# Certificateless Public Auditing with Privacy Preserving for Cloud-Assisted Wireless Body Area Networks

Authors: Baoyuan Kang; Jiaqiang Wang; Dongyang Shao
Journal: Mobile Information Systems
 (2017)

---

## Abstract

With cloud computing being integrated with wireless body area networks, the digital ecosystem called cloud-assisted WBAN was proposed. In cloud-assisted medical systems, the integrity of the stored data is important. Recently, based on certificateless public key cryptography, He et al. proposed a certificateless public auditing scheme for cloud-assisted WBANs. But He et al.’s scheme is not a scheme with privacy preserving. After many checks on some of the same data blocks, the auditor can derive these data blocks. In this paper, we propose a certificateless public auditing scheme with privacy preserving for cloud-assisted WBANs. In the proof phase of the proposed scheme, the proof information is protected from being directly exposed to the auditor. So, the curious auditor could not derive the data blocks. We also prove that the proposed scheme is secure in the random oracle model under the assumption that the Diffie-Hellman problem is hard, and we give a comparison of the proposed scheme with He et al.’s scheme in terms of security and computation cost.


---

## Body

## 1. Introduction

Advances in wireless communication technologies, microcontroller systems, and sensor technologies have enabled the design and development of wireless body area networks (WBANs) that are playing an increasingly important role in healthcare systems because of their ability to provide continuous measurements and to monitor a patient’s health status by using medical sensors implanted inside the patient’s body [1].To make a fast diagnosis and store and process sensing data in real time, cloud computing is being integrated with traditional WBANs to propose the digital ecosystem called cloud-assisted WBAN. In cloud-assisted medical systems, the data stored in the cloud-based store resource are the basis of all diagnoses. So, the integrity of the stored data is important. As a cryptographic technique, public auditing scheme [2] could provide effective data integrity check service in cloud-assisted WBANs. In a typical public auditing scheme in cloud service, there are three entities: a data user, a cloud server, and a third-party auditor. Data file from the data user is outsourced to the cloud server, and the auditor provides the data integrity check service for the data user. The data user is a resource-constrained entity, but the auditor has certain computation ability and expertise for integrity checking. After Ateniese et al.’s pioneering work [2], many auditing schemes were proposed [3–18]. But these schemes were constructed on a public key cryptographic system; data users and the auditor need more storage space or computation cost in key management and verification.In ID-based cryptography [19], the public key of any user is his/her identity. So, it is clear that the auditing schemes on the ID-based cryptography system will reduce the costs of the data users and the auditor. Many ID-based public auditing schemes are proposed [20–23]. But, in ID-based public auditing schemes, the PKG (private key generator) knows any user’s private key. It is clear that, for patient privacy information process in cloud-assisted medical systems, ID-based public auditing schemes are not secure. Recently, based on certificateless public key cryptography [24], He et al. proposed a certificateless public auditing scheme for cloud-assisted WBANs [1]. In certificateless public key cryptography, the private key of a user consists of two parts. One is the partial private key generated by the PKG, and the other is a secret key generated by the user. So, certificateless public key cryptography simultaneously overcomes the drawback of public key cryptography and ID-based cryptography. Certificateless public auditing scheme is very applicable for cloud-assisted WBANs with energy-limited sensors and a large amount of personal sensitive information. In [1], the proposed certificateless public auditing scheme is proved to be secure and very suitable for use in cloud-assisted WBANs. But He et al.’s scheme is not a scheme with privacy preserving. After many checks on some of the same data blocks, the auditor can derive these data blocks from the proof information that the cloud server submitted.In this paper, we propose a certificateless public auditing scheme with privacy preserving. In the proof phase of the proposed scheme, the proof information is protected from being directly exposed to the auditor. So, the curious auditor could not derive the data blocks. We also prove that the proposed scheme is secure in the random oracle model under the assumption that the Diffie-Hellman problem is hard.The rest of the paper is organized as follows. In Section2, we propose the system and security model. In Section 3, we review bilinear pairing and computational Diffie-Hellman problem relevant to the security of the proposed scheme. A certificateless public auditing scheme with privacy preserving is proposed in Section 4. In Section 5, we provide security proofs of the proposed scheme. In Section 6, we compare the proposed scheme with He et al.’s scheme in terms of security and computation cost. Conclusion is given in Section 7.


## 2. The System and Security Model

### 2.1. The System Model

There are four entities included in a certificateless public auditing scheme:(1)
A data user (DU) who possesses a data file needed to be stored on the cloud.(2)
A cloud server (CS) that provides data storage service to the data user.(3)
A third-party auditor (AU) who has capacities to check data integrity on behalf of the data user.(4)
A private key generator (PKG) that is responsible for setting up the system parameter and generating the partial private key for any entity by using the entity’s identity information.To reduce the burden of data file storage, the data user (DU) uploads his/her data file to the cloud server (CS) for storage, and the DU no longer possesses his/her data file locally. To ensure the data file is correctly stored in the cloud server, DU entrusts the trusted third-party AU who has expertise and computation capabilities to periodically check his/her data file integrity.


### 2.2. The Security Model

In a certificateless public auditing scheme, PKG is a trusted authority, DU is honest, and AU is honest but curious. CS is a semitrusted party; he/she might change or delete the data user’s file for his/her benefit and forge the proof information for passing data integrity checking. We will also investigate whether AU can get any information about the data file content during the auditing process.Our design goals are three aspects:(1)
Public auditability: AU can verify the correctness of the cloud data file blocks on demand without retrieving a copy of the whole data file or introducing additional online burden to the cloud users.(2)
Storage correctness: no cheating cloud server can pass AU’s audit.(3)
Privacy preserving: AU cannot derive data user’s file content from the information collected during the auditing process.


## 2.1. The System Model

There are four entities included in a certificateless public auditing scheme:(1)
A data user (DU) who possesses a data file needed to be stored on the cloud.(2)
A cloud server (CS) that provides data storage service to the data user.(3)
A third-party auditor (AU) who has capacities to check data integrity on behalf of the data user.(4)
A private key generator (PKG) that is responsible for setting up the system parameter and generating the partial private key for any entity by using the entity’s identity information.To reduce the burden of data file storage, the data user (DU) uploads his/her data file to the cloud server (CS) for storage, and the DU no longer possesses his/her data file locally. To ensure the data file is correctly stored in the cloud server, DU entrusts the trusted third-party AU who has expertise and computation capabilities to periodically check his/her data file integrity.


## 2.2. The Security Model

In a certificateless public auditing scheme, PKG is a trusted authority, DU is honest, and AU is honest but curious. CS is a semitrusted party; he/she might change or delete the data user’s file for his/her benefit and forge the proof information for passing data integrity checking. We will also investigate whether AU can get any information about the data file content during the auditing process.Our design goals are three aspects:(1)
Public auditability: AU can verify the correctness of the cloud data file blocks on demand without retrieving a copy of the whole data file or introducing additional online burden to the cloud users.(2)
Storage correctness: no cheating cloud server can pass AU’s audit.(3)
Privacy preserving: AU cannot derive data user’s file content from the information collected during the auditing process.


## 3. Preliminary

### 3.1. The Bilinear Pairing

LetG1 be a cyclic additive group generated by P, whose order is a prime q, and let G2 be a cyclic multiplicative group of the same order. Let e:G1×G1→G2 be a pairing map which satisfies the following conditions.(1) Bilinearity. For any P,Q,R∈G1, then(1)eP+Q,R=eP,ReQ,R,eP,Q+R=eP,QeP,R.In particular, for any a,b∈Zq, e(aP,bP)=e(P,abP)=e(abP,P)=e(P,P)ab.(2) Nondegeneracy. There exists P,Q∈G1, such that e(P,Q)≠1.(3) Computability. There is an efficient algorithm to compute e(P,Q) for all P,Q∈G1.


### 3.2. Computational Diffie-Hellman (CDH) Problem

There is a generatorP of an additive cyclic group G with order q, and there is (aP,bP) for unknown a,b∈Zq∗ to compute abP.


## 3.1. The Bilinear Pairing

LetG1 be a cyclic additive group generated by P, whose order is a prime q, and let G2 be a cyclic multiplicative group of the same order. Let e:G1×G1→G2 be a pairing map which satisfies the following conditions.(1) Bilinearity. For any P,Q,R∈G1, then(1)eP+Q,R=eP,ReQ,R,eP,Q+R=eP,QeP,R.In particular, for any a,b∈Zq, e(aP,bP)=e(P,abP)=e(abP,P)=e(P,P)ab.(2) Nondegeneracy. There exists P,Q∈G1, such that e(P,Q)≠1.(3) Computability. There is an efficient algorithm to compute e(P,Q) for all P,Q∈G1.


## 3.2. Computational Diffie-Hellman (CDH) Problem

There is a generatorP of an additive cyclic group G with order q, and there is (aP,bP) for unknown a,b∈Zq∗ to compute abP.


## 4. The Proposed Scheme

The proposed certificateless public auditing scheme consists of seven algorithms:setup, partial-private-key extraction, set-public key, tag generation, challenge phase, prove phase, and verify phase.Setup. Given a security parameter k∈Z, the algorithm works as follows:(1)
Run the parameter generator on inputk to generate a prime q, an additive cyclic group G1 and a multiplicative cyclic group G2 of the same order q, a generator P of G1, and a bilinear map e:G1×G1→G2.(2)
Pick a randoms∈Zq∗ as master key of PKG and set system public key Ppub=s·P.(3)
Choose four cryptographic hash functions(2)H1:0,1∗⟶G1,H2:0,1∗⟶Zq,H3:0,1∗⟶G1,H4:0,1∗⟶G1.The system parameters areq,G1,G2,e,P,Ppub,H1,H2,H3,H4.Partial-Private-Key Extraction. When any one wants to register his/her identity IDi to PKG, the algorithm works as follows:(1)
ComputeQi=H(IDi)∈G1.(2)
Set the partial private keySi=s·Qi, where s is the master key of PKG.Set-Public Key. Given a user’s identity IDi, this algorithm picks a random xi∈Zq∗ as the user’s secret value and computes his/her public key as Pi=xiP.Tag Generation. For a data file M=m1∥⋯∥mn,mi∈Zq, this algorithm works as follows:(1)
For each data blockmi, choose ri∈RZq∗ and compute (3)Ri=ri·P,hi=H2mi,Ri,IDDU,PDU,Zi=H3mi,Ri,IDDU,PDU,T=H4Ppub.(2)
Compute(4)σmi=hiSDU+xDUZi+ri+miT.Letφ=((σm1,R1),…,(σmn,Rn)).(3)
DU sends(IDDU,M,φ) to CS.(4)
DU sends(5)REDU=IDDU,IDCS,ω=h1,Z1,R1,…,hn,Zn,Rnto AU.Challenge Phase. To check the integrity of the outsourced data file M, AU randomly chooses a set I⊆[1,n] and a number a∈Zq to generate the challenging information (6)Chall=IDDU,a,Iand sends it to the CS.Prove Phase. Upon receiving Chall=[IDDU,a,I], CS produces set ω={(i,vi)},i∈I.Here,vi=aimodq. Then, using M=m1∥⋯∥mn and φ, CS picks a random number l∈Zq∗, computes (7)σ=∑i∈Iviσmi,μ=∑i∈Ivimi-l·H2Lmodq,and sends proof information (σ,μ,L) to the AU. Here, L=l·P.Verify Phase. Upon receiving the proof information (σ,μ,L), based on stored information REDU, AU computes (8)h=∑i∈Ivihi,Z=∑i∈IviZi,R=∑i∈IviRi.Then, it checks the equation(9)eσ,P=ehQDU,Ppub·eZ,PDU·eR+μ·P+H2L·L,T.If the equation holds, AU accepts the proof.The correctness of the above verification equation can be demonstrated as follows:(10)eσ,P=e∑i∈Iviσmi,P=∏i∈Ieviσmi,P=∏i∈IevihiSDU+vixDUZi+viri+miT,P=e∑i∈IvihiSDU,P·e∑i∈IvixDUZi,P·e∑i∈Iviri+miT,P=ehQDU,Ppub·eZ,PDU·eR+μP+H2L·L,T.


## 5. Security

In this section, we discuss the security of the proposed scheme in unforgeability and privacy preserving.


### 5.1. Unforgeability

Theorem 1.
If the CDH assumption is hard, then the proposed scheme is secure against proof information existential forgery attack from the CS.Proof of Theorem1.
We will show that if CS can forge valid proof information, the challenger will use the forged proof information to solve the CDH problem.
Because CS has the signature of any one file block, CS needs not do tag oracle. So, we only look at hash functionsH1,H2 as random oracles. For given CDH problem instance (aP,bP), the challenger lets the system public key Ppub=aP, and in partial-private-key-extract phase, for two times oracles, let Qi=H1(IDi)=βj(bP), j=1,2. βj, selected by the challenger, is a random number. In the proof process, for the same Chall information and same random number l, let (σ1,μ1,L) and (σ2,μ2,L) be two pieces of valid proof information under two times different H2 oracles, H2(L)=ηi, i=1,2. Then, the following two equations hold:(11)eσ1,P=ehβ1bP,aP·eZ,PDU·eR+μ1·P+η1·lP,T,eσ2,P=ehβ2bP,aP·eZ,PDU·eR+μ2·P+η2·lP,T.Then, (12)eσ2-σ1,P=ehβ2-β1bP,aP·eμ2-μ1·P+η2-η1·lP,T.So,(13)σ2-σ1=hβ2-β1abP+μ2-μ1+η2-η1l·T.The challenger derives(14)abP=hβ2-β1-1σ2-σ1-μ2-μ1+η2-η1l·T.


### 5.2. Privacy Preserving

Theorem 2.
In the proposed scheme, AU cannot derive any information about DU’s data blocks during the whole auditing procedure.Proof of Theorem2.
In the whole auditing procedure, AU can get information(15)REDU=IDDU,IDCS,ω=h1,Z1,R1,…,hn,Zn,Rn,Chall=IDDU,a,I,σ=∑i∈Iviσmi,μ=∑i∈Ivimi-l·H2Lmodq.But Chall=[IDDU,a,I] are irrelevant to the file content, and AU cannot derive any information about the data blocks from hi,Zi since the hash functions are secure.
AU cannot derive any information about the data blocks from equationμ=∑i∈Ivimi-l·H2Lmodq, since there is an unknown random number l.
Finally, AU cannot derive file content information fromσ.


## 5.1. Unforgeability

Theorem 1.
If the CDH assumption is hard, then the proposed scheme is secure against proof information existential forgery attack from the CS.Proof of Theorem1.
We will show that if CS can forge valid proof information, the challenger will use the forged proof information to solve the CDH problem.
Because CS has the signature of any one file block, CS needs not do tag oracle. So, we only look at hash functionsH1,H2 as random oracles. For given CDH problem instance (aP,bP), the challenger lets the system public key Ppub=aP, and in partial-private-key-extract phase, for two times oracles, let Qi=H1(IDi)=βj(bP), j=1,2. βj, selected by the challenger, is a random number. In the proof process, for the same Chall information and same random number l, let (σ1,μ1,L) and (σ2,μ2,L) be two pieces of valid proof information under two times different H2 oracles, H2(L)=ηi, i=1,2. Then, the following two equations hold:(11)eσ1,P=ehβ1bP,aP·eZ,PDU·eR+μ1·P+η1·lP,T,eσ2,P=ehβ2bP,aP·eZ,PDU·eR+μ2·P+η2·lP,T.Then, (12)eσ2-σ1,P=ehβ2-β1bP,aP·eμ2-μ1·P+η2-η1·lP,T.So,(13)σ2-σ1=hβ2-β1abP+μ2-μ1+η2-η1l·T.The challenger derives(14)abP=hβ2-β1-1σ2-σ1-μ2-μ1+η2-η1l·T.


## 5.2. Privacy Preserving

Theorem 2.
In the proposed scheme, AU cannot derive any information about DU’s data blocks during the whole auditing procedure.Proof of Theorem2.
In the whole auditing procedure, AU can get information(15)REDU=IDDU,IDCS,ω=h1,Z1,R1,…,hn,Zn,Rn,Chall=IDDU,a,I,σ=∑i∈Iviσmi,μ=∑i∈Ivimi-l·H2Lmodq.But Chall=[IDDU,a,I] are irrelevant to the file content, and AU cannot derive any information about the data blocks from hi,Zi since the hash functions are secure.
AU cannot derive any information about the data blocks from equationμ=∑i∈Ivimi-l·H2Lmodq, since there is an unknown random number l.
Finally, AU cannot derive file content information fromσ.


## 6. Comparisons

In this section, we compare the proposed scheme with He et al.’s scheme [1] in terms of security and computation cost. In the comparison of computation cost, we use P, H, and E as scalar multiplication computation, hash computation, and bilinear pairings computation, respectively. We show the comparison results in Tables 1 and 2. According to Table 1, our scheme demonstrates better security, and according to Table 2 there is notable low hash computation cost in the proposed scheme. Of course, in some phases, there are high computation costs in multiplication and bilinear pairings computation.Table 1
Comparison of security.
Unforgeability
Privacy preserving
He et al. [1]
Yes
No
Ours
Yes
YesTable 2
Comparison of computation cost.
A1
A2
A3
A4
A5
A6
He et al. [1]
1
P
1
P
+
1
H
1
p
2
P
+
3
H
|
I
|
P
(
|
I
|
+
3
)
P
+
(
|
I
|
+
3
)
H
+
2
E
Ours
1
P
1
P
+
1
H
1
P
4
P
+
3
H
|
I
|
P
+
1
(
2
|
I
|
+
3
)
P
+
1
H
+
4
E
A1: setup; A2: partial-private-key extraction; A3: set-public key; A4: tag generation; A5: proof phase; A6: verify phase.


## 7. Conclusion

In this paper, we propose a certificateless public auditing scheme with privacy preserving for cloud-assisted wireless body area networks. In the proof phase of the proposed scheme, the proof information is protected from being directly exposed to the auditor. So, the curious auditor could not derive the data blocks. We also prove that the proposed scheme is secure in the random oracle model under the assumption that the Diffie-Hellman problem is hard. The comparison indicates that the proposed scheme is more secure and suitable for cloud-assisted wireless body area networks.



---

*Source: 2925465-2017-07-06.xml*