# ID-Based Public Auditing Protocol for Cloud Data Integrity Checking with Privacy-Preserving and Effective Aggregation Verification

Authors: Baoyuan Kang; Lin Si; Hong Jiang; Chunqing Li; Mingming Xie
Journal: Security and Communication Networks
 (2018)

---

## Abstract

With the rapid development of cloud service, people with limited storage space can store their data files to the cloud and delete the file in their memory. However, the cloud service provider may change or partly delete user’s file for his benefit. Therefore, it is necessary for the user to periodically check the data file integrity. Public auditing protocols are just designated for checking the data file integrity by an auditor on behalf of the user. Recently, based on ID-based cryptography many ID-based public auditing protocols for cloud data integrity checking are proposed. However, some existing protocols are subjected to forgery attack. Other existing protocols cannot preserve the privacy of the user, as the auditor can obtain user’s file content through times of auditing the same file blocks. In this paper, we propose a new ID-based public auditing protocol for cloud data integrity checking with optimized structure, privacy-preserving, and effective aggregation verification. We also prove that the proposed protocol can resist forgery attack under the assumption that the Diffie-Hellman problem is hard. Furthermore, we compare our protocol with other ID-based auditing protocols.


---

## Body

## 1. Introduction

With the rapid development of cloud service, people with limited storage space like to store their large data file to the cloud, but cloud storage service also causes some security issues [1]. The cloud service provider may change or partly delete user’s data file for his benefit. Therefore, it is necessary for the user to periodically check data file integrity. However, once the user transfers his file to the cloud, he will delete the file in his memory. Later, he cannot check the data integrity in conventional method. Public auditing protocols [2] are just designated for checking the data file integrity. In a public auditing protocol a data user firstly signs every block of his data file. Then the user sends his file and the signatures on file blocks to the cloud service provider and deletes the file locally. In the protocol there is an auditor who can periodically contact with cloud service provider to check the data file integrity on behalf of the user.After first auditing protocols [2] many auditing protocols based on public key cryptographic system [3–33] were proposed. Recently, to eliminate public key management burden, a few public auditing protocols based on ID-based cryptographic system are proposed [16–22]. However, some existing ID-based public auditing protocols are subjected to malicious cloud server forgery attack [20]. Other existing ID-based public auditing protocols cannot preserve the privacy of the user as the auditor can obtain user’s file content through times of auditing the same file blocks [19, 29]. A common ID-based public auditing protocol consists of six phases: setup, key extraction, tag generation, challenge, prove, and verify [17]. In challenge phase the auditor generates challenge information and sends it to the cloud servicer. When the cloud server returns the proof information of the date file integrity, the auditor verifies the proof information using the parameters from the cloud servicer. In our views, since the auditor has more computation and storage resources than the data users, the auditor should store a few parameters and do more computations for the verification of the proof information. This may effectively resist the forgery attack from the cloud server. Another problem is that the existing ID-based public auditing protocols [17] lack necessary signature authentications on the messages between the data user, the cloud server, and the auditor. This problem leads to the lack of strictness in the protocols.Based on the above understanding, we proposed a new ID-based public auditing protocol for data integrity checking. Our contributions are fivefold. Firstly we optimize the structure of ID-based public auditing protocol. We compress the six phases of common ID-based public auditing protocols into four phases. We also add necessary signature authentications. These measures make the proposed protocol more compact, clear, and rigorous. Secondly we use the method of aggregate signatures to make the proposed protocol more effective due to aggregation verification. Thirdly in the challenge and prove phase of the proposed protocol, to prove the proof information from the cloud server, the auditor must provide some parameters. This makes the protocol more secure than existing protocols in preventing forgery attack. The proposed protocol proves to be secure against forgery attack under the assumption that the Diffie-Hellman problem is hard. Fourthly the proposed protocol has privacy-preserving security features. The auditor cannot obtain any information of user’s file content even through times of auditing the same file blocks.The rest of the paper is organized as follows. In Section2, we review bilinear pairing and computational Diffie-Hellman problem relevant to the security of the proposed protocol. An ID-based public auditing protocol is proposed in Section 3. In Section 4, we provide security proofs of the proposed protocol. In Section 5, we compare the proposed protocol with other two protocols in security, communication efficiency, and computation cost. Conclusion is given in Section 6.


## 2. Preliminary

In this section, we briefly introduce the definitions of bilinear pairings and computational Diffie-Hellman (CDH) problem relevant to the security of the proposed protocol [17].


### 2.1. The Bilinear Pairing

LetG1 be a cyclic additive group generated by P, whose order is a prime q, and G2 be a cyclic multiplicative group of the same order. Let e:G1×G1→G2 be a pairing map which satisfies the following conditions.(1) Bilinearity: for anyP,Q,R∈G1,(1)eP+Q,R=eP,ReQ,Rand(2)eP,Q+R=eP,QeP,R.In particular, for any a,b∈Zq, e(aP,bP)=e(P,abP)=e(abP,P)=eP,Pab.(2) Nondegeneracy: there existsP,Q∈G1, such that e(P,Q)≠1.(3) Computability: there is an efficient algorithm to computee(P,Q) for all P,Q∈G1.The typical way of obtaining such pairings is by deriving them from the Weil-pairing or the Tate-pairing on an elliptic curve over a finite field.


### 2.2. Computational Diffie-Hellman (CDH) Problem

Given a generatorP of an additive cyclic group G with order q and given aP,bP for unknown a,b∈Zq∗, it is hard to compute abP.


## 2.1. The Bilinear Pairing

LetG1 be a cyclic additive group generated by P, whose order is a prime q, and G2 be a cyclic multiplicative group of the same order. Let e:G1×G1→G2 be a pairing map which satisfies the following conditions.(1) Bilinearity: for anyP,Q,R∈G1,(1)eP+Q,R=eP,ReQ,Rand(2)eP,Q+R=eP,QeP,R.In particular, for any a,b∈Zq, e(aP,bP)=e(P,abP)=e(abP,P)=eP,Pab.(2) Nondegeneracy: there existsP,Q∈G1, such that e(P,Q)≠1.(3) Computability: there is an efficient algorithm to computee(P,Q) for all P,Q∈G1.The typical way of obtaining such pairings is by deriving them from the Weil-pairing or the Tate-pairing on an elliptic curve over a finite field.


## 2.2. Computational Diffie-Hellman (CDH) Problem

Given a generatorP of an additive cyclic group G with order q and given aP,bP for unknown a,b∈Zq∗, it is hard to compute abP.


## 3. The Proposed Protocol

As in [17], there are a data user, a cloud server, an auditor, and a private key generator (PKG) in an ID-based public auditing protocol. The cloud server is a semitrusted party. He might change or delete the data user’s file for his benefit. Here we consider the cloud server as the only adversary to launch the forgery attack of the proof information for integrity checking. The new protocol consists of four algorithms: setup, key extraction, tag generation, challenge, and prove phase. The following is the detailed description of the proposed protocol. The two phases of setup and key extraction are the same as the general method of ID-based signatures [25].Setup. Given a security parameter k∈Z, the algorithm works as follows:(1) Run the parameter generator on inputk to generate a prime q, an additive cyclic group G1 and a multiplicative cyclic group G2 of the same order q, a generator P of G1, and a bilinear map e:G1×G1→G2.(2) Pick a randoms∈Zq∗ as master key of PKG and set system public key Ppub=s·P.(3) Choose two cryptographic hash functions(3)H:0,1∗→G1,h:0,1∗→Zq.The system parameters areq,G1,G2,e,P,Ppub,H,h.Key Extraction. When any one of the data user (DU), the cloud server (CS), and the auditor (AU) wants to register his identity ID to PKG, the algorithm works as follows:(1)
ComputeQID=H(ID)∈G1.(2)
Set the private keySID=s·QID, where s is the master key of PKG.By the two steps the data user (DU), the cloud server (SC), and the auditor (AU) obtain their private keySDU, SCS, and SAU, respectively.Tag Generation. This phase consists of five steps showing the messages transfer between the data user (DU) and both the cloud server (SC) and the auditor (AU). For a data file M=m1∥⋯∥mn, the data user (DU) selects a random file name,name, and lets τ=name∥n be the file tag. The tag generation phase is shown in Algorithm 1.Algorithm 1:The tag generation phase.
AUDUCS Choose ri∈RZq∗ Compute Ri=ri⋅Ppub σ m i = ( h ( τ ∥ m i ∥ R ∥ I D D U ) + r i ) S D U + ( m i + h ( m i ) ) P p u b → I D D U , M , τ , σ m 1 ⋯ , σ m n , R Computes σ=∑i=1n‍σmi and checks e ( σ , P ) = e ∑ i = 1 n h τ ∥ m i ∥ R ∥ I D D U Q D U + m i + h m i P , P p u b ⋅ e ( R , Q D U ) Chooses l∈RZq∗, computes L = l ⋅ P p u b and checks V = ( h ( τ ∥ L ∥ I D C S ∥ I D D U ) + l ) S C S ← ( V , L ) Checks e ( V , P ) = e ( h ( τ ∥ L ∥ I D C S ∥ I D D U ) P p u b + L , Q C S ) Chooses t∈RZq∗, and generates T = t ⋅ P p u b and G=(h(τ∥ω∥T)+t)SDU ← F A D U Checks e(V,P)=e(h(τ∥L∥IDCS∥IDDU)Ppub+L,QCS) e(G,P)=e(h(τ∥ω∥T)Ppub+T,QDU) Choosesx∈RZq∗, computes X=x⋅Ppub W=(h(τ∥X)+x)SAU → ( I D A U , τ , W , X ) Checks e(W,P)=e(h(τ∥X)Ppub+X,QAU) Deletes the file M(1)DU→CS:IDDU,M,τ,σm1⋯,σmn,RForτ and each file block mi, DU chooses ri∈RZq∗, lets Ri=ri·Ppub, and computes(4)R=∑i=1nRi,1≤i≤n,σmi=hτ∥mi∥R∥IDDU+riSDU+mi+hmiPpub.Then, DU sends(IDDU,M,τ,σm1⋯,σmn,R) to CS.(2)CS→DU:V,LCS computes(5)σ=∑i=1nσmiand checks the following equation:(6)eσ,P=e∑i=1nhτ∥mi∥R∥IDDUQDU+mi+hmiP,Ppub·eR,QDU.If the equation holds, CS choosesl∈RZq∗, computes(7)L=l·Ppub(8)V=hτ∥L∥IDCS∥IDDU+lSCS,sends (V,L) to DU, and then stores (IDDU,M,τ,σm1⋯,σmn,R).(3)DU→AU:FADU=(IDDU,IDCS,τ,V,L,T,ω,G,z1,⋯,zn,R1,⋯,Rn)DU checks the following equation.(9)eV,P=ehτ∥L∥IDCS∥IDDUPpub+L,QCSIf it holds, DU choosest∈RZq∗ and generates the signature on information ω expressing the a request for auditing agency.(10)T=t·PpubG=hτ∥ω∥T+tSDUsends(11)FADU=IDDU,IDCS,τ,V,L,T,ω,G,z1,⋯,zn,R1,⋯,Rnto AU. Here zi=h(τ∥mi∥R∥IDDU).(4)AU→DU:IDAU,τ,W,XAU checks following equations(12)eV,P=ehτ∥L∥IDCS∥IDDUPpub+L,QCSeG,P=ehτ∥ω∥TPpub+T,QDUIf the equations hold, AU choosesx∈RZq∗, computes(13)X=x·PpubW=hτ∥X+xSAU,sends (IDAU,τ,W,X) to DU for expressing that he accepts the auditing agency, and stores FADU.(5) When DU receives the(W,X) from AU, DU checks the following equation:(14)eW,P=ehτ∥XPpub+X,QAU.If the equation holds, DU deletes the fileM.Challenge and Prove Phase. This phase consists of three steps showing the messages transfer between the auditor AU and the cloud server CS.(1)AU→CS:Chall,IDAU,ω,G,TTo check the integrity of the outsourced data fileM, AU randomly chooses a set I⊆[1,n] and a number a∈Zq to generate the challenging information Chall=[IDDU,τ,a,I] and sends Chall and (IDAU,ω,G,T) to CS.(2)CS→AU:σ′,μUpon receivingChall=[IDDU,τ,a,I] and (IDAU,ω,G,T), CS checks the equation(15)eG,P=ehτ∥ω∥TPpub+T,QDU.If the equation holds, CS finds (IDDU,M,τ,σm1⋯,σmn,R) and produces set ω={(i,bi)},i∈I.Here,bi=aimod⁡q. Then using M=m1∥⋯∥mn and (σm1⋯,σmn), CS computes(16)σ′=∑i∈Ibiσmi,μ=∑i∈Ibimi+hmiand sends (σ′,μ) to AU.(3) Upon receiving the proof information(σ′,μ), based on stored information FADU, AU computes(17)z=∑i∈Ibizi,R′=∑i∈IbiRi.Then AU checks the following equation:(18)eσ′,P=ezQDU+μP,Ppub·eR′,QDUIf the equation holds, AU accepts the proof.The challenge and prove phases are shown in Algorithm2.Algorithm 2:The challenge and prove phase.
AU CS Choose a setI⊆[1,n]  and a number a∈Zq GenerateChall=[IDDU,τ,a,I] → C h a l l , ( I D A U , ω , G , T ) Checks e(G,P)=e(h(τ∥ω∥T)Ppub+T,QDU) Produces set ω={(i,bi)},i∈I Computes σ′=∑i∈I‍biσmi, μ=∑i∈I‍bi(mi+h(mi)) ← ( σ ′ , μ ) Computeh=∑i∈I‍bihi, R′=∑i∈I‍biRi. Checke(σ′,P)=e(zQDU+μP,Ppub)⋅e(R′,QDU)


## 4. Security of the Proposed Protocol

Theorem 1.
The proposed protocol is correct.Proof of Theorem1.
In order to save space,to prove the correctness of proof of the proposed protocol, we only prove the correctness of three representative equations.
Firstly, we show that the aggregate signatureσ can be verified by equation(19)eσ,P=e∑i=1nhτ∥mi∥R∥IDDUQDU+mi+hmiP,Ppub·eR,QDU.In fact,(20)eσ,P=e∑i=1nhτ∥mi∥R∥IDDU+riSDU+mi+hmiPpub,P=e∑i=1nhτ∥mi∥R∥IDDUSDU,Pe∑i=1nriSDU,P·e∑i=1nmi+hmiPpub,P=e∑i=1nhτ∥mi∥R∥IDDUQDU,Ppube∑i=1nriPpub,QDU·e∑i=1nmi+hmiP,Ppub=e∑i=1nhτ∥mi∥R∥IDDUQDU+mi+hmiP,Ppub·eR,QDU.
Secondly, the signatureV can be verified by equation(21)eV,P=ehτ∥L∥IDCS∥IDDUPpub+L,QCS.In fact,(22)eV,P=ehτ∥L∥IDCS∥IDDU+lSCS,P=e(hτ∥L∥IDCS∥IDDUSCS,P·elSCS,P=e(hτ∥L∥IDCS∥IDDUPpub,QCS·el·Ppub,QCS=ehτ∥L∥IDCS∥IDDUPpub+L,QCS.
Finally, the proof information(σ′,μ) can be verified by the following equation.(23)eσ′,P=ezQDU+μP,Ppub·eR′,QDUIn fact,(24)eσ′,P=e∑i∈Ibiσmi,P=∏i∈Iebiσmi,P=∑i∈Iebihτ∥mi∥R∥IDDU+riSDU+mi+hmiPpub,P)=∑i∈IebiziSDU,P·ebiriSDU,P·ebimi+hmiPpub,P=e∑i∈IbiziSDU,P·e∑i∈IbiriSDU,P·e∑i∈Ibimi+hmiPpub,P=e∑i∈IbiziQDU,Ppub·e∑i∈IbiriPpub,QDU·e∑i∈Ibimi+hmiP,Ppub=ezQDU,Ppub·eR′,QDU·eμP,Ppub=ezQDU+μP,Ppub·eR′,QDU.Theorem 2.
If the CDH assumption is hard, then the proposed protocol is secure against existential forgery attack.Proof of Theorem2.
Similar to general proof thought, it will be shown that the challenger can solve the CDH problem when CS can provide forged valid proof information for the data integrity checking.
In the proof process, hashH and h are random oracles. For given CDH problem instance (αP,βP), the challenger sets system public key Ppub=αP, user DU’s private as ti(βP), ti∈RZq, for timely oracles.
Assuming that for the same challenge informationChall=[IDDU,τ,a,I], CS produces two valid forged proof pieces of information (σ1′∗,μ∗) and (σ2′∗,μ∗) in two forgeries, then the following two equations hold. (25)eσ1′∗,P=ez1∗QDU+μ∗P,Ppub·eR′∗,QDU=ez1∗t1αβP+μPpub,P·eR′∗,QDUeσ2′∗,P=ez2∗QDU+μ∗P,Ppub·eR′∗,QDU=ez2∗t2αβP+μPpub,P·eR′∗,QDUThen, (26)σ2′∗-σ1′∗=z2∗t2-z1∗t1αβPabP=z2∗t2-z1∗t1-1σ2′∗-σ1′∗.Theorem 3.
In the proposed protocol, the author cannot derive any information of data file content.Proof of Theorem3.
In the whole auditing procedure, the author AU only obtains messages(27)FADU=IDDU,IDCS,τ,V,L,T,ω,G,z1,⋯,zn,R1,⋯,Rnfrom DU and (28)σ′=∑i∈Ibiσmi,μ=∑i∈Ibimi+hmifrom CS. However, (τ,V,L) and (T,ω,G) are signatures irrelevant to the file content. (R1,⋯,Rn) is also irrelevant to the file content. (z1,⋯,zn) and σ′ are relevant to the file content, but the file content is protected by hash function.
It is impossible for AU to obtain blockmi from equation μ=∑i∈I‍bi(mi+h(mi)).Even through times of auditing the same file blocks, AU also does not obtain any block of the file. Because μ=∑i∈I‍bi(mi+h(mi)) is not linear equation of mi. Therefore, AU cannot derive any information about DU’s data file content during the whole auditing procedure.


## 5. Comparisons

In this section, the comparisons of the proposed protocol with other two ID-based auditing protocols [16, 17] are shown. The comparison results of the security features, communication number, and computation costs are shown, respectively, in Tables 1, 2, and 3.Table 1
Comparison of features.
F1 F2 F3 F4 F5 F6 F7 Wang et al. [16] No No No No No Yes No  Zhang et al. [17] No - Yes No No No No Yes  Ours Yes Yes Yes Yes Yes Yes Yes F1: file tag verification, F2: block tag verification, F3: accept storage verification, F4: application agent verification, F5: accept auditing verification, F6: unforgeability, F7: privacy-preserving.Table 2
Required communication number.
P1 P2 P3 Wang et al. [16] 1 1 2  Zhang et al. [17] 1 1 2  Ours 1 4 2 P1: key extraction phase, P2: tag generation phase, P3: challenge and prove phase.Table 3
Comparison of computation costs.
P1 P2 P3 P4 Zhang et al. [17] 2H+2S 4nH+6nS+3nB+ nE |I|H+2|I|S+|I|E |I|H+2|I|S+3B  Ours H+S (4n+7)H+(5n+12)S+11B |I|H +|I|S+|I|E |I|S+3B P1: key extraction phase, P2: block tag generation phase, P3: prove phase, P4: verify phase; E: exponential operation and its time cost, S: scalar multiplication and its time cost, H: hash computation and its time cost, B: bilinear pairing and its time cost.From Table2, in tag generation phase, the communication number in the proposed protocol is obviously higher than the other two protocols. This is caused by the following two facts. One is that in our protocol when the cloud server accepts the data file from cloud user, the cloud server must return an ‘accept service’ authentication information to the user. The other one is that the date user must send information to the auditor for begging auditing agency, and once accepting the auditing agency, the auditor also sends a response to the user.Since there is no detail file tag signature algorithm description in [16], in Table 3, we only compare the computation costs of the parts common to the proposed protocol with [17] in key extraction phase, block tag generation phase, challenge phase, and prove phase. In addition, we mainly count the exponential operation, scalar multiplication, hash computation, and bilinear pairings operation. Also we assume in challenge and prove phase that the challenging blocks number is I. The computation cost of Zhang et al.’s protocol [17] is (4n+2I+2)H+(6n+4I+2)S+(3n+3)B+(n+I)E. However, the computation cost of our protocol is (4n+I+8)H+(5n+2I+13)S+14B+IE. According to [33], H≈23t, S≈29t, E≈21t, B≈1440t. Here, t represents the time cost of a modular multiplication in zq. Then, the computation cost of Zhang et al.’s protocol is about (4607n+183|I|+4424)t. However, the computation cost of our protocol is about (237n+102|I|+20721)t. The computation cost of Zhang et al.’s protocol in tag generation phase is about 4607nt. However, the computation cost of our protocol in tag generation phase is about (237n+13049)t.We simulate the computational cost of our protocol and Zhang et al.’s protocol [17] on a Mac OS High Sierra system with an Intel Core i7 at 2.9 GHz and 16-GB RAM. The algorithms are implemented using the pairing-based cryptography (PBC) library version 0.5.14. When the file is 1024 Bytes, the comparison of computation cost in tag generation phase between our protocol and Zhang et al.’s protocol is shown in Figure 1. The whole computation costs of our protocol and Zhang et al.’s protocol are shown in Figures 2 and 3, respectively. When the number n of the blocks of the file is 48, the comparison of computation cost between our protocol and Zhang et al.’s protocol is shown in Figure 4. When the file is large and the number of its blocks is correspondingly large, our protocol needs significant low computation cost.Figure 1
The computation time of tag generation for 1024-Byte data.Figure 2
The computation cost of our protocol.Figure 3
The computation cost of Zhang et al.’s protocol.Figure 4
The comparison of computation cost between our protocol and Zhang et al.’s protocol.Another need for comparison and explanation is the relationship between our protocol and the one in [25]. In [25] a certificateless public auditing protocol with privacy-preserving for cloud-assisted wireless body area networks was proposed. Since the same issue of public auditing is researched in the two protocols, there are some unavoidable similarities in structure and concern. However, the protocol in [25] is based on certificateless public cryptography, while the protocol in this paper is based on ID-based public cryptography. There is a great difference in the concrete structure of the two protocols. In the tag generation phase of the protocol in this paper aggregation verification technology is used to greatly reduce the amount of computation. Therefore, on the whole, the efficiency and design concept of the protocol in this paper are higher than the one in [25].


## 6. Conclusion

In this paper, we propose a new ID-based public auditing protocol for cloud data integrity checking. The proposed protocol has not only optimized structure but also effective aggregation verification to reduce the computation cost. Furthermore, the proposed protocol has privacy-preserving feature as the auditor cannot obtain any information of user’s file content even through times of auditing the same file blocks. We prove that the proposed protocol can resist forgery attack under the assumption that the Diffie-Hellman problem is hard. We also compare the proposed protocol with other ID-based auditing protocols. The proposed protocol is shown to be more secure and efficient in computation cost.



---

*Source: 3205898-2018-11-01.xml*