# Improved Cloud Auditing Protocol and Its Application for Pandemic Data Management

Authors: Xu An Wang; Zhengge Yi; Xiaoyuan Yang; Jindan Zhang; Yun Xie; Manman Zhang; Guixin Wu
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

Data integrity verification mechanisms play an important role in cloud environments. Recently, a lightweight identity-based cloud storage audit scheme has been proposed; this paper points out security vulnerabilities of their OffTagGen algorithm. That is, the attackers such as malicious cloud servers can forge the tags, which can destroy data integrity. By improving the construction of OffTagGen algorithm, an improved security cloud auditing protocol is proposed in this work to better protect user’s privacy. The analysis shows that the new protocol is effective and resistant to attacks.


---

## Body

## 1. Introduction

In the last two years, the COVID-19 pandemic has become a major disaster in the world. As COVID-19 has a certain fatality rate and spreads very fast, prevention and control of this virus have become a top priority worldwide. However, compared to the prevention and control regarding SARS in 2003, information related technique is being widely used in all aspects regarding prevention and control of this COVID-19 pandemic. Hence, extensive collection, processing, and investigation of personal data has become an important part of the anti-pandemic work. Given the huge amount of data collected, it is necessary to store these data in the cloud to reduce the storage burden.As a new storage paradigm, cloud storage collects different storage devices to provide users with massive data storage. Hospitals and patients can easily access data by connecting to the cloud anytime, anywhere, and through any networked device whenever needed.The infrastructures supporting cloud storage are distributed and virtual. This brings some threats to users’ data security, such as network virus propagation, unauthorized access, denial of service attacks, information leakage, data loss, as well as network infrastructure that could damage data integrity during data transmission, etc. For pandemic prevention and control, it is clear that the loss of data, such as the patient’s recent whereabouts, will certainly cause enormous trouble and could even lead to further virus spread and may even favour the situation of successive waves of the new coronavirus.Due to the threat of internal or external attacks, data stored in the cloud are easily damaged. In addition, the cloud service provider (CSP) may not notify the user of this event in consideration of its own reputation. The user has a mechanism to detect data corruption only after accessing the data [1–3]. Therefore, in order to improve the reputation of cloud storage and let users know the integrity of the hosted data in a timely manner, a mechanism is needed to verify the data integrity in the cloud. Hence, an integrity verification mechanism is very important in the cloud environment.


### 1.1. Related Works

Traditional methods need to download the entire data from the cloud when verifying data integrity, which brings unacceptable communication and computing costs and greatly consumes users’ resources. In order to satisfy the user’s remote checking of data integrity, the cloud data remote integrity check solution should need not to download the complete data in the cloud storage environment. Thus, the following solutions have been proposed.Ateniese et al. [4] first proposed a provable data possession (PDP) scheme, an effective technology to audit the cloud storage. In the PDP protocol, data are encoded as blocks, and the user processes the block data to generate a verifiable authenticator, and then it outsources the data blocks and authenticators to the cloud. A public verifier with sufficient resources is also called a third-party auditor (TPA) and is trusted by users to check the data integrity. TPA creates a challenge to the server by randomly selecting a small group of block indexes. The server returns a proof that proves the integrity of the challenged blocks. TPA can effectively verify the proof without downloading data block. PDP has laid the foundation for the design of cloud storage audit schemes. In recent years, many researchers have conducted extensive and in-depth explorations around PDP [5–7].In order to obtain better efficiency and performance, several improved PDP protocols have been proposed [8, 9]. The previously proposed schemes mostly use traditional public key cryptography, so a trusted certificate authority (CA) is required to issue a certificate to bind certain user identities and their public keys. Heavy certificate management, including certificate generation, distribution, and revocation, requires a lot of computing and storage resources. As the number of users increases, certificate management becomes extremely difficult. In addition, the verifier must retrieve the certificate from the CA and then check the validity of the public key certificate, which also brings heavy calculation and communication costs to the verifier. Therefore, the certificate-based PDP protocol is very inefficient when used in actual situations.In order to overcome this problem, researchers considered applying identity-based cryptography to the PDP protocol and therefore proposed many ID-PDP solutions. Wang et al. [10] first introduced the concept of identity-based PDP (ID-PDP), which uses user names or emails instead of public keys. Then, ID-PDP is further extended to the multicloud storage environment [11] to check the integrity of remote data. In order to improve performance, Wang et al. [12] added a proxy server to the remote data integrity check scheme. The proxy server processes data instead of users. In the scheme, incentive and unconditional anonymous ID-PDP was first proposed to protect and encourage criminal whistleblowers. Yu et al. [13] used RSA signature technology to design an ID-based integrity cloud data check protocol. The protocol supports variable size file blocks and public verification. In order to further improve security, Yu et al. [14] combined the key homomorphic encryption technology in the cryptographic cloud audit system and proposed an improved scheme with perfect data privacy protection capabilities. The ID-based privacy-preserving integrity verification of shared data over untrusted cloud scheme is proposed, which can support users to update the data in cloud and protect users’ privacy in untrusted cloud servers. Li et al. [15] proposed identity-based privacy-preserving remote data integrity checking for cloud storage scheme, which uses homomorphic verifiable tags to reduce the computational complexity and uses random integer addition to mask the original data to protect the verifier from obtaining any knowledge about the data during the integrity checking process.


### 1.2. Contribution

Currently, using cloud storage audit protocols is regarded as an important cloud service. However, the existing audit protocols have certain shortcomings. On the one hand, most of them rely on expensive public key infrastructure (PKI), so certificate management/verification is very complicated. On the other hand, most cloud users have limited resources. Nowadays, ID-based cloud audit protocols have attracted the attention of researchers, but most of them require users with limited resources to perform expensive operations.Recently, Rabaninejad et al. [16] proposed a lightweight identity-based provable data ownership cloud storage audit scheme, which supports privacy and traceability of user identities. They also proposed an online/offline ID-based PDP scheme [17]. However, we discovered that there are security flaws in the digital signature (OffTagGen) of their scheme. Attackers, such as malicious cloud servers, can destroy the privacy of user’s identity privacy and damage data privacy and integrity. In order to get a more secure protocol, based on the scheme presented in [16], we propose an improved one and discuss its application in pandemic data management. The main contributions of this paper are summarized as follows:(1)
We firstly point out the insecurity of Rabaninejad et al.’s lightweight identity-based provable data ownership cloud storage audit scheme. We give two attacks to show that data tags can be easily forged.(2)
We provide an improved secure cloud audit protocol that protects user privacy. This new protocol is effective yet resistant to attacks.(3)
Finally, we show how our scheme can be applied to the pandemic data management.


### 1.3. Organization

The rest of this article is organized as follows. In Section2, we describe the system framework. In Section 3, we review the cloud audit scheme proposed by Rabaninejad et al. [17]. In Sections 4 and 5, we introduce the attack. In Section 6, we provide an improved privacy protection cloud audit protocol and conduct a rough analysis of its security. In Section 7, we apply our scheme to pandemic data management. Finally, in Section 8, we conclude the work and point out some directions for future work.


## 1.1. Related Works

Traditional methods need to download the entire data from the cloud when verifying data integrity, which brings unacceptable communication and computing costs and greatly consumes users’ resources. In order to satisfy the user’s remote checking of data integrity, the cloud data remote integrity check solution should need not to download the complete data in the cloud storage environment. Thus, the following solutions have been proposed.Ateniese et al. [4] first proposed a provable data possession (PDP) scheme, an effective technology to audit the cloud storage. In the PDP protocol, data are encoded as blocks, and the user processes the block data to generate a verifiable authenticator, and then it outsources the data blocks and authenticators to the cloud. A public verifier with sufficient resources is also called a third-party auditor (TPA) and is trusted by users to check the data integrity. TPA creates a challenge to the server by randomly selecting a small group of block indexes. The server returns a proof that proves the integrity of the challenged blocks. TPA can effectively verify the proof without downloading data block. PDP has laid the foundation for the design of cloud storage audit schemes. In recent years, many researchers have conducted extensive and in-depth explorations around PDP [5–7].In order to obtain better efficiency and performance, several improved PDP protocols have been proposed [8, 9]. The previously proposed schemes mostly use traditional public key cryptography, so a trusted certificate authority (CA) is required to issue a certificate to bind certain user identities and their public keys. Heavy certificate management, including certificate generation, distribution, and revocation, requires a lot of computing and storage resources. As the number of users increases, certificate management becomes extremely difficult. In addition, the verifier must retrieve the certificate from the CA and then check the validity of the public key certificate, which also brings heavy calculation and communication costs to the verifier. Therefore, the certificate-based PDP protocol is very inefficient when used in actual situations.In order to overcome this problem, researchers considered applying identity-based cryptography to the PDP protocol and therefore proposed many ID-PDP solutions. Wang et al. [10] first introduced the concept of identity-based PDP (ID-PDP), which uses user names or emails instead of public keys. Then, ID-PDP is further extended to the multicloud storage environment [11] to check the integrity of remote data. In order to improve performance, Wang et al. [12] added a proxy server to the remote data integrity check scheme. The proxy server processes data instead of users. In the scheme, incentive and unconditional anonymous ID-PDP was first proposed to protect and encourage criminal whistleblowers. Yu et al. [13] used RSA signature technology to design an ID-based integrity cloud data check protocol. The protocol supports variable size file blocks and public verification. In order to further improve security, Yu et al. [14] combined the key homomorphic encryption technology in the cryptographic cloud audit system and proposed an improved scheme with perfect data privacy protection capabilities. The ID-based privacy-preserving integrity verification of shared data over untrusted cloud scheme is proposed, which can support users to update the data in cloud and protect users’ privacy in untrusted cloud servers. Li et al. [15] proposed identity-based privacy-preserving remote data integrity checking for cloud storage scheme, which uses homomorphic verifiable tags to reduce the computational complexity and uses random integer addition to mask the original data to protect the verifier from obtaining any knowledge about the data during the integrity checking process.


## 1.2. Contribution

Currently, using cloud storage audit protocols is regarded as an important cloud service. However, the existing audit protocols have certain shortcomings. On the one hand, most of them rely on expensive public key infrastructure (PKI), so certificate management/verification is very complicated. On the other hand, most cloud users have limited resources. Nowadays, ID-based cloud audit protocols have attracted the attention of researchers, but most of them require users with limited resources to perform expensive operations.Recently, Rabaninejad et al. [16] proposed a lightweight identity-based provable data ownership cloud storage audit scheme, which supports privacy and traceability of user identities. They also proposed an online/offline ID-based PDP scheme [17]. However, we discovered that there are security flaws in the digital signature (OffTagGen) of their scheme. Attackers, such as malicious cloud servers, can destroy the privacy of user’s identity privacy and damage data privacy and integrity. In order to get a more secure protocol, based on the scheme presented in [16], we propose an improved one and discuss its application in pandemic data management. The main contributions of this paper are summarized as follows:(1)
We firstly point out the insecurity of Rabaninejad et al.’s lightweight identity-based provable data ownership cloud storage audit scheme. We give two attacks to show that data tags can be easily forged.(2)
We provide an improved secure cloud audit protocol that protects user privacy. This new protocol is effective yet resistant to attacks.(3)
Finally, we show how our scheme can be applied to the pandemic data management.


## 1.3. Organization

The rest of this article is organized as follows. In Section2, we describe the system framework. In Section 3, we review the cloud audit scheme proposed by Rabaninejad et al. [17]. In Sections 4 and 5, we introduce the attack. In Section 6, we provide an improved privacy protection cloud audit protocol and conduct a rough analysis of its security. In Section 7, we apply our scheme to pandemic data management. Finally, in Section 8, we conclude the work and point out some directions for future work.


## 2. System Framework

In this section, we first describe the system model. Then, we give the goals of the design. After that, we introduce some necessary definitions. Finally, we show the security model.


### 2.1. System Model

The system model includes four entities, as shown in Figure1, which involves the key generation center (KGC), the users, the third-party auditor (TPA), and the cloud server. The functions of each entity are summarized as follows:(1)
KGC. Based on the user’s identity, KGC generates its private key.(2)
TheUsers. When the users want to store data files remotely in the cloud, they first divide the file into several blocks, use their own private key to generate a label or tag on each data block, and then outsource (block, label) to the cloud server.(3)
TPA. TPA performs public audits delegated by the users.(4)
CloudServer. The cloud server stores user-managed data and generates a proof verified by TPA.Figure 1
System model.As shown in Figure1, the workflow of the four parties can be described as follows:(1)
The users generate the offline tags and store them locally.(2)
The users send their identity information to KGC.(3)
KGC uses the master key and the users’ identity information to generate the users’ private key and returns it to them.(4)
When users need to store data files in the cloud server, they generate online tags by using some lightweight computations based on offline tags.(5)
Users outsource the (block, online tag) pair to the cloud server.(6)
The user sends an audit request to TPA with some audit information attached.(7)
TPA sends the challenge message to the cloud server.(8)
The cloud server generates a proof based on the challenge message and sends it to TPA.(9)
TPA sends the results of the audit as the auditing report to the users.


### 2.2. Design Goal

The design goals are roughly as follows.(i)
Correctness. If TPA honestly follows the agreement, it can correctly audit the integrity of outsourced data.(ii)
Soundness. If an untrusted cloud server has not completely stored the outsourcing data, it cannot pass the audit.(iii)
PublicAudit. TPA can replace the user to remotely audit the integrity of the data.(iv)
Scalability. TPA can simultaneously support the effective verification of multiple audit requirements.(v)
Lightweight. TPA provides low-cost label generation algorithms for users with limited computing resources.


### 2.3. Definition

The ID-PDP scheme includes the following algorithms:(i)
Setup1k⟶param,msk. KGC executes this algorithm. The input is the security parameter 1k, and the output is the master key msk and the public parameter param.(ii)
ExtractID,param,msk⟶kID. KGC receives the inputs, including msk, and identity ID and then outputs the secret key kID.(iii)
TagGenparam​,kID​,F⟶σ. The data owner with the key kID executes this algorithm, inputs the parameters and the data file, and first splits F into n blocks F=m1,…,mn. Next, the data owner generates a corresponding label σi for each block mi and outsources the label σ=σ1,σ2,…,σn and the data blocks F=m1,…,mn to the cloud together.(iv)
Challengeparam,Fname;ID⟶chal. TPA outputs a challenge on behalf of the data owner whose identity is ID to challenge the integrity of the Fname file. The parameters, the name Fname of the data file F, and the identity ID of the data owner are taken as input.(v)
ProofGenparam,ID,chal,F,σ⟶proof. The cloud server executes ProofGen, inputs param,chal, owner’s identity ID, and the file F with label σ, and outputs a certificate proving the integrity of the challenge block.(vi)
ProofVerifyparam,Fname,R,ID,chal,proof⟶0,1. TPA executes ProofVerify to verify the proof of challenge reported by the cloud server. The input are param, Fname, the identity ID of the data owner, and the pair chal,proof. If the verification is passed, 1 is output, otherwise 0.


### 2.4. Security Model

For maintaining their own reputation, cloud servers are generally unwilling to disclose data loss/damage to the verifier, so they are not completely credible in the PDP scheme. Here, we focus on the security model of auditing soundness of the cloud storage auditing protocol. The security model is described as follows: a game between an adversary serverA and a challenger B.(i)
Setup. The algorithm Setup is run by challenger B, and the master key msk and public parameters param are obtained. Then, challenger B forwards the parameters to the server A but keeps msk secret.(ii)
Query. The adversary server A adaptively makes the following queries to the challenger B:(a)
HashQuery. A performs a hash function query, and B uses the hash value as a response.(b)
ExtractQuery. A can query any user’s key through it. B obtains the key by running the Extract algorithm and sends the obtained result to A.(c)
TagQuery. A queries the tags on the input pair ID,m. B responds to the query by running the TagGen algorithm and feeds the results back to A.(iii)
Challenge. Challenger B runs the Challenge algorithm on the file F of the user with ID, and B sends a challenge to A. Note that ID has never been queried from the Extract oracle, and all blocks of the file F have been queried from the tag oracle.(iv)
ProofGen. Adversary A executes the algorithm and computes a proof based on the received challenge.(v)
ProofVerify. If the proof is verified, A wins the game. Also, part of the proof represented by µ in the protocol is not equal to the aggregate value coming from the challenger B based on the ProofGen algorithm.


## 2.1. System Model

The system model includes four entities, as shown in Figure1, which involves the key generation center (KGC), the users, the third-party auditor (TPA), and the cloud server. The functions of each entity are summarized as follows:(1)
KGC. Based on the user’s identity, KGC generates its private key.(2)
TheUsers. When the users want to store data files remotely in the cloud, they first divide the file into several blocks, use their own private key to generate a label or tag on each data block, and then outsource (block, label) to the cloud server.(3)
TPA. TPA performs public audits delegated by the users.(4)
CloudServer. The cloud server stores user-managed data and generates a proof verified by TPA.Figure 1
System model.As shown in Figure1, the workflow of the four parties can be described as follows:(1)
The users generate the offline tags and store them locally.(2)
The users send their identity information to KGC.(3)
KGC uses the master key and the users’ identity information to generate the users’ private key and returns it to them.(4)
When users need to store data files in the cloud server, they generate online tags by using some lightweight computations based on offline tags.(5)
Users outsource the (block, online tag) pair to the cloud server.(6)
The user sends an audit request to TPA with some audit information attached.(7)
TPA sends the challenge message to the cloud server.(8)
The cloud server generates a proof based on the challenge message and sends it to TPA.(9)
TPA sends the results of the audit as the auditing report to the users.


## 2.2. Design Goal

The design goals are roughly as follows.(i)
Correctness. If TPA honestly follows the agreement, it can correctly audit the integrity of outsourced data.(ii)
Soundness. If an untrusted cloud server has not completely stored the outsourcing data, it cannot pass the audit.(iii)
PublicAudit. TPA can replace the user to remotely audit the integrity of the data.(iv)
Scalability. TPA can simultaneously support the effective verification of multiple audit requirements.(v)
Lightweight. TPA provides low-cost label generation algorithms for users with limited computing resources.


## 2.3. Definition

The ID-PDP scheme includes the following algorithms:(i)
Setup1k⟶param,msk. KGC executes this algorithm. The input is the security parameter 1k, and the output is the master key msk and the public parameter param.(ii)
ExtractID,param,msk⟶kID. KGC receives the inputs, including msk, and identity ID and then outputs the secret key kID.(iii)
TagGenparam​,kID​,F⟶σ. The data owner with the key kID executes this algorithm, inputs the parameters and the data file, and first splits F into n blocks F=m1,…,mn. Next, the data owner generates a corresponding label σi for each block mi and outsources the label σ=σ1,σ2,…,σn and the data blocks F=m1,…,mn to the cloud together.(iv)
Challengeparam,Fname;ID⟶chal. TPA outputs a challenge on behalf of the data owner whose identity is ID to challenge the integrity of the Fname file. The parameters, the name Fname of the data file F, and the identity ID of the data owner are taken as input.(v)
ProofGenparam,ID,chal,F,σ⟶proof. The cloud server executes ProofGen, inputs param,chal, owner’s identity ID, and the file F with label σ, and outputs a certificate proving the integrity of the challenge block.(vi)
ProofVerifyparam,Fname,R,ID,chal,proof⟶0,1. TPA executes ProofVerify to verify the proof of challenge reported by the cloud server. The input are param, Fname, the identity ID of the data owner, and the pair chal,proof. If the verification is passed, 1 is output, otherwise 0.


## 2.4. Security Model

For maintaining their own reputation, cloud servers are generally unwilling to disclose data loss/damage to the verifier, so they are not completely credible in the PDP scheme. Here, we focus on the security model of auditing soundness of the cloud storage auditing protocol. The security model is described as follows: a game between an adversary serverA and a challenger B.(i)
Setup. The algorithm Setup is run by challenger B, and the master key msk and public parameters param are obtained. Then, challenger B forwards the parameters to the server A but keeps msk secret.(ii)
Query. The adversary server A adaptively makes the following queries to the challenger B:(a)
HashQuery. A performs a hash function query, and B uses the hash value as a response.(b)
ExtractQuery. A can query any user’s key through it. B obtains the key by running the Extract algorithm and sends the obtained result to A.(c)
TagQuery. A queries the tags on the input pair ID,m. B responds to the query by running the TagGen algorithm and feeds the results back to A.(iii)
Challenge. Challenger B runs the Challenge algorithm on the file F of the user with ID, and B sends a challenge to A. Note that ID has never been queried from the Extract oracle, and all blocks of the file F have been queried from the tag oracle.(iv)
ProofGen. Adversary A executes the algorithm and computes a proof based on the received challenge.(v)
ProofVerify. If the proof is verified, A wins the game. Also, part of the proof represented by µ in the protocol is not equal to the aggregate value coming from the challenger B based on the ProofGen algorithm.


## 3. Review of Rabaninejad’s Scheme

In this section, we will review the specific scheme of Rabaninejad et al. [17]. First, we review the concept of a bilinear map. G1 and G2 denote a cyclic additive group and a cyclic multiplicative group of the same prime order q, where g is the generator of G1. The bilinear map e:G1×G1⟶G2 is a function with the following properties:(i)
Bilinearity. eaP,bQ=eP,Qab, for all P,Q∈G1 and a,b∈Zq.(ii)
Non−Degeneracy. eP,P≠1, where 1 denotes the identity element of G2.(iii)
Computability. There exists an efficient algorithm to compute eP,Q for all P,Q∈G1.Rabaninejad et al. [17] proposed an online/offline ID-based PDP scheme, which consists of the following algorithms. In addition to the definition and notation in the bilinear map, two hash functions H:0,1∗⟶G1 and h:0,1∗⟶Zq are used in the scheme.(1)
Setup. The KGC chooses a random value α∈Zq as the master secret key msk and sets the master public key as mpk=gα. So, the system public parameters are param=e,q,G1,G2,g,mpk,h,H.(2)
Extract. The KGC uses param=e,q,G1,G2,g,mpk,h,H and mpk=α to generate the secret key kID=HIDα for user ID.(3)
OffTagGen. The user with identity ID chooses a secret random value x∈Zq as the trapdoor key and sets γ=mpkx. Then, it generates an offline tag σioff for i∈1,B by choosing two random value mi',ri' from Zq as follows:(1)σioff=kIDxmt′kIDrt′=kIDxm′+rt′.At last, the offline tagsmit,rit,σioffi∈1,B are locally stored.(4)
OnTagGen. The user with identity ID owns the file F with Fname. First, it divides F into n blocks as F=m1,...,mn, where mi∈Zq. Then, it generates the online tag ri,σi on block mi based on an unused offline tagmit,ri′,σioff and uses trapdoor key as follows:(2)ri=rit+xmit−mimodq,σi=σioff.Finally, the onlinetagri,σii∈1,n together with the data blocks F=m1,…,mn is outsourced to the cloud server. The data owner also creates an MHT on the ordered hash value hrii∈1,n with the root node root and generates σroot=IDSroot. At the same time, the pair root,σroot together with γ,Fname, IDSγ||Fname is sent to the server and the TPA. Here, IDS is a secure ID-based signature. When the server receives the tags ri,σii∈1,n and the data blocks F=m1,…,mn, it first checks whether Verifymi,ri,σi,ID,mpk,γ=1 passes for all i∈1,n. If so, it stores mi,ri,σii∈1,n in its storage; otherwise, it outputs ⊥. Furthermore, if σroot and IDSγ||Fname are valid signatures, the server and the TPA save the values’ root, γ for the file name Fname.(5)
Challenge. In order to challenge the integrity of the file Fname which is owned by the user with identity ID, the TPA runs the following process:(a)
Choose a random subsetJ⊂1,n as the block indices to be challenged in the auditing process, and for each j⊂J, choose a random value yj∈Zq.(b)
Send the challengechal=Fname,j,yjj∈J to the server.(6)
ProofGen. The server generates an auditing proof according to the received challenge chal=Fname,j,yjj⊂J, through the following procedure:(a)
Computes a combination of the challenged blocks asµt=∑j∈Jyimj and sets µ=HIDµ.(b)
Aggregates the tags asσ=∑j∈Jσjyj.(c)
Sends backµ,σ,rj.Δjj∈J as the auditing proof to the TPA. Here, rj is the first term in tag of block mj and Δj is the corresponding AAI in MHT.(7)
ProofVerify. When TPA receives the proof µ,σ,rj.Δjj∈J, it first computes root′ from hrjj∈J and the corresponding AAIΔjj∈J. If root′=root, it then computes R=∑j∈Jyjrj and checks equation (3). which indicates that the cloud storage is good or not(3)eσ,g=?eμ,γ⋅eHID,mpkR.


## 4. Attack I on the OffTagGen Algorithm

The attack I is as follows:(1)
The adversary (which can be the malicious cloud server) can obtain many block-signature pairs, such asM1,σ1,M2,σ2,…,Mn,σn, and the following holds:(4)σ1=kIDxm1′+r1′=kIDxm1+r1,σ2=kIDxm2′+r2′=kIDxm2+r2,⋯σn=kIDxmn′+rn′=kIDxmn+rn.(2)
LetkIDx=A,kID=B, and r1,r2,...,rn be all known to the adversary; thus, the above equations can be rewritten as follows:(5)σ1=kIDxm1+r1=Am1Br1,σ2=kIDxm2+r2=Am2Br2,⋯σn=kIDxmn+rn=AmnBrn.(3)
With these equations, the adversary can computeA and B. We must point out that actually two equations are enough to compute A and B. Concretely, the adversary first computes(6)σ1m2=Am1m2Br1m2,σ2m1=Am2m1Br2m1,σ1r2=Am1r2Br1r2,σ2r1=Am2r1Br2r1,and then computes(7)σ1m2σ2m1=Am1m2Br1m2Am2m1Br2m1=Br1m2Br2m1=Br1m2−r2m1,σ1r2σ2r1=Am1r2Br1r2Am2r1Br2r1=Am1r2Am2r1=Am1r2−m2r1.(4)
LetC=σ1m2/σ2m1 and D=σ1r2/σ2r1:(8)C=σ1m2σ2m1=Br1m2−r2m1,D=σ1r2σ2r1=Am1r2−m2r1.For the exponential prime modular,q is publicly known to all; thus, the adversary can compute A and B as follows:(9)C1/r1m2−r2m1=B,D1/m1r2−m2r1=A.(5)
WithA and B, the adversary can forge any offline and online tags; concretely, the offline tags and online tags are generated as follows:(a)
OffTagGen. The adversary forges offline tags σoff for i∈1,B, and by choosing random values m¯i′,r¯i′ from Zq, it computes(10)σioff=Am¯i′Br¯i′=kIDxm¯i′kIDr¯i′=kIDxm¯i′′r¯i′.Because the adversary knowsA and B, it can compute σoff. At last, the adversary locally stores the offline tags m¯i′,r¯i′,σioffi∈1,B.(b)
OnTagGen. For the file F with Fname where =m1,…,mn, assume the adversary wants to modify F=m1,…,mn to be F=m¯1,m¯2,…,m¯n and then forge the tags. It generates the online tag r¯i,σ¯i on block m¯i as follows:(11)r¯i=rimodq,σ¯i=Am¯iBri=kIDxm¯ikIDri=kIDxm¯i+ri.Finally, the online tagsr¯i,σ¯ii∈1,n together with the data blocks F=m¯1,m¯2,…,m¯n are outsourced to the cloud server. At the same time, the original pair root,σroot together with γ,Fname, IDSγ||Fname is also sent to the server and the TPA. Here, IDS is a secure ID-based signature.We can check that the forged tagσ¯i a valid one because the below equation holds:(12)eσ¯i,g=ekIDxm¯i+ri,g=eHIDαxm¯i⋅HIDαri,g=eHIDαxm¯i,γ⋅eHIDri,mpk.Thus, OffTagGen algorithm is not secure. Even with two block-signature pairs, anyone can first modify the contents of the blocks and then forge the offline and online tags correspondingly.


## 5. Attack II on the Cloud Auditing Protocol

In our attack II, we show that the adversary (which can be the malicious cloud server) can forge proof while it can even delete all the outsourced data blocks. Concretely, the attack is the following:(1)
The first four steps of the attack are the same as attack I. The malicious cloud server can get=kIDx, B=kID after these steps. The below steps follow the framework of the cloud auditing protocol(2)
When the cloud server receives the tagsri,σii∈1,n and the data blocks F=m1,m2,…,mn outsourced by the data owner, it first checks whether Verifymi,ri,σi,ID,mpk,γ=1 passes for all i∈1,n. If so, it stores mi,ri,σii∈1,n in its storage; otherwise, it outputs ⊥. Furthermore, if σroot and IDSγ||Fname are valid signatures, the server and the TPA save the values’ root, γ for the file name Fname.(3)
Challenge. In order to challenge the integrity of the file F_name which is owned by the user with identity ID, the TPA runs the following process:(a)
Choose a random c−element subsetJ⊂1,n as the block indices to be challenged in the auditing process, and for each j⊂J, choose a random value yi∈Zq.(b)
Send the challengechal=Fname,j,yjj∈J to the server.(4)
ProofGen. Here we show that the malicious cloud server can even delete all the outsourced data blocks but still has the ability to return the correct auditing proof to the TPA. Note here that the malicious cloud server still stores all the tags ri,σii∈1,n. Concretely, the server generates an auditing proof according to the received challenge chal=Fname,j,yjj⊂J, through the following procedure:(a)
First, it randomly choosesm^j∈Zqj∈J and computes a combination of the challenged blocks as μ′=∑j∈Jyjm^j and sets μ=HIDμ′.(b)
For anym^j∈Zqj∈J, the malicious cloud server computes the forged tags as σ^j=Am^jBrj=kIDxm^jkIDrj=kIDxm^j+rj and aggregates the tags as σ=∏j∈Jσ^jyi.(c)
It sends backμ,σ,rj,Δjj⊂J as the auditing proof to the TPA. Here, rj is the first term in the original tags of corresponding to the deleted block mj and Δj is the corresponding AAI in MHT.(5)
ProofVerify. When TPA receives the proof μ,σ,rj,Δjj⊂J, it first computes root′ from hrjj∈J and the corresponding AAIΔjj∈J. If root=root′, it then computes R=∑j∈Jyjrj and checks equation (13). If the equation holds, the TPA outputs 1, which means that the verification passes; otherwise, it outputs 0.(13)eσ,g=?eμ,γ⋅eHID,mpkR.Here, we can verify that the forged proof, is a valid one because the below equation holds:(14)eσ,g=e∏j∈Jσ^jyj,g=e∏j∈JkIDxm^jyj,gekIDrjyj,g=e∏j∈JHIDxαm^jyj,geHIDαrjyj,g=e∏j∈JHIDm^jyj,gxαeHIDrjyj,gα=e∏j∈JHIDyjm^j,gxαeHIDrjyj,gα=e∏j∈JHIDyjm^j,gxαeHID,gαrjyj=eHIDΣj∈Jyjm^,gxαeHID,gαΣj∈Jrjyj=eμ,γ⋅eHID,mpkR.


## 6. Our Improved Cloud Auditing Protocol

(1)
Setup. The KGC chooses a random value α∈Zq as the master secret key msk and sets the master public key as mpk=gα. So, the system public parameters are param=e,q,G1,G2,g,mpk,h,H.(2)
Extract. The KGC uses param=e,q,G1,G2,g,mpk,h,H and mpk=α to generate the secret key kID=HIDα for user ID.(3)
OffTagGen. The user with identity ID owns the file F with Fname, chooses a secret random value x∈Zq as the trapdoor key, and sets γ=mpkx, γ′=gx. Then, it generates an offline tag θioff for i∈1,B, by choosing two random values mi′,ri′ from Zq as follows:(15)σioff=kIDxmi′kIDri'HFname||ix=kIDmi′x+ri′HFname||ix.At last, it locally stores the offline tags,mi′,ri′,σioffi∈1,B.(4)
OnTagGen. First, it divides F into n blocks as F=m1,…,mn, where mi∈Zq. Then, it generates the online tag ri,σi on block mi based on an unused offline tag mi′,ri′,σioff and uses trapdoor key as follows:(16)ri=ri′+xmi′−mimodq,σi=σioff.Finally, the online tagsri,σii∈1,n together with the data blocks F=m1,…,mn are outsourced to the cloud server. The data owner also creates an MHT on the ordered hash value hrii∈1,n with the root node root and generates σroot=IDSroot. At the same time, the pair root,σroot together with γ,Fname,IDSγ‖Fname is sent to the server and the TPA. Here, IDS is a secure ID-based signature.When the server receives the tagsri,σii∈1,n and the data blocks F=m1,…,mn, it first checks whether Verifymi,ri,σi,ID,mpk,γ=1 passes for all i∈1,n. If so, it stores mi,ri,σii∈1,n in its storage; otherwise, it outputs ⊥. Furthermore, if σroot and IDSγ,Fname are valid signatures, the server and the TPA save the values’ root, γ for the file name Fname.(5)
Challenge. In order to challenge the integrity of the file Fname which is owned by the user with identity ID, the TPA runs the following process:(a)
Choose a random c−element subsetJ⊂1,n as the block indices to be challenged in the auditing process, and for each j⊂J, choose a random value yj∈Zq.(b)
Send the challengechal=Fname,j,yjj∈J to the server.(6)
ProofGen. The server generates an auditing proof according to the received challenge chal=Fname,j,yjj⊂J, through the following procedure:(a)
Computes a combination of the challenged blocks asµt=∑j∈Jyjmj and sets µ=HIDµ′.(b)
Aggregates the tags asσ=∑j∈Jσjyj.(c)
Sends backµ,σ,rj.Δjj∈J as the auditing proof to the TPA. Here, rj is the first term in tag of block mj and Δj is the corresponding AAI in MHT.(7)
ProofVerify. When TPA receives the proof µ,σ,rj.Δjj∈J, it first computes root′ from hrjj∈J and the corresponding AAIΔjj∈J. If root′=root, it then computes R=∑j∈Jyjrj and checks equation (17).(17)eσ,g=e∑j∈JHFname||iyj,γ′eμ,γeHID,mpkR.


## 7. Security Analysis

In this section, we first prove the correctness of our improved scheme. Then, we prove that the audit proof in our proposed scheme cannot be forged, which proves that our proposed scheme can resist attacks I and II.(1)
Correctness. The correctness of verification equation (17) is proved below:(18)eσ,g=e∑j∈JkIDxmi′kIDri′HFname||ixyj,g=e∑j∈JHFname||ixyj,g·e∑j∈JkIDxmi′yj,g·e∑j∈JkIDri′yj,g=e∑j∈JHFname||iyj,γ′·e∑j∈JHIDmi′yj,gxα·e∑j∈JkIDri′yj,gx=e∑j∈JHFname||iyj,γ′·eμ,γ·eHID,mpkR.(2)
Soundness. In our improved scheme, a malicious CSP cannot forge a correct audit proof by using our attacks.Proof(i)
Setup. The challenger B chooses a random value α∈Zq as the master secret key msk and sets the master public key as mpk=gα. Then, challenger B forwards the parameters to the server A but keeps msk secret.(ii)
Query. The adversary server A adaptively makes the following queries to the challenger B:(a)
HashQuery. A queries hash value based on IDi, and B chooses random yi∈Zq and then outputs Hi=gyi as a response.(b)
ExtractQuery. A can query any user’s key through its ID. By running the Extract algorithm, B generates KIDi=gyiα and sends the obtained result to A.(c)
TagQuery. A queries the tags on the input pair (PID, m). B responds to the query by running the TagGen algorithm. B chooses random ri,rj∈Zq and generates σij=gxriyiαmj⋅gyiαrj⋅HFname||ix. Finally, B outputs rj,σij and γi,IDSγi and sends them to A.(iii)
Challenge. Challenger B runs the Challenge algorithm on the file F of the user with PID and B sends a challenge chal∗=Fname∗,j,yjj∈J∗ to A.(iv)
ProofGen. Adversary A executes the algorithm and computes a ProofP∗=μ∗,σ,rj∗,Δj∗j∈J∗ based on the received challenge chal∗.(v)
ProofVerify. If the proof is verified, A wins the game. Also, part of the proof represented by μ∗ in the protocol is not equal to the aggregate value μ coming from the challenger B based on the ProofVerify algorithm.In the original scheme, the adversaryA can compute μ=HIDiμ′; therefore, he can set μ=μ∗.However, in our improved scheme, the authentication tag is calculated as equation (15):(19)σioff=kIDmi′x+ri′HFname||ix.Before the malicious adversary forges an off tag, he needs to know the value ofHFname||ix. However, for i∈1,n, the value of HFname||ix is different. Even if he can get the hash value of the data HFname||i, calculating HFname||ix is as hard as solving the DL problem in G1, which is computationally infeasible. If p∗ passes the verification, we can get xri∗μ′+R=xri∗μ′∗+R∗, where μ≠μ∗.Boutputs μ/μ∗ΔR−1ri∗yi∗−1 which is a solution to the InvCDH problem and is not feasible. Therefore, the malicious CSP cannot forge a correct audit proof to pass the proof verify of TPA.(3)
Data Privacy against TPA. While providing the integrity audit service to the user, TPA cannot obtain any information about the content of the user’s data from the information provided by the user or from the auditing process.Proof. On the one hand, TPA received information from user before performing the auditing work are (root,σroot) and (γ, Fname). The user data cannot be accessed from root due to the one-way nature of the hash function. Meanwhile, γ = mpkx, and TPA cannot get user’s data from it.On the other hand, in the auditing process, the TPA gainsμ=HIDiμ′. However, given HIDi∈G1 and μ∈G1, computing μ′=∑j∈Jyjmj is solution to the DL problem.Therefore, our improved scheme can preserve the user’s data privacy.


## 8. Application of Our Scheme

As an application, we consider the hospital’s data management in cloud setting as an example to demonstrate the effectiveness of our scheme to the actual pandemic data management. During the prevention and control of the epidemic, many medical data of patients need to be recorded, including the patients’ nucleic acid testing results, the doctor’s diagnosis, and if diagnosed as COVID-19, the recent whereabouts of the patients. In fact, the amount of these data is very huge; if the hospital stores them locally, it will consume a lot of storage resources, so it is better to outsource these huge data to cloud servers for storage. However, the cloud server is not completely reliable. Many important data may be lost due to various unexpected accidents. This will cause the treatment of many patients to be delayed due to the loss of data. Furthermore, the loss of some key data of diagnosed patients may lead to inadequate control of the epidemic, which may lead to the spread of the epidemic. If there is no data integrity audit mechanism, we cannot know whether the data are completely stored. So, an integrity audit mechanism is used to ensure the integrity of cloud data. At the same time, the public key is usually used to generate the authentication information of patient data. Due to the large number of patients and the continuous increase in the number of patients, the key management is a big problem. Our scheme uses identity-based way to generate public and private keys and directly uses the user’s identity information to generate public keys, which effectively avoids the difficulty of key management.Figure2 illustrates the system model. It includes five entities. The five entities are patients, hospital (which we termed as HSP), KGC, CSP, and TPA. Because the KGC generates the private keys for the patients, it is necessary for the hospital to select a trusted key generation server as the KGC. As the cloud server needs to store a large amount of medical data, servers with strong storage capacity are selected as the cloud storage servers. Since the TPA requires a lot of audit work, a server with powerful computing power is used as the TPA. There are three steps in this model, and they are key generation, data upload, and integrity verification. The concrete implementation is as follows:Step 1 (key generation): first, the KGC in the HSP sets the parameters and calculates the master key in the Setup stage. When the patient comes to the hospital, the hospital generates the patient’s ID based on the patient’s identity information and sends the ID to KGC. Then, the KGC computes the identity-based private key for the patient according to the Extract algorithm.Step 2 (data upload): after the hospital collected the patients’ data, these data need to be uploaded to the HSP’s storage server. Firstly, the hospital computes the corresponding tag for the patient based on the corresponding collected data. Then, it uploads the data blocks and the corresponding tags to the HSP’s storage server. According to the policy, the tags and auxiliary information based on patient’s identity are transmitted to TPA, ensuring that the TPA can implement the auditing for the data stored in the cloud server.Step 3 (integrity verification): in order to guarantee the integrity of the data, HSP needs to check it regularly. First of all, the hospital or patients make a request for integrity verification to TPA, which in turn uses the challenge-response auditing protocol to verify the integrity of the data stored in the cloud, as requested. If the verification is successful, the patient’s data are considered to be good stored in the cloud server. Otherwise, the CSP does not store the patient’s data well, and other patient’s data blocks may also be lost. At this time, other important data need to be checked also, and if the data are lost, remedial measures such as backup and recovery of the lost data are needed in time.Figure 2
Pandemic data management in a hospital-based application.


## 9. Conclusions

In this paper, we review a lightweight ID-based verifiable data ownership cloud storage audit scheme proposed by Rabaninejad et al. [17]. Then, we point out the security vulnerabilities in the OffTagGen and OnTagGen part of the scheme and further demonstrate the insecurity of the original protocol by showing the attack. In order to protect the integrity of users’ data, an improved secure cloud audit protocol is proposed. The security analysis shows that the new protocol is secure.



---

*Source: 5127499-2022-02-26.xml*