,σID2∗ and H2ωID∗ to A1. The new tuple VID∗,σID2∗,ωID∗,λ∗,h∗ is added in L3.
Encrypt query. For any plaintextm, A1 adaptively requests the encrypt query with identityID∗. ℬ searches list L2 for the tupleID∗,DID∗,spkID∗,sskID∗,σID∗. If the tuple ID∗,DID∗,spkID∗,sskID∗,σID∗ is stored in L2, ℬ returns σID∗ directly toA1. Otherwise, whether the tuple is ID∗,⊥,∗,∗,∗ or ID∗,∗,spkID∗′,∗,∗, ℬ calculates the ciphertext σID∗′ with the replaced key spkID∗′, in which σID∗′=σID1∗′,σID2∗′ andσID1∗′=mID∗⊕VID∗. Then, ℬ updates the tuple ID,⊥,spkID∗′,∗,σID∗′ and ID∗,∗,spkID∗′,∗,σID∗′ in L2, respectively.
Tag query.A1 adaptively requests the tag on any identityID∗ and plaintext block mID∗ by submitting the result ofσID∗. Based on the result of tossing the coin in L1; if τ∗=1, ℬ aborts. Otherwise, based on the values of H2ωID∗ in L3 and both DID∗ andσID∗ inL2, ℬ generates the tag for the tuple DID∗,σID∗,H2ωID∗ by step TagGen and returns it to A1.
Forgery. Eventually, a forgery tagT′, which is relevant to plaintext m′ on the identityID′ with the public key spkID′, is forged by A1. If τ=0, ℬ aborts. Otherwise, based on the aforementioned operations, ℬ holds the following values: H1ID′=gbr′, σID2′=gλ′, P0=ga, and H2ωID′=gh′, σID1′, andXID′, and then it can output gab=T′/XID′λ+h1/r′σID′ solving the proposed CDH problem.
Analysis. Now, we analyze the probability thatℬ can guess the correct query of the target data block by simulating operation. Similar to the analysis and proof of [48, 50], ℬ only halts two queries on partial key query and tag query; therefore the probability of ℬ implementing the queries is higher than 1−γqp+qT. Assume that the probability of occurrence of output of the right value of gab for ℬ is ε⋅γ⋅1−γqp+qT.
Let(4)ε′=ε⋅γ⋅1−γ.
In order to find the minimum value ofε′, let us take the derivatives of both sides of (4) with respect to γ:(5)dε′dγ=dε⋅γ⋅1−γqp+qTdγ=ε⋅1−γqp+qT−ε⋅γ⋅qp+qT⋅1−γqp+qT−1=ε⋅1−γqp+qT−1⋅1−γ⋅qp+qT+1.
Replacedε′/dγ=0; that is,(6)ε⋅1−γqp+qT−1⋅1−γ⋅qp+qT+1.
We can obtainγopt=1/1+qp+qT. Thereby (4) becomes(7)ε′=ε⋅γ⋅1−γqp+qT≥ε⋅11+qp+qT⋅1−11+qp+qTqp+qT.
According to the formulalimitn⟶∞1+1/nn=e for n∈N, equation (7) becomes(8)ε′≥ε/1+qp+qT⋅e.
Further, simulatorℬ can solve the CDH problem in polynomial time t′ which satisfies t′≤t+qH1+qp+3qK+3qH2te+3tm+2te⋅qT+qR+qE.Theorem 2.
If a PPT adversaryA2 has an advantageε to win Game2 described in Section 4.4 within time t after implementing the mostqH1 Hash-1 queries, qK key queries, qE encryption queries, and qH2 Hash-2 queries and requesting at most qT times tag queries, then there exists a ε′,t-simulator ℬ that can address the CDH problem withε′≥ε/1+qK+qT+qE⋅e,t′≤t+qH1+qp+3qK+3qH2⋅te+3tm+2te⋅qT+qR+qE, where one exponentiation costs time te onG1, one scalar multiplication operation costs time tm in G1, and e is base of natural logarithm.Proof.
On inputg,ga,gb in G1, the CDH algorithm ℬ has capability to simulate a data-integrity-verifying security game and output gab by interacting with adversaryA2 as follows:
Setup.ℬ chooses the master keys at random and outputs the system parametersparams. Then, both s andparams are returned to A2 by ℬ.
Hash-1 query.A2 requests the Hash-1 query results for any identityID∗ in terms of its capability. A tuple list L1=ID,Q,r is established to record all query data by ℬ. If a certain ID∗ has been stored in L1, ℬ returns gar∗ to A2. Otherwise, ℬ selects a random value r∗∈Zq∗ and responds to A2 with Q∗=gar∗ and then stores ID∗,Q∗,r∗ in L1.
Key query. According to the assumption that adversaryA2 has an ability to access the master keys, it directly initiates the key query of the public/private key pairing spkID,sskID. A list L2=ID,spkID,sskID,σID,τ is established by ℬ for recording the results of key query.(1)
IfID∗ is not stored in list L2, ℬ picks a value of x∗ at random and tosses a coinτ∈0,1. Let γ denote the probability of τ∗=0; thus 1−γ represents the probability of τ∗=1. If τ∗=1, ℬ sets sskID∗=Q∗x∗,x∗ and spkID∗=XID∗,YID∗=gbx∗,gsx∗ and inserts ID∗,spkID∗,sskID∗,∗,τ∗ into L2 but halts and returns ⊥. If τ∗=0, ℬ sets sskID∗=Q∗x∗,x∗ and spkID∗=XID∗,YID∗=gx∗,gsx∗ and records ID∗,spkID∗,sskID∗,∗,τ∗ into L2 and then returns x∗ to A1.(2)
IfID∗ is stored in listL2, ℬ checks whether the value of τ∗ is 1 or 0. If τ∗=1, ℬ halts and returns⊥. Otherwise, assuming that sskID∗ is already inL2, ℬ directly returns it to A2.
Notably, sinceA2 can access the master key to get the private key, there is no partial key query.
Hash-2 query. As required,A2 runs the Hash-2 query for the target value ωID∗. In order to record the participating tuple, ℬ establishes a listL3=VID,σID2,ωID,λ,h for Hash-2 query. If ωID∗ is stored in L3, ℬ returns the value H2ωID∗=gh∗ to A2. Otherwise, ℬ randomly picks a tuple value λ∗,h∗ and calculates VID∗=H2eQ∗,YID∗λ∗, σID2∗=gλ∗, andH2ωID∗=gh∗ and then returns H2ωID∗ to A2. The new tuple VID∗,σID2∗,ωID∗,λ∗,h∗ is added inL3.
Encrypt query. For any plaintextm, A1 adaptively requests the encrypt query with identityID∗. ℬ searches list L2 for the tupleID∗,spkID∗,sskID∗,σID∗,τ∗.(1)
If the tupleID∗,spkID∗,sskID∗,σID∗,τ∗ cannot be found in listL2, ℬ first requests the Hash-1 query and key query until the tuple ID∗,Q∗,r∗ and the tossing coin value τ∗ become existent in L1 and L2, respectively. Then ℬ calculates the ciphertextσID1∗=mID∗⊕VID∗ and updates the tuple ID∗,spkID∗,sskID∗,σID∗,τ∗ in L2, where σID∗=σID1∗,σID2∗. If τ∗=1, ℬ halts and returns⊥; otherwise, ℬ outputs σID∗ to A1.(2)
If the tupleID∗,spkID∗,sskID∗,σID∗,τ∗ is stored in L2 and τ∗=0, then ℬ directly returns σID∗ to A1; otherwise, ℬ halts and returns⊥.
Tag query. For ciphertextσID∗ associated with plaintext m∗, adversary A1 adaptively performs the tag query with ωID∗,σID∗,ID∗. ℬ first checks the value of τ∗ in L2; if τ∗=1, ℬ halts and outputs⊥. Otherwise, based on the values of ωID∗ in L3 and σID∗ in L2, ℬ calculates DID∗ to generate the tag for the tuple ωID∗,σID∗,ID∗ by step TagGen and then returns it to A2.
Forgery. Eventually, a forgery tagT′, which is relevant to plaintext m′ on identityID′ with the private keysskID′, is forged by A2. If τ=0, ℬ halts and outputs⊥. Otherwise, based on the aforementioned operations, ℬ holds the following values: P0=gs, H1ID′=gar′, H2ωID′=gh′, XID′=gbx′, and σID2′=gλ′, σID1′, and then it can output gab=T′1/λ′+h′x′r′sσID1′ solving the proposed CDH problem.
Analysis. In this game, there are three times of aborting forℬ on key query, encrypt query, and tag query. Thereby, the probability of ℬ implementing the queries for A2 without abortion is higher than 1−γqK+qT+qE. Thus, the probability of occurrence of output of the right value of gab for ℬ is ε′≥ε⋅γ⋅1−γqK+qT+qE≥ε/1+qK+qT+qE⋅e. Running time of algorithm ℬ generating the forgery tag ist′≤t+2qT+qKte+2qT+2qH1+4qK+3qH2⋅te+qE.Theorem 3.
As long as the DL assumption holds, the probability that adversaryA3 wins Game3, that is, to forge the tag and pass the verification in the scheme, is computationally negligible.Proof.
IfA3 wants to win the game, it has to generate the forged integrity proof P′=T′,F′ according to the challenge informationchal=c,k1,k2 and satisfy the following equations with the nonnegligible probability:(9)e∏k=1z′T¯′k,g=∏k=1z′e∏vj∈ClkH2ωvj⋅σvj2′lk′,Xlkaj⋅e∏k=1z′H1IDlkF¯′k,P0,where z′ denotes the count of the group member participating in the challenge and lk′ represents the number of encrypted data blocks participating in the challenge.
On the other hand, assuming thatP=T,F is also a set of legitimate integrity proofs generated according to challenge informationchal=c,k1,k2, tuple P is also verified using the above equation; that is, e∏k=1z′T¯k,g=∏k=1z′e∏vj∈ClkH2ωvj⋅σvj2′lk′,Xlkaj⋅e∏k=1z′H1IDlkF¯k,P0. According to the rules of Game3, the two different integrity proofs P′ andP generated, respectively, by adversaryA3 and the legitimate member on the same challenge information chal=c,k1,k2 have the following relationship: T¯=T¯′ and F¯≠F¯′. According to the above inequality, we can get the same formula as that in [29]: ∏k=1z′H1IDkF¯′k≠∏k=1z′H1IDkF¯k. Then we can get ∏k=1z′H1IDkF¯′k−F¯k=1.
Randomly givenαk∈Zq∗ andh a generator ofG1, H1IDk can be denoted asH1IDk=hαk. Then we can get an approach to solve the DL problem by turning above formula into 1=h∑k=1z′αkΔF¯k; that is, ∑k=1z′αkF¯′k−F¯k=0. In terms of the assumption in the game, there must be at least one tuple F¯′k,F¯k that satisfies F¯′k≠F¯k, and therefore at least one of the corresponding αk is 0. Based on the analysis of αk, there is at least one component αk=01≤k≤z′ in the vector α1,α2,⋯,αz′, so the count of vectors satisfying the condition is at most qz′−1. Clearly, we can find that the probability of ∑k=1z′αkF¯′k−F¯k=0 is less than qz′−1/qz=1/q, which is negligible for a large prime q. We can find that the probability of solving the DL problem is a nonnegligible probability 1−1/q; thereby adversary A3 wins Game3 at the negligible probability.Theorem 4.
The adversary cannot pass the integrity proof by leveraging forged ciphertext.Proof: .
IfA4 wants to win the game, it tries to generate the forged ciphertext σ′=σID1′,σID2′ with the forgery identity ID′ and legitimate ciphertext σ in the revoke a participant phase. Suppose that adversaryA4 generates its parameters for its identity ID′ through the aforementioned games, for example, H1ID′, the private key sskID′=DID′x′,x′, the public key spkID′=XID′,YID′, andH2ωID′. If the tag generating by A4 utilizing these parameters still passes the integrity proof by CSP, then adversaryA4 wins this game. Otherwise, it fails.(1)
Assume that the revoked memberui calculates the reencryption key ri↔j=H2eH1IDi,Yiri⊕eH1IDj,Yjri withA4’s identity ID′ and its public key spkID′ and then returns ri↔j to A4.(2)
A4 calculates reencrypted ciphertext σID′=σID1′,σID2′, where σID1′=σi1⊕ri↔j=mi⊕H2eH1ID′,YID′ri andσID2′=σi2=gri. Then A4 randomly picks xID′ as the partial key and outputs the forgery tag TID′=H2ωID′⋅σID2′x′⋅DID′σID1′.
Through the aforementioned operations, the forgery tag is generated by attackerA4. If the tag passes the integrity proof, the equation eTID′,g=eH2ωID′⋅σID′2,XID′⋅eH1ID′σID′1,P0 holds. However, Theorems 1 and 2 have pointed that the tag with the forged private/public key pairing has a negligible probability to win Game1 and Game2; thereby, without the real ciphertext reencrypted by the legitimate private key, the adversary could output the correct integrity proof only with negligible probability.


## 7. Performance Analysis

In this section, we first show the computation and communication cost of our scheme by theory and then represent the experiment results of the scheme.


### 7.1. Computation Cost

In our scheme, the computation cost is mainly concentrated on those operations that are computationally complex and time-consuming, such as pairing operation, exponentiation operation, and multiplication operations. For the simplicity of presentation, we use symbolsCp, Cexp, Cmul1, andCmul2 to represent the cost of one pairing operation in G1×G1⟶G2, one exponentiation operation in G1, one multiplication in group G1, and one multiplication in groupG2, respectively. In addition, the computational overhead of some other operations (such as pseudorandom parameter selection, hash operation, addition, and pseudorandom permutation) is negligible, so these operations are not analyzed. Continue to leverage the above symbols, and let n, z, c, andz′ denote the number of projects divided into subprojects, members participating in the project, the challenge subprojects, and the members involved in the challenge, respectively. According to the processes of Encrypt and TagGen, the computation costs for n data blocks arezCp+2Cexp and n2Cmul1+2Cexp, respectively.In the process ofProofGen, we ignore the generation operation cost of challenge information chal and focus on the proof information, so the computation cost of this procedure iscCexp+c−z′Cmul1. In this scheme, we also give the computation cost on the revocation step RevGen for a member of the project, in which the revoked member costs 2Cp+Cexp, the specified recipient costs 2Cexp+Cmul1, and the verification computation cost for the CSP is 2l−1Cmul1+3Cp+2Cexp+Cmul2. Table 1 shows the detailed comparison of computation cost and data blocks types among the scheme of papers [7, 39] and ours. As can be seen from Table 1, in step TagGen, our scheme is one more Cmul1 than [7] and much less than [39]. After all, the cost of [39] is related to the number of participants z′. The cost amount of the step ProofGen is the same as that of [7] but is less than that of paper [39]. In addition, the step VerifyProof is used to verify the correctness of proof information and its computation cost isz′+2Cp+2c+z′−2Cmul1+c+2z′Cexp+z′Cmul2, and the costs of [7, 39] are 3Cp+2c+z′⋅Cexp+2c+z′Cmul1+Cmul2 and z′+2Cp+c+z′Cexp+c+2z′Cmul1+z′Cmul2, respectively. Compared with the schemes in [7, 39], the cost of our scheme is slightly higher. The reason is that our scheme performs tag generation, verification, and update of ciphertext, and the computational cost is obviously higher than that in literature.Table 1
Comparison of computation cost.
SchemesTag generationProof generationVerification proofData block typeScheme in [39]z′+1⋅Cexp+Cmul1cCexp+cCmul13Cp+2c+z′Cexp+2c+z′Cmul1+Cmul2PlaintextScheme in [7]2Cexp+Cmul1cCexp+c−z′Cmul1z′+2Cp+c+z′Cexp+c+2z′Cmul1+z′Cmul2PlaintextOur scheme2Cexp+2Cmul1cCexp+c−z′Cmul1z′+2Cp+c+2z′Cexp+2c+z′−2Cmul1+z′Cmul2Ciphertext


### 7.2. Communication Cost

In this scheme, the communication cost mainly arises from the challenge information generation phase and proof generation phase. To audit the integrity of the data stored in the cloud service, a verifier sends the challenge informationc,k1,k2 to the CSP, and then proof P=T,F is returned to the verifier by CSP. The communication cost for an integrity proof challenge isn+2q bits, and the communication cost of proof information response is 2c+z′G1+n+2q bits, where q is the element length in ℤq and n is the length of the element in set 1,n. In addition, the communication cost for the revocation phase is 2l+1G1, where l is denotes the number of ciphertext data blocks owned by the revoked member.


### 7.3. Experimental Results

In this experiment, we utilized the Ubuntu Kylin 16.04 LTS (64-bit) operation system equipped with the VMware Workstation 10 with Intel Core i7-8700 3.2 GHz processor and 16 G RAM of the host computer with Win10 operation system using C language to simulate the scheme implementation environment. The Pairing Based Cryptography (PBC) [51] library (version 0.5.14) has been used to execute pairing steps and the Openssl library [52] (version 1.1.1k) is deployed to implement two hash (SHA 256) operations. For the choice of experimental parameters, we used the file params/a.param provided by PBC for type A pairing and constructed a 256-bit order elliptic curve [53] group of type A. To obtain more accurate results,all experiments were run 50 times to get an average.The stepEncrypt needs to execute two time-consuming calculations, namely, pairing operation and exponentiation on group G1, totally costing almost 602.024 ms for 100 members. We utilize the file with the size of 32 M for experimental demonstration, so the total number of blocks is 106 which is bounded by the order of the 256-bit group. Suppose that all blocks are averagely distributed to project members; thereby the number of members getting the blocks is 104. Figure 2 depicts the time cost result for the members varying from 1 to 100 to generate all ciphertext blocks. Through observation, it is found that the time consumption of encrypting operation is proportional to the number of users. It takes 5.83 ms for a single member to encrypt all its data blocks, while all members can accept the fact that it takes 602.02 ms to encrypt all data blocks. Moreover, the operation that all data blocks are clustered together and encrypted only occurs at the beginning of the project, in the distribution phase of the subproject.Figure 2
Computation cost of encryption.Based on the cost of ciphertext generation, we now evaluate the cost of tag generation experimentally. We still leverage the 106 ciphertext blocks for the experiment. To carry out the experiment demonstration, we utilize the participant ciphertext number ranging from 105 to 106 with an increment of 105 for each test. From the experimental results in Figure 3, we can observe that the time consumption for tag generation is linear with the increase of the number of blocks, and it takes about 173.9 s to generate tags for all 106 blocks. As observing the proposed scheme, the entire Encrypt and TagGen processes are executed by only the project manager; thereby the project members just need to download the ciphertext and tags within the appointed time.Figure 3
Computation cost of tag generation.We setq=256 bits, n=20 bits, and z′=100 as in previous work [39]. Based on the previous conclusions [5, 7, 39], if 1% of all blocks are corrupted, 460 challenge blocks picked randomly can achieve 99% error detection probability and 300 challenge blocks chosen at random can successfully achieve 95% malpractice detection probability. In Figure 4, we can see that when the size of project group varies from 500 to 1000 and the number of challenge members ranges from 0 to 200, our scheme can achieve an auditing task with the maximum verification time of 14.664 s and 42 KB by choosing c = 460.Figure 4
The computation cost of challenge operation. (a) The size of group. (b) The number of challenge members.
(a)(b)


## 7.1. Computation Cost

In our scheme, the computation cost is mainly concentrated on those operations that are computationally complex and time-consuming, such as pairing operation, exponentiation operation, and multiplication operations. For the simplicity of presentation, we use symbolsCp, Cexp, Cmul1, andCmul2 to represent the cost of one pairing operation in G1×G1⟶G2, one exponentiation operation in G1, one multiplication in group G1, and one multiplication in groupG2, respectively. In addition, the computational overhead of some other operations (such as pseudorandom parameter selection, hash operation, addition, and pseudorandom permutation) is negligible, so these operations are not analyzed. Continue to leverage the above symbols, and let n, z, c, andz′ denote the number of projects divided into subprojects, members participating in the project, the challenge subprojects, and the members involved in the challenge, respectively. According to the processes of Encrypt and TagGen, the computation costs for n data blocks arezCp+2Cexp and n2Cmul1+2Cexp, respectively.In the process ofProofGen, we ignore the generation operation cost of challenge information chal and focus on the proof information, so the computation cost of this procedure iscCexp+c−z′Cmul1. In this scheme, we also give the computation cost on the revocation step RevGen for a member of the project, in which the revoked member costs 2Cp+Cexp, the specified recipient costs 2Cexp+Cmul1, and the verification computation cost for the CSP is 2l−1Cmul1+3Cp+2Cexp+Cmul2. Table 1 shows the detailed comparison of computation cost and data blocks types among the scheme of papers [7, 39] and ours. As can be seen from Table 1, in step TagGen, our scheme is one more Cmul1 than [7] and much less than [39]. After all, the cost of [39] is related to the number of participants z′. The cost amount of the step ProofGen is the same as that of [7] but is less than that of paper [39]. In addition, the step VerifyProof is used to verify the correctness of proof information and its computation cost isz′+2Cp+2c+z′−2Cmul1+c+2z′Cexp+z′Cmul2, and the costs of [7, 39] are 3Cp+2c+z′⋅Cexp+2c+z′Cmul1+Cmul2 and z′+2Cp+c+z′Cexp+c+2z′Cmul1+z′Cmul2, respectively. Compared with the schemes in [7, 39], the cost of our scheme is slightly higher. The reason is that our scheme performs tag generation, verification, and update of ciphertext, and the computational cost is obviously higher than that in literature.Table 1
Comparison of computation cost.
SchemesTag generationProof generationVerification proofData block typeScheme in [39]z′+1⋅Cexp+Cmul1cCexp+cCmul13Cp+2c+z′Cexp+2c+z′Cmul1+Cmul2PlaintextScheme in [7]2Cexp+Cmul1cCexp+c−z′Cmul1z′+2Cp+c+z′Cexp+c+2z′Cmul1+z′Cmul2PlaintextOur scheme2Cexp+2Cmul1cCexp+c−z′Cmul1z′+2Cp+c+2z′Cexp+2c+z′−2Cmul1+z′Cmul2Ciphertext


## 7.2. Communication Cost

In this scheme, the communication cost mainly arises from the challenge information generation phase and proof generation phase. To audit the integrity of the data stored in the cloud service, a verifier sends the challenge informationc,k1,k2 to the CSP, and then proof P=T,F is returned to the verifier by CSP. The communication cost for an integrity proof challenge isn+2q bits, and the communication cost of proof information response is 2c+z′G1+n+2q bits, where q is the element length in ℤq and n is the length of the element in set 1,n. In addition, the communication cost for the revocation phase is 2l+1G1, where l is denotes the number of ciphertext data blocks owned by the revoked member.


## 7.3. Experimental Results

In this experiment, we utilized the Ubuntu Kylin 16.04 LTS (64-bit) operation system equipped with the VMware Workstation 10 with Intel Core i7-8700 3.2 GHz processor and 16 G RAM of the host computer with Win10 operation system using C language to simulate the scheme implementation environment. The Pairing Based Cryptography (PBC) [51] library (version 0.5.14) has been used to execute pairing steps and the Openssl library [52] (version 1.1.1k) is deployed to implement two hash (SHA 256) operations. For the choice of experimental parameters, we used the file params/a.param provided by PBC for type A pairing and constructed a 256-bit order elliptic curve [53] group of type A. To obtain more accurate results,all experiments were run 50 times to get an average.The stepEncrypt needs to execute two time-consuming calculations, namely, pairing operation and exponentiation on group G1, totally costing almost 602.024 ms for 100 members. We utilize the file with the size of 32 M for experimental demonstration, so the total number of blocks is 106 which is bounded by the order of the 256-bit group. Suppose that all blocks are averagely distributed to project members; thereby the number of members getting the blocks is 104. Figure 2 depicts the time cost result for the members varying from 1 to 100 to generate all ciphertext blocks. Through observation, it is found that the time consumption of encrypting operation is proportional to the number of users. It takes 5.83 ms for a single member to encrypt all its data blocks, while all members can accept the fact that it takes 602.02 ms to encrypt all data blocks. Moreover, the operation that all data blocks are clustered together and encrypted only occurs at the beginning of the project, in the distribution phase of the subproject.Figure 2
Computation cost of encryption.Based on the cost of ciphertext generation, we now evaluate the cost of tag generation experimentally. We still leverage the 106 ciphertext blocks for the experiment. To carry out the experiment demonstration, we utilize the participant ciphertext number ranging from 105 to 106 with an increment of 105 for each test. From the experimental results in Figure 3, we can observe that the time consumption for tag generation is linear with the increase of the number of blocks, and it takes about 173.9 s to generate tags for all 106 blocks. As observing the proposed scheme, the entire Encrypt and TagGen processes are executed by only the project manager; thereby the project members just need to download the ciphertext and tags within the appointed time.Figure 3
Computation cost of tag generation.We setq=256 bits, n=20 bits, and z′=100 as in previous work [39]. Based on the previous conclusions [5, 7, 39], if 1% of all blocks are corrupted, 460 challenge blocks picked randomly can achieve 99% error detection probability and 300 challenge blocks chosen at random can successfully achieve 95% malpractice detection probability. In Figure 4, we can see that when the size of project group varies from 500 to 1000 and the number of challenge members ranges from 0 to 200, our scheme can achieve an auditing task with the maximum verification time of 14.664 s and 42 KB by choosing c = 460.Figure 4
The computation cost of challenge operation. (a) The size of group. (b) The number of challenge members.
(a)(b)


## 8. Conclusion

In this paper, a remote encrypted data integrity auditing scheme stored on a cloud service provider is presented. This scheme addresses the integrity auditing issue for the encrypted data which is shared with numerous members of a group. In our scheme, the sponsor of a shared data group is the project manager who is responsible for the initialization of system parameters, the selection of partial private keys for project members, and the generation of original ciphertext blocks for subprojects. Meanwhile, with the help of certificateless signature idea, the synchronization change between the ciphertext block and the tag is realized, and the problem of auditing the integrity of the ciphertext block is transformed into an equation verification related to the tag. Therefore, based on the above two measures, the key escrow and certificate management in PKI naturally do not exist. With regard to the revocation of the member, our scheme utilizes the homomorphic hash function to transform the ciphertexts of the revoked members into the ciphertexts of the existing members without leaking the information of ciphertext. Finally, the protocol has been proven secure to satisfy adaptively selective the ciphertext attack assuming the stability of CDH and DL in bilinear pairing. From the results of the experiment, our scheme is efficient in both computation and communication cost and more secure in a shared group in cloud storage.



---

*Source: 1493768-2022-02-25.xml*