# An Improved Secure Public Cloud Auditing Scheme in Edge Computing

Authors: Zhengge Yi; Lixian Wei; Haibin Yang; Xu An Wang; Wenyong Yuan; Ruifeng Li
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Cloud storage plays an important role in the data processing of edge computing. It is very necessary to protect the integrity of these data and the privacy of users. Recently, a cloud auditing scheme which can be used to smart cities has been proposed, which is lightweight and privacy-preserving. Although this scheme has very good performance and is a very valuable work, we find that there is insecurity in it. By giving two kinds of attacks, we prove that a malicious cloud server provider (CSP) can forge auditing proof and can successfully pass the verification of the third-party auditor (TPA) even if the CSP deletes the user’s data. Then, based on this scheme, we propose an improved scheme, which can resist the forgery attack from malicious CSP. Through security analysis, our scheme improves the security compared to the original scheme without reducing the efficiency.


---

## Body

## 1. Introduction

The rise of the Internet of Things and the 5G network has led to many new services, including intelligent transportation, smart city, location service, and so on [1, 2]. The number of smartphones, wearable devices, Internet-connected televisions, and other sensor devices shows an explosive growth trend, followed by “sea-scale” data generated by these Internet of Things terminals [3–6].In edge computing, some or all of the private data of end users need to be outsourced to third parties (such as cloud computing data centers and edge data centers) [7–9]. By using the cheap storage and computing services provided by the cloud server, users with limited resources can be freed from the complex hardware system, reduce the storage burden, and at the same time be able to easily access their own data [10–12]. Compared to the traditional cloud computing model which relies solely on the computing center, the edge computing can handle the big data at the network edge effectively.However, the users’ data stored in the third-party data center have the features of separation of control, storage randomization, and so on, which can easily lead to data security problems such as data loss, data leakage, and so on [13, 14]. When the integrity of users’ data is destroyed, the interests of these users may receive huge losses. Therefore, it is significant to design a cloud auditing scheme for edge computing.


### 1.1. Related Work

Recently, in order to meet different application requirements, various cloud storage audit schemes have been proposed. At present, the research on data integrity audit is mainly focused on four functional requirements, namely, dynamic audit, batch audit, privacy protection, and lightweight computing.At the CCS conference in 2007, Jules and Ateniese et al. proposed proofs of retrievability (POR) and provable data possession (PDP), respectively, to audit cloud storage data [15, 16]. Both of them use the idea of sampling testing to audit the integrity of the data. That is, only a small part of the data in the cloud can ensure the integrity and reliability of all data with a high probability. Then, Ateniese et al. proposed a scalable PDP scheme based on the original PDP [17], which is the first verifiable data holding protocol that supports partial dynamic operation. The design of this protocol provides a new idea for the construction of the cloud audit protocol and takes an important step towards the more practical PDP protocol. Inspired by Ateniese et al., Erway et al. [18] extended the above PDP protocol and designed a protocol that supports the dynamic update of cloud data. The audit protocol uses jump tables to support complete dynamic operation of data. Compared with the protocol of Ateniese et al., it has a greater breakthrough in practical value and the probability of detecting cloud data errors. However, the protocol does not have the performance of privacy protection, batch auditing, and so on.Wang et al. [19] proposed a distributed data audit system to protect privacy in order to solve the problems of privacy disclosure and batch audit in the process of data integrity audit. The system uses a third-party audit platform to perform integrity audits, and the data owner can delete the local original data after the data are outsourced and stored to the cloud server. At the same time, homomorphic MAC and random mask technology are used to ensure that the third-party audit platform cannot know the content of the stored data in the effective audit process to achieve privacy protection. Subsequently, Wang et al. further improved the scheme in reference [20] by constructing a Merkle hash tree structure based on block authentication tags to improve the proof of the storage model. A study [20] further improved the bilinear aggregation signature method and improved the batch audit efficiency of TPA. Yang et al. [21] proposed an efficient and privacy-protected dynamic auditing protocol, which can be extended to realize dynamic data operations and batch auditing. At the same time, combining cryptography and bilinear properties, this scheme can protect the data privacy. In view of mobile devices with insufficient computing power, a lightweight integrity audit scheme supporting privacy protection is proposed in reference [22]. This scheme uses an online/offline signature method where the offline phase undertakes a lot of computing work. When the data file to be outsourced is given, the user just needs to construct the outsourced data signature in the online phase, which is lightweight.


### 1.2. Motivation

At present, in most public audit systems, in order to ensure the integrity of user data, the third-party auditor usually initiates an integrity challenge to the CSP, and then the CSP generates evidence to prove that it honestly stores user data. In this model, we first need to ensure that the cloud service provider cannot complete the forgery attack; that is, the forged evidence cannot be verified by the third-party auditor.Recently, a public cloud auditing scheme has been proposed by Jing Han et al. [23]. This scheme is pairing-free and allows a third-party auditor to generate authentication metasets on behalf of users, which can achieve lightweight computing. It can protect the privacy of a user’s data by blinding the raw data before storing them in the CSP and sending to the third-party auditor. At the same time, this scheme can realize batch auditing. Their proposed scheme is very valuable.However, we find this scheme is not secure. A malicious CSP can easily forge auditing proof. Even if the CSP deletes all the data of a user, it can still generate the correct data possession proof to pass the verification of TPA. According to our findings, we have carried out the following work:(1)
We give two attack methods to prove the insecurity of Han’s scheme. The first attack proves that the audit proof can be forged by the CSP, and the second attack proves that the CSP can pass the verification of the TPA even if it deletes the user’s data.(2)
Based on the original scheme, we propose an improved scheme, which can effectively resist the forgery attack from CSP.


## 1.1. Related Work

Recently, in order to meet different application requirements, various cloud storage audit schemes have been proposed. At present, the research on data integrity audit is mainly focused on four functional requirements, namely, dynamic audit, batch audit, privacy protection, and lightweight computing.At the CCS conference in 2007, Jules and Ateniese et al. proposed proofs of retrievability (POR) and provable data possession (PDP), respectively, to audit cloud storage data [15, 16]. Both of them use the idea of sampling testing to audit the integrity of the data. That is, only a small part of the data in the cloud can ensure the integrity and reliability of all data with a high probability. Then, Ateniese et al. proposed a scalable PDP scheme based on the original PDP [17], which is the first verifiable data holding protocol that supports partial dynamic operation. The design of this protocol provides a new idea for the construction of the cloud audit protocol and takes an important step towards the more practical PDP protocol. Inspired by Ateniese et al., Erway et al. [18] extended the above PDP protocol and designed a protocol that supports the dynamic update of cloud data. The audit protocol uses jump tables to support complete dynamic operation of data. Compared with the protocol of Ateniese et al., it has a greater breakthrough in practical value and the probability of detecting cloud data errors. However, the protocol does not have the performance of privacy protection, batch auditing, and so on.Wang et al. [19] proposed a distributed data audit system to protect privacy in order to solve the problems of privacy disclosure and batch audit in the process of data integrity audit. The system uses a third-party audit platform to perform integrity audits, and the data owner can delete the local original data after the data are outsourced and stored to the cloud server. At the same time, homomorphic MAC and random mask technology are used to ensure that the third-party audit platform cannot know the content of the stored data in the effective audit process to achieve privacy protection. Subsequently, Wang et al. further improved the scheme in reference [20] by constructing a Merkle hash tree structure based on block authentication tags to improve the proof of the storage model. A study [20] further improved the bilinear aggregation signature method and improved the batch audit efficiency of TPA. Yang et al. [21] proposed an efficient and privacy-protected dynamic auditing protocol, which can be extended to realize dynamic data operations and batch auditing. At the same time, combining cryptography and bilinear properties, this scheme can protect the data privacy. In view of mobile devices with insufficient computing power, a lightweight integrity audit scheme supporting privacy protection is proposed in reference [22]. This scheme uses an online/offline signature method where the offline phase undertakes a lot of computing work. When the data file to be outsourced is given, the user just needs to construct the outsourced data signature in the online phase, which is lightweight.


## 1.2. Motivation

At present, in most public audit systems, in order to ensure the integrity of user data, the third-party auditor usually initiates an integrity challenge to the CSP, and then the CSP generates evidence to prove that it honestly stores user data. In this model, we first need to ensure that the cloud service provider cannot complete the forgery attack; that is, the forged evidence cannot be verified by the third-party auditor.Recently, a public cloud auditing scheme has been proposed by Jing Han et al. [23]. This scheme is pairing-free and allows a third-party auditor to generate authentication metasets on behalf of users, which can achieve lightweight computing. It can protect the privacy of a user’s data by blinding the raw data before storing them in the CSP and sending to the third-party auditor. At the same time, this scheme can realize batch auditing. Their proposed scheme is very valuable.However, we find this scheme is not secure. A malicious CSP can easily forge auditing proof. Even if the CSP deletes all the data of a user, it can still generate the correct data possession proof to pass the verification of TPA. According to our findings, we have carried out the following work:(1)
We give two attack methods to prove the insecurity of Han’s scheme. The first attack proves that the audit proof can be forged by the CSP, and the second attack proves that the CSP can pass the verification of the TPA even if it deletes the user’s data.(2)
Based on the original scheme, we propose an improved scheme, which can effectively resist the forgery attack from CSP.


## 2. System Model and Design Goals

### 2.1. The System Model

The cloud storage system (CSS) includes three entities as depicted in Figure1: users, CSP, and TPA. The specific definitions are as follows:(1)
Users: the owner of the data, outsources the data to the CSP for storage, and delivers the audit work to the TPA.(2)
CSP : a provider of cloud storage services, has large storage space and powerful computing capabilities, and can realize data sharing.(3)
TPA : the third-party auditor, generates the authentication metaset for users’ data and audits the integrity of data stored in the cloud for users.Figure 1
System model.As depicted in Figure2, the workflow of this scheme is as follows:(1)
When a user needs to store a data file in the cloud server, they blind it and send the blinded data file to the CSP and TPA. Then, they delete the local data;(2)
After receiving the blinded data from user, the TPA generates the tags for the data and sends it to the CSP;(3)
In order to ensure whether their data is correctly stored in the cloud server, the user sends an auditing request to TPA;(4)
Upon receiving the auditing request, the TPA randomly selects a small set of data blocks as the audit objects and sends an auditing challenge to the CSP;(5)
The cloud server, based on the challenge and the authentication metaset, generates a proof and sends it to the TPA.(6)
After receiving the proof, the TPA verifies the correctness of it. Finally, the TPA sends the auditing report to the user.Figure 2
Workflow.


### 2.2. The Design Goals

Our cloud storage audit scheme would achieve the requirements of public auditability, correctness, and unforgeability.(1)
Pubic auditability: TPA can replace the user to remotely audit the integrity of the data when the user does not need to download the data stored in the cloud.(2)
Correctness: if CSP honestly stores user data, it can be audited by TPA. Otherwise, the generated proof cannot be verified by TPA.(3)
Unforgeability: any party cannot forge the authentication meta set of a user's data unless it has the user's secret key.


## 2.1. The System Model

The cloud storage system (CSS) includes three entities as depicted in Figure1: users, CSP, and TPA. The specific definitions are as follows:(1)
Users: the owner of the data, outsources the data to the CSP for storage, and delivers the audit work to the TPA.(2)
CSP : a provider of cloud storage services, has large storage space and powerful computing capabilities, and can realize data sharing.(3)
TPA : the third-party auditor, generates the authentication metaset for users’ data and audits the integrity of data stored in the cloud for users.Figure 1
System model.As depicted in Figure2, the workflow of this scheme is as follows:(1)
When a user needs to store a data file in the cloud server, they blind it and send the blinded data file to the CSP and TPA. Then, they delete the local data;(2)
After receiving the blinded data from user, the TPA generates the tags for the data and sends it to the CSP;(3)
In order to ensure whether their data is correctly stored in the cloud server, the user sends an auditing request to TPA;(4)
Upon receiving the auditing request, the TPA randomly selects a small set of data blocks as the audit objects and sends an auditing challenge to the CSP;(5)
The cloud server, based on the challenge and the authentication metaset, generates a proof and sends it to the TPA.(6)
After receiving the proof, the TPA verifies the correctness of it. Finally, the TPA sends the auditing report to the user.Figure 2
Workflow.


## 2.2. The Design Goals

Our cloud storage audit scheme would achieve the requirements of public auditability, correctness, and unforgeability.(1)
Pubic auditability: TPA can replace the user to remotely audit the integrity of the data when the user does not need to download the data stored in the cloud.(2)
Correctness: if CSP honestly stores user data, it can be audited by TPA. Otherwise, the generated proof cannot be verified by TPA.(3)
Unforgeability: any party cannot forge the authentication meta set of a user's data unless it has the user's secret key.


## 3. Review of Han’s Scheme

Jing Han et al. (2020) proposed a public cloud auditing scheme, which consists of six algorithms as follows. Before reviewing this scheme, we first introduce the concept of HomMAC (homomorphic message authentication code). For a more specific definition, please refer to [24]. For the specific descriptions of the symbols that appear below, please refer to Table 1.Table 1
Symbols.
SymbolsDescriptionsGA multiplicative cyclic group.hA secure hash function such thath·:0,1∗⟶Zp .ZqA prime field.qThe order of groupG.gThe generator of groupG.ΓThe index set of data blocks.m=m11,...,mnsThe user’s data file withn blocks and s slices.αThe secret random values of user.ΔTime upper limit.ka key pair, wherekg∈ℜprg and kf∈ℜprf .IDUThe identifier of user.IDTThe identifier of TPA.skUThe secret key of user.pkUThe public key of user.skTThe secret key of TPA.pkTThe public key of TPA.tTime stamp.TagMThe unique tag of the fileM.σiThe authentication label for the i-th data block.ΦThe authentication meta set of data blocks.chalThe challenge set.pThe proof generated by CSP or auditor.Given a data blockmi=mi1,mi2…,mis∈Zqs , then computes(1)ρi=∑l=1sωlmil+ϖi,where ρi is the HomMAC of mi and ω1,ω2,…,ωs∈Zq , ϖ∈Zq.(1)
Setup: input a security parameter λ , and then outputs p,q , which are two large primes. The CSS selects h⋅:0,1∗⟶Zq and G . The CSS sets a PRG:ℜprg⟶Zqs and PRF:ℜprf×Γ⟶Zq . Besides, the CSS set two time upper limits ΔS and ΔA, where ΔS is the longest time for CSP to generate auditing proof, ΔA is the longest time for the TPA to generate authentication meta set. Finally, the cp=p,q,G,g,PRF,PRG,h⋅,ΔS,ΔA is made public.(2)
KeyGen: the identifier of TPA is IDT∈Zq and IDU∈Zq . TPA generate their secret skT∈Zq∗ and public key pkT=gskT . The user generates this secret/public key pair skupku from cp . Besides, the user chooses s random values α1α2…,αs∈Zq∗ and keeps them secret.(3)
SigGen:


### 3.1. SigGen1

First, the user divided fileM into n data blocks. Then, divided each data block into s segments. Then, they establishe a unique tag TagM=name‖SSigskUname for the file M.The user blinds each data blocks to protect the privacy of the fileM as follows:Chooses a random valueu∈RG and then compute βl=uαl∈G and φl=hβl , where l=1,2,…,s. Blind each data block mi:(2)mil′=αlmil+φlmodq,l=1,2,…,s,mi′=mi1′,mi2′,…,mis′.The blinded file isM′=m1′,m2′,…,mn′.Finally, the user sendsM′,TagM,IDU to TPA and sends IDU,TagM,M′,ts1 to CSP.


### 3.2. SigGen2

The TPA choose a key pairk=kg,kf, where kg∈ℜprg and kf∈ℜprf. Then, they compute(3)ω=ω1,ω2,…,ωs⟵PRGkg,ω1,ω2,…,ωs∈Zq,ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq.and the HomMAC:(4)ρi=∑l=1sωlmil′+ϖi,i=1,2,…,n.The TPA computeri=gηi and si=riηi+ρiskTmodq, and then output σi=ri,si, where ηi∈Zq∗ is random value. Let Φ=σi be the authentication meta set of data blocks mi′. Then, IDT,k,TagM,Φ is sent to the CSP.


### 3.3. Storage

The CSP stores fileM′.When receiving the data from TPA, the CSP records time stampts2, and computes:(5)Δs′=ts2−ts1.IfΔS′>ΔS, the CSP refuse to store data. Otherwise, they store data.Next, the CSP computes the validity ofΦ by performing the following computations:(6)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq,(7)ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq,(8)gsi=riri⋅pkT∑l=1sωl⋅mil′+ϖimodp.If the (8) holds, the CSP stores the file and other information.


### 3.4. Challenge

The user sends an auditing request to the TPA. If it is validity, the TPA generates an auditing challengechal as follows:The TPA randomly choosesc elements as a subset I∈Γ and chooses a random value vi∈Zq∗. Then, output chal=i,vi. Finally, they send the chal to the CSP.


### 3.5. ProofGen

The CSP computes:(9)R=∏i∈Irivisimodq,S=∑i∈Ivisimodq,μl=∑i∈Ivimil′modq,l=1,2,…,s.Then, the proofμ,R,S is sent to the TPA, in which μ=μ1,μ2,…,μs.ProofVer: after receiving the proof, the TPA records time stamp tA2 immediately and computes ΔA′=tA2−tA1. If ΔA′>ΔA, stop audit work and return “Expiration” to the CSP. Otherwise, proceed to the following steps.Compute:(10)τ=∑l=1sωlμl+∑i∈Iviϖimodq.Then, verify the following equation:(11)gs=R⋅pkTτmodp.If the (11) does not hold, the TPA concludes that the user’s data is corrupted. Otherwise, the TPA believe the user’s data is integrity. Finally, the TPA sends the auditing report to the user.


### 3.6. Attack I

In this section, we will show the scheme of Jing Han et al. is not secure by giving the attack I. From the protocol ofProofVer, we can know that the TPA verifying the integrity of the data stored in the CSP by determines whether the following equation holds:(12)gs′=R⋅pkTτmodp.Through observation, we can obtain the following information:(1)
Thepk in this equation is the public key of user, which can be obtained by the CSP(2)
τ=∑l=1sωlμl+∑i∈Iviϖimodq, the CSP can obtain the ωl, ϖi and vi , and the μ is computed by CSP(3)
TheS and R is generated by CSPThrough the abovementioned points, the CSP can forge an auditing proof. The specific process is as follows:(1)
In theaudit phase, after receiving the chal from TPA, the CSP randomly chooses s numbers as μl′∈Zq,l=1,2,…,s.(2)
The CSP computes theτ′ based on the μl′∈Zq,l=1,2,…,s:(13)τ′=∑l=1sωlμl′+∑i∈Iviϖimodq,and then computes the value of pkTτ.(3)
The CSP randomly selects a number asS′∈Zq, and computes gS′(4)
With the value ofpkTτ and gS′, the CSP computes R′:(14)R′=gs′pkTτmodq,(5)
Finally, the CSP generates the forged proofp′=μ′,R′,S′ and sends it to the TPA, where μ′=μ1′,μ2′,…,μs′.


### 3.7. Attack II

Our attack II is based on this observation because the CSP can forge the auditing proof without using the blinded data of the user, which has been proved in the attack I. The malicious CSP can even delete the data stored in the cloud server but can still pass the verification of the TPA. Concretely, the attack is as follows:(1)
In thestorage phase, after receiving the message from the TPA, the CSP verifies the validity of it and the correctness of Φ as the original scheme. If the message is valid and the Φ is correct, the CSP computes:(15)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq.(16)ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq,then the CSP deletes the user’s data file.(2)
In theaudit phase, to verify the integrity of the data in the CSP, TPA sends a challenge chal to the CSP. Upon receiving the chal, the CSP generates an auditing proof p′=μ′,R′,S′ according to the method in the attack II. Note that the user’s data are not stored when the CSP generates proof at this time(3)
After receiving the proofp′ from the CSP, the TPA verifies the correctness of p′. First, the TPA generates ω=ω1,ω2,…,ωs,ωl∈Zq≠ and ϖi∈Zq, where l=1,2,…,s. Then they compute(17)τ′=∑l=1sωlμl′+∑i∈Iviϖimodq,based on the μl′ from the CSP. Finally, the TPA verifies the whether the following equation holds:(18)gs′=R′⋅pkTτ′modp.Because theS′ and R′ in the p′ all are generated by the CSP, here we can prove the forged proof p′ is a valid one for the eq. holds:(19)gs′=R′⋅pkTτ′modp=gs′pkTτ′pkTτ′modp,=gs′.


## 3.1. SigGen1

First, the user divided fileM into n data blocks. Then, divided each data block into s segments. Then, they establishe a unique tag TagM=name‖SSigskUname for the file M.The user blinds each data blocks to protect the privacy of the fileM as follows:Chooses a random valueu∈RG and then compute βl=uαl∈G and φl=hβl , where l=1,2,…,s. Blind each data block mi:(2)mil′=αlmil+φlmodq,l=1,2,…,s,mi′=mi1′,mi2′,…,mis′.The blinded file isM′=m1′,m2′,…,mn′.Finally, the user sendsM′,TagM,IDU to TPA and sends IDU,TagM,M′,ts1 to CSP.


## 3.2. SigGen2

The TPA choose a key pairk=kg,kf, where kg∈ℜprg and kf∈ℜprf. Then, they compute(3)ω=ω1,ω2,…,ωs⟵PRGkg,ω1,ω2,…,ωs∈Zq,ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq.and the HomMAC:(4)ρi=∑l=1sωlmil′+ϖi,i=1,2,…,n.The TPA computeri=gηi and si=riηi+ρiskTmodq, and then output σi=ri,si, where ηi∈Zq∗ is random value. Let Φ=σi be the authentication meta set of data blocks mi′. Then, IDT,k,TagM,Φ is sent to the CSP.


## 3.3. Storage

The CSP stores fileM′.When receiving the data from TPA, the CSP records time stampts2, and computes:(5)Δs′=ts2−ts1.IfΔS′>ΔS, the CSP refuse to store data. Otherwise, they store data.Next, the CSP computes the validity ofΦ by performing the following computations:(6)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq,(7)ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq,(8)gsi=riri⋅pkT∑l=1sωl⋅mil′+ϖimodp.If the (8) holds, the CSP stores the file and other information.


## 3.4. Challenge

The user sends an auditing request to the TPA. If it is validity, the TPA generates an auditing challengechal as follows:The TPA randomly choosesc elements as a subset I∈Γ and chooses a random value vi∈Zq∗. Then, output chal=i,vi. Finally, they send the chal to the CSP.


## 3.5. ProofGen

The CSP computes:(9)R=∏i∈Irivisimodq,S=∑i∈Ivisimodq,μl=∑i∈Ivimil′modq,l=1,2,…,s.Then, the proofμ,R,S is sent to the TPA, in which μ=μ1,μ2,…,μs.ProofVer: after receiving the proof, the TPA records time stamp tA2 immediately and computes ΔA′=tA2−tA1. If ΔA′>ΔA, stop audit work and return “Expiration” to the CSP. Otherwise, proceed to the following steps.Compute:(10)τ=∑l=1sωlμl+∑i∈Iviϖimodq.Then, verify the following equation:(11)gs=R⋅pkTτmodp.If the (11) does not hold, the TPA concludes that the user’s data is corrupted. Otherwise, the TPA believe the user’s data is integrity. Finally, the TPA sends the auditing report to the user.


## 3.6. Attack I

In this section, we will show the scheme of Jing Han et al. is not secure by giving the attack I. From the protocol ofProofVer, we can know that the TPA verifying the integrity of the data stored in the CSP by determines whether the following equation holds:(12)gs′=R⋅pkTτmodp.Through observation, we can obtain the following information:(1)
Thepk in this equation is the public key of user, which can be obtained by the CSP(2)
τ=∑l=1sωlμl+∑i∈Iviϖimodq, the CSP can obtain the ωl, ϖi and vi , and the μ is computed by CSP(3)
TheS and R is generated by CSPThrough the abovementioned points, the CSP can forge an auditing proof. The specific process is as follows:(1)
In theaudit phase, after receiving the chal from TPA, the CSP randomly chooses s numbers as μl′∈Zq,l=1,2,…,s.(2)
The CSP computes theτ′ based on the μl′∈Zq,l=1,2,…,s:(13)τ′=∑l=1sωlμl′+∑i∈Iviϖimodq,and then computes the value of pkTτ.(3)
The CSP randomly selects a number asS′∈Zq, and computes gS′(4)
With the value ofpkTτ and gS′, the CSP computes R′:(14)R′=gs′pkTτmodq,(5)
Finally, the CSP generates the forged proofp′=μ′,R′,S′ and sends it to the TPA, where μ′=μ1′,μ2′,…,μs′.


## 3.7. Attack II

Our attack II is based on this observation because the CSP can forge the auditing proof without using the blinded data of the user, which has been proved in the attack I. The malicious CSP can even delete the data stored in the cloud server but can still pass the verification of the TPA. Concretely, the attack is as follows:(1)
In thestorage phase, after receiving the message from the TPA, the CSP verifies the validity of it and the correctness of Φ as the original scheme. If the message is valid and the Φ is correct, the CSP computes:(15)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq.(16)ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq,then the CSP deletes the user’s data file.(2)
In theaudit phase, to verify the integrity of the data in the CSP, TPA sends a challenge chal to the CSP. Upon receiving the chal, the CSP generates an auditing proof p′=μ′,R′,S′ according to the method in the attack II. Note that the user’s data are not stored when the CSP generates proof at this time(3)
After receiving the proofp′ from the CSP, the TPA verifies the correctness of p′. First, the TPA generates ω=ω1,ω2,…,ωs,ωl∈Zq≠ and ϖi∈Zq, where l=1,2,…,s. Then they compute(17)τ′=∑l=1sωlμl′+∑i∈Iviϖimodq,based on the μl′ from the CSP. Finally, the TPA verifies the whether the following equation holds:(18)gs′=R′⋅pkTτ′modp.Because theS′ and R′ in the p′ all are generated by the CSP, here we can prove the forged proof p′ is a valid one for the eq. holds:(19)gs′=R′⋅pkTτ′modp=gs′pkTτ′pkTτ′modp,=gs′.


## 4. Our Improved Scheme

In order to resist the abovementioned attack, in this section, we give our improved security scheme. The details of this scheme are as follows.


### 4.1. A Single-User Scenario

Based on the original scheme, our scheme consists of six algorithms: Setup, KeyGen, SigGen, Challenge, ProofGen, and ProofVer.(1)
Setup: the cloud storage system (CSS) inputs a security parameter λ , and then outputs p,q , which are two large primes. The CSS chooses a secure hash function h⋅:0,1∗⟶Zq a multiplicative cyclic group G , where the order of G is q and the generator of G is g. The CSS sets a PRG:ℜprg⟶Zqs and PRF:ℜprf×Γ⟶Zq . Γ=1,2,…,n is the index set of data blocks. Besides, the CSS set two time upper limits ΔS and ΔA, where ΔS is the longest time for CSP to generate auditing proof, ΔA is the longest time for the TPA to generate authentication meta set. Finally, the cp=p,q,G,g,PRF,PRG,h⋅,ΔS,ΔA is made public.(2)
KeyGen : the identifier of TPA is IDT∈Zq and IDU∈Zq . TPA generate their secret skT∈Zq∗ and public key pkT=gskT . The user generate this secret/public key pair sku,pku from cp . Besides, the user chooses s random values α1,α2,…,αs∈Zq∗ and keeps them secret.(3)
SigGen : this algorithm is run by user, TPA, and CSP, including three subalgorithms SigGen1, SigGen2, and storage.


#### 4.1.1. SigGen 1

The user processes the file and generates the tags of data blocks.First, the user divided fileM into n data blocks and each data block is divided into s segments.(20)M=m1,m2,…,mn,mi=mi1,mi2,…,mis,i∈1,2,…,n.Then, they establishe a unique tagTagM=name‖SSigskUname for the file M, where the SSigskUname is the signature of the file’s name using skU.The user blinds each data blocks to protect the privacy of the fileM as follows:Chooses a random valueu∈RG and then compute βl=uαl∈G and φl=hβl , where l=1,2,…,s. Blind each data block mi:(21)mil′=αlmil+φlmodq,l=1,2,…,s,mi′=mi1′,mi2′,…,mis′.The blinded file isM′=m1′,m2′,…,mn′.Finally, the user sendsIDU,TagM,M′ to the TPA and sends IDU,TagM,M′,ts1 to CSP.


#### 4.1.2. SigGen 2

The TPA generates authentication meta set for the user.The TPA choose a key pairk=kg,kf, where kg∈ℜprg and kf∈ℜprf. Then, they compute(22)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq,ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq,and the HomMAC:(23)ρi=∑l=1sωlmil′+ϖi,i=1,2,…,n.The TPA computeri=gηi and si=riηi+ρiskTmodq, and then output σi=ri,si, where ηi∈Zq∗ is random value. Let Φ=σi be the authentication meta set of data blocks mi′ for i=1,2,…,n. Then, the TPA send IDT,k,TagM,Φ to the CSP and delete the file M′ from their local record.


#### 4.1.3. Storage

The CSP stores fileM′.When receiving the data from TPA, the CSP records time stampts2, and computes:(24)ΔS′=ts2−ts1.IfΔS′>ΔS, the CSP refuse to store data. Otherwise, they store data.Next, the CSP computes the validity ofΦ by performing the following computations:(25)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq,ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq.(26)gsi=riri⋅pkT∑l=1sωl⋅mil′+ϖimodp.If the (26) holds, the CSP returns “Correct” to the user and stores the file, the file tag TagM and Φ. Otherwise, the CSP does not store the file and returns “Error” to the user.


#### 4.1.4. Challenge

The user sends an auditing request to the TPA. If it is validity, the TPA generates an auditing challengechal as follows:The TPA randomly choosesc elements as a subset I∈Γ and chooses a random value vi∈Zq∗ for each element i∈I. Then, output chal=i,vi for i∈I. Finally, they send the chal to the CSP and record the time stamp tA1 immediately.


#### 4.1.5. ProofGen

After receiving thechal, the CSP computes the proof p .The CSP computes:(27)S=∑i∈Ivisimodq,μl=∑i∈Ivimil′modq,l=1,2,…,s.Then, they generates the proofp=μ,S and sends it to the TPA, where μ=μ1,μ2,…,μs. Note that CSP no longer needs to generate R an element of audit proof.


#### 4.1.6. ProofVer

After receiving the proof, the TPA records time stamptA2 immediately and computes ΔA′=tA2−tA1. If ΔA′>ΔA, stop audit work and return “Expiration” to the CSP. Otherwise, proceed to the following steps.Compute:(28)R=∏i∈Irivisimodq,τ=∑l=1sωlμl+∑i∈Iviϖimodq.Then, verify the following equation:(29)gs=R⋅pkTτmodp.If the (29) does not hold, the TPA concludes that the user’s data are corrupted. Otherwise, the TPA believe the user’s data are integrity. Finally, the auditing report is sent to the user.


### 4.2. A Multiuser Scenario

In edge computing, it is common for multiple end users to apply for an audit at the same time. Compared with the single-user scheme, batch auditing can reduce the computational consumption and thus improve the auditing efficiency. In this section, we extend the scheme in section 6.1 to the one that TPA can conduct batch auditing for multiple users.Suppose there are N users. They send their auditing requests to the TPA. In the three phases of Setup, KeyGen and SigGen, users, TPA and CSP do the same as described in section 6.1.(1)
Challenge: upon receiving the auditing requests, the TPA randomly chooses c elements as a subset I∈Γ and chooses a random value vi∈Zq∗ for each element i∈I. Then, output chal=i,vi,Ms, where Ms includes the message of the N users. Finally, they send the chal to the CSP and record the time stamp tA1 immediately.(2)
ProofGen : after receiving the chal from TPA, CSP perform the following calculations:(30)S=∑θ=1N∑i∈Ivisiθmodq,θ=1,2,…,N,μlθ=∑i∈Ivimilθmodq,l=1,2,…,s.Then, the TPA send auditing proof p=μθ,S to the CSP, where μθ=μ1θ,μ2θ,…,μsθ.(3)
ProofVer : after receiving the proof, the TPA records time stamp tA2 immediately and computes ΔA′=tA2−tA1. If ΔA′>ΔA, stop audit work and return “Expiration” to the CSP. Otherwise, the TPA computes:(31)ωθ=ω1θ,ω2θ,…,ωsθ←PRGkgθω1θ,ω2θ,…,ωsθ∈Zq←PRFkfθ,iθ.Then, compute:(32)R=∏θ=1N∏i∈Irivisimodq,τθ=∑l=1sωlθμlθ+∑i∈Iviϖθmodq,τ˜=∑θ=1Nτθmodq.Finally, verify the following equation:(33)gs=R⋅pkTτ˜modp.If the (29) does not hold, the TPA concludes that the users’ data is corrupted. Otherwise, the TPA believes the users’ data is integrity. Finally, the auditing reports are sent to the users.


## 4.1. A Single-User Scenario

Based on the original scheme, our scheme consists of six algorithms: Setup, KeyGen, SigGen, Challenge, ProofGen, and ProofVer.(1)
Setup: the cloud storage system (CSS) inputs a security parameter λ , and then outputs p,q , which are two large primes. The CSS chooses a secure hash function h⋅:0,1∗⟶Zq a multiplicative cyclic group G , where the order of G is q and the generator of G is g. The CSS sets a PRG:ℜprg⟶Zqs and PRF:ℜprf×Γ⟶Zq . Γ=1,2,…,n is the index set of data blocks. Besides, the CSS set two time upper limits ΔS and ΔA, where ΔS is the longest time for CSP to generate auditing proof, ΔA is the longest time for the TPA to generate authentication meta set. Finally, the cp=p,q,G,g,PRF,PRG,h⋅,ΔS,ΔA is made public.(2)
KeyGen : the identifier of TPA is IDT∈Zq and IDU∈Zq . TPA generate their secret skT∈Zq∗ and public key pkT=gskT . The user generate this secret/public key pair sku,pku from cp . Besides, the user chooses s random values α1,α2,…,αs∈Zq∗ and keeps them secret.(3)
SigGen : this algorithm is run by user, TPA, and CSP, including three subalgorithms SigGen1, SigGen2, and storage.


### 4.1.1. SigGen 1

The user processes the file and generates the tags of data blocks.First, the user divided fileM into n data blocks and each data block is divided into s segments.(20)M=m1,m2,…,mn,mi=mi1,mi2,…,mis,i∈1,2,…,n.Then, they establishe a unique tagTagM=name‖SSigskUname for the file M, where the SSigskUname is the signature of the file’s name using skU.The user blinds each data blocks to protect the privacy of the fileM as follows:Chooses a random valueu∈RG and then compute βl=uαl∈G and φl=hβl , where l=1,2,…,s. Blind each data block mi:(21)mil′=αlmil+φlmodq,l=1,2,…,s,mi′=mi1′,mi2′,…,mis′.The blinded file isM′=m1′,m2′,…,mn′.Finally, the user sendsIDU,TagM,M′ to the TPA and sends IDU,TagM,M′,ts1 to CSP.


### 4.1.2. SigGen 2

The TPA generates authentication meta set for the user.The TPA choose a key pairk=kg,kf, where kg∈ℜprg and kf∈ℜprf. Then, they compute(22)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq,ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq,and the HomMAC:(23)ρi=∑l=1sωlmil′+ϖi,i=1,2,…,n.The TPA computeri=gηi and si=riηi+ρiskTmodq, and then output σi=ri,si, where ηi∈Zq∗ is random value. Let Φ=σi be the authentication meta set of data blocks mi′ for i=1,2,…,n. Then, the TPA send IDT,k,TagM,Φ to the CSP and delete the file M′ from their local record.


### 4.1.3. Storage

The CSP stores fileM′.When receiving the data from TPA, the CSP records time stampts2, and computes:(24)ΔS′=ts2−ts1.IfΔS′>ΔS, the CSP refuse to store data. Otherwise, they store data.Next, the CSP computes the validity ofΦ by performing the following computations:(25)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq,ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq.(26)gsi=riri⋅pkT∑l=1sωl⋅mil′+ϖimodp.If the (26) holds, the CSP returns “Correct” to the user and stores the file, the file tag TagM and Φ. Otherwise, the CSP does not store the file and returns “Error” to the user.


### 4.1.4. Challenge

The user sends an auditing request to the TPA. If it is validity, the TPA generates an auditing challengechal as follows:The TPA randomly choosesc elements as a subset I∈Γ and chooses a random value vi∈Zq∗ for each element i∈I. Then, output chal=i,vi for i∈I. Finally, they send the chal to the CSP and record the time stamp tA1 immediately.


### 4.1.5. ProofGen

After receiving thechal, the CSP computes the proof p .The CSP computes:(27)S=∑i∈Ivisimodq,μl=∑i∈Ivimil′modq,l=1,2,…,s.Then, they generates the proofp=μ,S and sends it to the TPA, where μ=μ1,μ2,…,μs. Note that CSP no longer needs to generate R an element of audit proof.


### 4.1.6. ProofVer

After receiving the proof, the TPA records time stamptA2 immediately and computes ΔA′=tA2−tA1. If ΔA′>ΔA, stop audit work and return “Expiration” to the CSP. Otherwise, proceed to the following steps.Compute:(28)R=∏i∈Irivisimodq,τ=∑l=1sωlμl+∑i∈Iviϖimodq.Then, verify the following equation:(29)gs=R⋅pkTτmodp.If the (29) does not hold, the TPA concludes that the user’s data are corrupted. Otherwise, the TPA believe the user’s data are integrity. Finally, the auditing report is sent to the user.


## 4.1.1. SigGen 1

The user processes the file and generates the tags of data blocks.First, the user divided fileM into n data blocks and each data block is divided into s segments.(20)M=m1,m2,…,mn,mi=mi1,mi2,…,mis,i∈1,2,…,n.Then, they establishe a unique tagTagM=name‖SSigskUname for the file M, where the SSigskUname is the signature of the file’s name using skU.The user blinds each data blocks to protect the privacy of the fileM as follows:Chooses a random valueu∈RG and then compute βl=uαl∈G and φl=hβl , where l=1,2,…,s. Blind each data block mi:(21)mil′=αlmil+φlmodq,l=1,2,…,s,mi′=mi1′,mi2′,…,mis′.The blinded file isM′=m1′,m2′,…,mn′.Finally, the user sendsIDU,TagM,M′ to the TPA and sends IDU,TagM,M′,ts1 to CSP.


## 4.1.2. SigGen 2

The TPA generates authentication meta set for the user.The TPA choose a key pairk=kg,kf, where kg∈ℜprg and kf∈ℜprf. Then, they compute(22)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq,ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq,and the HomMAC:(23)ρi=∑l=1sωlmil′+ϖi,i=1,2,…,n.The TPA computeri=gηi and si=riηi+ρiskTmodq, and then output σi=ri,si, where ηi∈Zq∗ is random value. Let Φ=σi be the authentication meta set of data blocks mi′ for i=1,2,…,n. Then, the TPA send IDT,k,TagM,Φ to the CSP and delete the file M′ from their local record.


## 4.1.3. Storage

The CSP stores fileM′.When receiving the data from TPA, the CSP records time stampts2, and computes:(24)ΔS′=ts2−ts1.IfΔS′>ΔS, the CSP refuse to store data. Otherwise, they store data.Next, the CSP computes the validity ofΦ by performing the following computations:(25)ω=ω1,ω2,…,ωs←PRGkg,ω1,ω2,…,ωs∈Zq,ϖi←PRFkf,ϖ1,ϖ2,…,ϖn∈Zq.(26)gsi=riri⋅pkT∑l=1sωl⋅mil′+ϖimodp.If the (26) holds, the CSP returns “Correct” to the user and stores the file, the file tag TagM and Φ. Otherwise, the CSP does not store the file and returns “Error” to the user.


## 4.1.4. Challenge

The user sends an auditing request to the TPA. If it is validity, the TPA generates an auditing challengechal as follows:The TPA randomly choosesc elements as a subset I∈Γ and chooses a random value vi∈Zq∗ for each element i∈I. Then, output chal=i,vi for i∈I. Finally, they send the chal to the CSP and record the time stamp tA1 immediately.


## 4.1.5. ProofGen

After receiving thechal, the CSP computes the proof p .The CSP computes:(27)S=∑i∈Ivisimodq,μl=∑i∈Ivimil′modq,l=1,2,…,s.Then, they generates the proofp=μ,S and sends it to the TPA, where μ=μ1,μ2,…,μs. Note that CSP no longer needs to generate R an element of audit proof.


## 4.1.6. ProofVer

After receiving the proof, the TPA records time stamptA2 immediately and computes ΔA′=tA2−tA1. If ΔA′>ΔA, stop audit work and return “Expiration” to the CSP. Otherwise, proceed to the following steps.Compute:(28)R=∏i∈Irivisimodq,τ=∑l=1sωlμl+∑i∈Iviϖimodq.Then, verify the following equation:(29)gs=R⋅pkTτmodp.If the (29) does not hold, the TPA concludes that the user’s data are corrupted. Otherwise, the TPA believe the user’s data are integrity. Finally, the auditing report is sent to the user.


## 4.2. A Multiuser Scenario

In edge computing, it is common for multiple end users to apply for an audit at the same time. Compared with the single-user scheme, batch auditing can reduce the computational consumption and thus improve the auditing efficiency. In this section, we extend the scheme in section 6.1 to the one that TPA can conduct batch auditing for multiple users.Suppose there are N users. They send their auditing requests to the TPA. In the three phases of Setup, KeyGen and SigGen, users, TPA and CSP do the same as described in section 6.1.(1)
Challenge: upon receiving the auditing requests, the TPA randomly chooses c elements as a subset I∈Γ and chooses a random value vi∈Zq∗ for each element i∈I. Then, output chal=i,vi,Ms, where Ms includes the message of the N users. Finally, they send the chal to the CSP and record the time stamp tA1 immediately.(2)
ProofGen : after receiving the chal from TPA, CSP perform the following calculations:(30)S=∑θ=1N∑i∈Ivisiθmodq,θ=1,2,…,N,μlθ=∑i∈Ivimilθmodq,l=1,2,…,s.Then, the TPA send auditing proof p=μθ,S to the CSP, where μθ=μ1θ,μ2θ,…,μsθ.(3)
ProofVer : after receiving the proof, the TPA records time stamp tA2 immediately and computes ΔA′=tA2−tA1. If ΔA′>ΔA, stop audit work and return “Expiration” to the CSP. Otherwise, the TPA computes:(31)ωθ=ω1θ,ω2θ,…,ωsθ←PRGkgθω1θ,ω2θ,…,ωsθ∈Zq←PRFkfθ,iθ.Then, compute:(32)R=∏θ=1N∏i∈Irivisimodq,τθ=∑l=1sωlθμlθ+∑i∈Iviϖθmodq,τ˜=∑θ=1Nτθmodq.Finally, verify the following equation:(33)gs=R⋅pkTτ˜modp.If the (29) does not hold, the TPA concludes that the users’ data is corrupted. Otherwise, the TPA believes the users’ data is integrity. Finally, the auditing reports are sent to the users.


## 5. Security Analysis

In this section, we first prove the correctness of the improved scheme. Then, we prove that the auditing proof cannot be forged, which proves that our proposed scheme can resist attack I and attack II. The proof process of privacy preserving users’ data can refer to Han’s scheme.


### 5.1. Correctness

The correctness of verification (8) is proved as follows:(34)gsi=griηi+ρi⋅skTmodp=griηi+gρi⋅skTmodp=riripkT∑l=1sωlmil+ϖimodp.The correctness of verification (11) is elaborated as follows:(35)gS=g∑i∈Ivisimodp=g∑i∈Iviriηi+ρi⋅skTmodp=R⋅pkT∑l=1sωl∑i∈Ivimil′+∑i∈Iviϖimodp=R⋅pkT∑l=1sωlμl+∑i∈Iviϖimodp=R⋅pkTτmodp.The correctness of verification (33) is proved in the following:(36)gS=g∑θ=1N∑i∈Ivisiθmodq=g∑θ=1N∑i∈Iviriθηθ+ρiθ⋅skTmodp=R⋅∏θ=1NpkT∑i∈Iviρiθmodp=R⋅∏θ=1NpkT∑i∈Ivi∑l=1sωlθmil′θϖiθmodp=R⋅∏θ=1NpkT∑l=1sωlθμlθ+∑i∈Iviϖlθmodp=R⋅∏θ=1NpkTτθmodp=R⋅pkTτ˜modp.


### 5.2. Unforgeability

In our improved scheme, a malicious CSP cannot forge a correct audit proof that can pass the verification of TPA.Proof.
the malicious CSP forge a proofp⌢=μ⌢,S⌢. If it is valid, the (7) will hold.(37)gs⌢=R⌢⋅pkTτmodp,pkTτ=gS⌢R⌢.
BecauseP is valid, (38) must hold.(38)gs=R⋅pkTτmodp,pkTτ=gSR.
According to (37) and (38), we can get:(39)gS⌢R⌢=gSR.
In the original scheme, bothR and S are calculated by the CSP and sent to the TPA, so the CSP can easily calculates the value of gS/R and then forges gS⌢/R⌢ that makes the (39) hold according to the method in attack 1. However, in our improved scheme, R is generated by TPA, so the (40) must hold.(40)gS−S⌢=RR⌢−1.
From the abovementioned equations,S=S⌢ and R=R⌢ must hold. Otherwise, we can easily get the value of S−S⌢ when g,gS−S⌢∈G is given. It means that there is a solution of a DLP instance in G. However, this contradicts to the proven DLP difficult problem. Therefore, a malicious CSP cannot forge a valid auditing proof to pass the verification of TPA.


### 5.3. Privacy Preserving

The proposed scheme provides privacy preserving for users’ data.Proof.
before sending the data to TPA and CSP, the user has blinded each data block by using random mask technique as follows:(41)mil′=αlmil+φlmodq,l=1,2,…,s,mi′=mi1′,mi2′,…,mis′,where u∈RG, βl=uαl∈G, φl=hβl , l=1,2,…,s. The curious TPA or CSP may want to obtain some privacy information of user from the blinded data M′. Only know the value of αl∈RZq∗ for l=1,2,…,s can they do that successfully. However, that computing αl given βl=uαl∈G is to solve the DLP in G, which is infeasible in calculation. Therefore, the curious TPA or CSP have no ability to get privacy information of user’s data.


## 5.1. Correctness

The correctness of verification (8) is proved as follows:(34)gsi=griηi+ρi⋅skTmodp=griηi+gρi⋅skTmodp=riripkT∑l=1sωlmil+ϖimodp.The correctness of verification (11) is elaborated as follows:(35)gS=g∑i∈Ivisimodp=g∑i∈Iviriηi+ρi⋅skTmodp=R⋅pkT∑l=1sωl∑i∈Ivimil′+∑i∈Iviϖimodp=R⋅pkT∑l=1sωlμl+∑i∈Iviϖimodp=R⋅pkTτmodp.The correctness of verification (33) is proved in the following:(36)gS=g∑θ=1N∑i∈Ivisiθmodq=g∑θ=1N∑i∈Iviriθηθ+ρiθ⋅skTmodp=R⋅∏θ=1NpkT∑i∈Iviρiθmodp=R⋅∏θ=1NpkT∑i∈Ivi∑l=1sωlθmil′θϖiθmodp=R⋅∏θ=1NpkT∑l=1sωlθμlθ+∑i∈Iviϖlθmodp=R⋅∏θ=1NpkTτθmodp=R⋅pkTτ˜modp.


## 5.2. Unforgeability

In our improved scheme, a malicious CSP cannot forge a correct audit proof that can pass the verification of TPA.Proof.
the malicious CSP forge a proofp⌢=μ⌢,S⌢. If it is valid, the (7) will hold.(37)gs⌢=R⌢⋅pkTτmodp,pkTτ=gS⌢R⌢.
BecauseP is valid, (38) must hold.(38)gs=R⋅pkTτmodp,pkTτ=gSR.
According to (37) and (38), we can get:(39)gS⌢R⌢=gSR.
In the original scheme, bothR and S are calculated by the CSP and sent to the TPA, so the CSP can easily calculates the value of gS/R and then forges gS⌢/R⌢ that makes the (39) hold according to the method in attack 1. However, in our improved scheme, R is generated by TPA, so the (40) must hold.(40)gS−S⌢=RR⌢−1.
From the abovementioned equations,S=S⌢ and R=R⌢ must hold. Otherwise, we can easily get the value of S−S⌢ when g,gS−S⌢∈G is given. It means that there is a solution of a DLP instance in G. However, this contradicts to the proven DLP difficult problem. Therefore, a malicious CSP cannot forge a valid auditing proof to pass the verification of TPA.


## 5.3. Privacy Preserving

The proposed scheme provides privacy preserving for users’ data.Proof.
before sending the data to TPA and CSP, the user has blinded each data block by using random mask technique as follows:(41)mil′=αlmil+φlmodq,l=1,2,…,s,mi′=mi1′,mi2′,…,mis′,where u∈RG, βl=uαl∈G, φl=hβl , l=1,2,…,s. The curious TPA or CSP may want to obtain some privacy information of user from the blinded data M′. Only know the value of αl∈RZq∗ for l=1,2,…,s can they do that successfully. However, that computing αl given βl=uαl∈G is to solve the DLP in G, which is infeasible in calculation. Therefore, the curious TPA or CSP have no ability to get privacy information of user’s data.


## 6. Conclusion

In edge computing, it will do great harm to the running of terminal users if their data stored in the CSP can be deleted without being found. In this paper, we proved that Han’s scheme is not secure because the cloud server provider can successfully forge auditing proof to prove to TPA that it honestly stores users' data. Then, we proposed an improved scheme that can effectively avoid the forgery attack from the cloud server.In the future, cloud storage auditing schemes will be proposed to adapt to more different situations in edge computing, but we should give more attention to the security of the schemes.



---

*Source: 1557233-2022-04-26.xml*