# Efficient Privacy-Preserving Certificateless Public Auditing of Data in Cloud Storage

Authors: Hao Yan; Yanan Liu; Zheng Zhang; Qian Wang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Cloud computing is a fast-growing technology which supplies scalable, innovative, and efficient business models. However, cloud computing is not fully trusted, and the security of the data outsourced in cloud storage needs to be guaranteed. One of the hottest issues is how to ensure the integrity of the data in cloud storage. Until now, many researchers have proposed lots of provable data possession (PDP) schemes to deal with the problem of data integrity audition. Nevertheless, very little effort has been devoted to preserve the data uploader’s privacy while auditing the integrity of data shared in a group. To overcome the shortcoming, we propose a novel certificateless PDP protocol to efficiently audit the integrity of data shared in a workgroup with user privacy preserving. Due to the inherent structural advantage of the certificateless crypto mechanism, our PDP scheme eliminates the key escrow problem and the certificate management problem simultaneously. Moreover, the audition process in our scheme does not need any user’s identity which helps to keep the anonymity of data uploader. We give for our scheme a detailed security proof and efficiency analysis. Experiment results of performance evaluation demonstrate that our new scheme is very efficient and feasible.


---

## Body

## 1. Introduction

Recently, cloud computing has continued to provide scalable and low-cost services to user. The core advantage of cloud storage is dynamic scalability that allows the cloud storage services to deal with increasing amounts of data. Therefore, a vast number of organizations and people would like to buy cloud storage service for data maintenance and management as one of fundamental investments. Moreover, with cloud storage platform, users are easy to work together in one team [1–4], in which they share data with each other. However, cloud service provider (CSP) is not fully trustworthy. The data stored in CSP might be corrupted or deleted because of accidental hardware errors, network exceptions, software bugs, or human mistakes [5–8]. Furthermore, the untrusted CSP can tamper the user’s data easily by either deleting or modifying them. To escape economic compensation and keep good reputation, CSP would not tell the truth to user. Additionally, with no audition mechanism, untrusted CSP can never be detected. Therefore, cloud users need to periodically audit whether the data outsourced in cloud storage server is kept well.The PDP model supplies the user an efficient method to audit the integrity of the remote data in cloud storage. The audition process of PDP is conducted by a challenge-response mechanism. In PDP schemes, the data owner divides their data to many small data blocks and binds one tag to each data block. Since the tag contains the information of data block, user can get the integrity status of data block through checking the validity of the corresponding tag. Until now, many articles have proposed several types of PDP schemes [9–39] for different application scenarios. However, most PDP protocols are just suitable for checking the integrity of single data that belong to only one user.In real applications, sharing data among multiple users is a common situation, in which the shared data can be used by any one of the workgroup. Therefore, auditing the integrity of data shared in a workgroup is an essential task which should be solved by PDP scheme. When auditing shared data, user anonymity against third party auditor (TPA) is an important security requirement. In practice, TPA is usually assumed to be honest-but-curious, which means TPA tries to guess the identity of data uploader when auditing the data integrity. If the identity is exposed, the data uploader may face great security threats especially when the data are sensitive. For example, every person can report to the government about criminal behaviors through open complaint platform. If the criminal knows who reported his behavior, he may revenge the reporter. To prevent criminal from revenging the reporter, it is necessary to preserve reporter’s identity privacy. Therefore, PDP scheme should keep confidential of uploader’s identity to TPA. Aim to this goal, Wang et al. [23] proposed a concrete PDP protocol with the notion of user privacy preserving for shared data. Following, several schemes [24–29] with user privacy preserving are proposed. However, most previous PDP schemes are constructed by the PKI technique which suffers from certificate management problems such as generation, distribution, renew, revocation, update, and verification. To avoid certificate management, some PDP schemes are designed based on identity-based public cryptography (IBC) [40]. However, IBC also has the natural drawback of “key escrow.” To address these shortcomings, certificateless cryptography (CLC) [41] is introduced as a cryptography primitive. In CLC, user’s private key is consisted of two components: the first is the partial key and the second is the secret value. User’s partial key is computed by the key generation center (KGC), but the secret value is computed by the user himself/herself which is unknown to KGC. Therefore, CLC overcomes the drawbacks of PKI and IBC simultaneously. Because of these advantages, some researchers utilize CLC to construct PDP schemes [31–39]. Nevertheless, these schemes also have other shortcomings such as no user privacy preserving, heavy computationally cost, or existing security flaws which reduce the practicability of the schemes. Thus, it is necessary and urgent to present more efficient and secure PDP scheme based on CLC with user privacy preserving.


### 1.1. Our Contributions

Most previous PDP schemes only concentrate on verifying the integrity of personal data. However, to share data with multiple users based on cloud platform is a development trend and is becoming popular. Because any user can upload data to the cloud, the privacy of data uploader’s identity should be guaranteed. That is to say, TPA can audit data integrity with the help of CSP but cannot distinguish the exact data uploader.In this manuscript, we mainly consider to verify the integrity of data shared in a group with user privacy preserving. Our primary contributions in this study are summarized as following.(1)
We present the security model of certificateless-based PDP scheme for group shared data with user privacy protection. It defines the abilities of adversaries and the requirement of user privacy preserving.(2)
We propose the concrete PDP scheme based on CLC for group shared data with user privacy preserving. The proposal can resist the attacks of two types of adversaries and keep user privacy against TPA.(3)
We give rigorous secure proofs to prove the security of the proposed scheme in a random oracle model. We also demonstrate the performance evaluation results of our scheme and make comprehensive comparisons with several existing schemes.


### 1.2. Related Work

The initial PDP model is proposed by Ateniese et al. [9], which tried to provide a method to verify the integrity of client’s data stored in a remote server without downloading the data. To get better efficiency, they realized blockless verification by using homomorphic verifiable tags. Furthermore, they proposed two concrete schemes based on the RSA algorithm. However, the schemes were only available for static data with no support for dynamic operations. With the aim to enhance the scalability, Ateniese et al. [10] extended their initial PDP schemes and proposed an improved one based on symmetric key encryption. Although the improved scheme realized dynamic data operations as appending, updating, and deleting, the drawbacks still existed that the challenge number of the scheme was limited and did not support data inserting. Subsequently, Juels and Kaliski [11] proposed a similar model called proof of retrievability (POR) which had error-correcting capabilities besides data integrity audition. To improve efficiency, Shacham and Waters [12] developed a compact PoR scheme with a shorter authentication tag.Later, Erway et al. [13] presented a PDP scheme which supported public integrity audition and fully data dynamic operations. To improve the efficiency of dynamic operation, Yan et al. [14] realized a PDP scheme with a new data structure that stored all blocks operation records. To increase data durability, Liu et al. [15] presented a multireplicas data integrity checking scheme, which supported fully dynamic data updates. Li et al. [16] further considered a more complex environment that multicopies were stored in multi-CSPs, and they constructed a concrete scheme to check the integrity of all copies for one time. In other works, Wang [17] proposed a proxy PDP scheme in which a commitment was used to authenticate the validity of the auditor. Yan et al. [18] strengthened the restriction for the verifier and proposed a verifier-designated PDP protocol. Wang et al. [19] presented a notion of data privacy protection and designed a public auditable PDP scheme. Shen et al. [20] designed a PDP protocol to guarantee the privacy of authenticators.In recent years, many cloud applications supported users to work in coordination with shared data. Therefore, how to audit the data shared among multiusers attracted many attentions. Wang et al. [21] designed the first PDP scheme by a ring signature technique to verify the integrity of data shared in a group with multiusers. The scheme also supported public auditing and user privacy preserving. Later, Yang et al. [22] proposed a PDP protocol for group data with user identity privacy and traceability. Wang et al. [23] designed a new PDP scheme to support dynamic groups which allowed group members to join or leave the group at any time. Wu et al. [24] developed a PDP scheme for auditing the integrity of data shared within multiple uploaders. Subsequently, Wang et al. [25] presented a PDP protocol based on the proxy resignature technique to address the problem of user revocation. Nonetheless, all these PDP schemes were designed by the traditional PKI mechanism which bears heavy cost of certificate management.To eliminate certificate management, the identity-based cryptography (IBC) mechanism is used by many researchers to construct PDP schemes. Until now, several IBC-based PDP schemes have been proposed. For instance, Wang et al. [26] designed the first IBC-based data integrity checking scheme and proved its security under the defined security model. Yu et al. [27] presented an IBC-based PDP scheme which supported the dynamic group and data privacy protection. Tan and Jia [28] relied on an IBC-based signature scheme to propose a PDP scheme which also alleviated the users’ fear of losing their keys. To improve the applicability of cloud storage, Zhang et al. [29] proposed a proxy-oriented identity-based encryption with a keyword search scheme from lattices for cloud storage, which was postquantum secure. Furthermore, Zhang et al. [29] proposed a scheme CIPPPA to check the integrity of medical data generated by wireless body area networks (WBANs). CIPPPA can not only achieve conditional identity privacy of patients in WBANs but also validate malicious auditing behaviors with the help of ethereum blockchain.Unfortunately, IBC also has its own inherent drawback named “key escrow.” To address this problem, PDP schemes based on CLC were proposed in many articles. Wang et al. [31] first presented a CLC-based PDP scheme for auditing cloud data. In this scheme, KGC computed the partial key for each user, but KGC did not know the user’s secret value, so the user’s private key was protected against KGC which avoided the key escrow problem. However, He et al. [32] thought the scheme in [31] is insecure because it did not give the formal security model. Subsequently, they proposed a CLC-based PDP scheme for checking the data of WBANs. Nevertheless, this scheme is proved insecure [33] either. To improve verification efficiency, Kim and Jeong [34] proposed a CLC-based PDP scheme with constant verification time. Similarly, Yang et al. [35] presented a PDP scheme for shared data integrity audition based on certificateless cryptography. The scheme claimed that it was able to guarantee user identity, but in the verification phase, TPA got the relationship between data and the public keys. Thus, it did not really realize user privacy preserving. Li et al. [36] presented a PDP protocol of group shared data based on certificateless cryptography, but the scheme lost the user privacy preservation feature. Kang et al. [37] proposed a certificateless public auditing scheme with privacy preserving for cloud-assisted WBANs which protected the data from being directly exposed to the TPA. Ming and Shi [38] proposed an efficient CLC-based PDP scheme with user privacy protection. Wu et al. [39] also designed a PDP scheme for multiusers setting with user privacy preserving, but the overheads of both communication and computation were too heavy especially in the challenge phase.


## 1.1. Our Contributions

Most previous PDP schemes only concentrate on verifying the integrity of personal data. However, to share data with multiple users based on cloud platform is a development trend and is becoming popular. Because any user can upload data to the cloud, the privacy of data uploader’s identity should be guaranteed. That is to say, TPA can audit data integrity with the help of CSP but cannot distinguish the exact data uploader.In this manuscript, we mainly consider to verify the integrity of data shared in a group with user privacy preserving. Our primary contributions in this study are summarized as following.(1)
We present the security model of certificateless-based PDP scheme for group shared data with user privacy protection. It defines the abilities of adversaries and the requirement of user privacy preserving.(2)
We propose the concrete PDP scheme based on CLC for group shared data with user privacy preserving. The proposal can resist the attacks of two types of adversaries and keep user privacy against TPA.(3)
We give rigorous secure proofs to prove the security of the proposed scheme in a random oracle model. We also demonstrate the performance evaluation results of our scheme and make comprehensive comparisons with several existing schemes.


## 1.2. Related Work

The initial PDP model is proposed by Ateniese et al. [9], which tried to provide a method to verify the integrity of client’s data stored in a remote server without downloading the data. To get better efficiency, they realized blockless verification by using homomorphic verifiable tags. Furthermore, they proposed two concrete schemes based on the RSA algorithm. However, the schemes were only available for static data with no support for dynamic operations. With the aim to enhance the scalability, Ateniese et al. [10] extended their initial PDP schemes and proposed an improved one based on symmetric key encryption. Although the improved scheme realized dynamic data operations as appending, updating, and deleting, the drawbacks still existed that the challenge number of the scheme was limited and did not support data inserting. Subsequently, Juels and Kaliski [11] proposed a similar model called proof of retrievability (POR) which had error-correcting capabilities besides data integrity audition. To improve efficiency, Shacham and Waters [12] developed a compact PoR scheme with a shorter authentication tag.Later, Erway et al. [13] presented a PDP scheme which supported public integrity audition and fully data dynamic operations. To improve the efficiency of dynamic operation, Yan et al. [14] realized a PDP scheme with a new data structure that stored all blocks operation records. To increase data durability, Liu et al. [15] presented a multireplicas data integrity checking scheme, which supported fully dynamic data updates. Li et al. [16] further considered a more complex environment that multicopies were stored in multi-CSPs, and they constructed a concrete scheme to check the integrity of all copies for one time. In other works, Wang [17] proposed a proxy PDP scheme in which a commitment was used to authenticate the validity of the auditor. Yan et al. [18] strengthened the restriction for the verifier and proposed a verifier-designated PDP protocol. Wang et al. [19] presented a notion of data privacy protection and designed a public auditable PDP scheme. Shen et al. [20] designed a PDP protocol to guarantee the privacy of authenticators.In recent years, many cloud applications supported users to work in coordination with shared data. Therefore, how to audit the data shared among multiusers attracted many attentions. Wang et al. [21] designed the first PDP scheme by a ring signature technique to verify the integrity of data shared in a group with multiusers. The scheme also supported public auditing and user privacy preserving. Later, Yang et al. [22] proposed a PDP protocol for group data with user identity privacy and traceability. Wang et al. [23] designed a new PDP scheme to support dynamic groups which allowed group members to join or leave the group at any time. Wu et al. [24] developed a PDP scheme for auditing the integrity of data shared within multiple uploaders. Subsequently, Wang et al. [25] presented a PDP protocol based on the proxy resignature technique to address the problem of user revocation. Nonetheless, all these PDP schemes were designed by the traditional PKI mechanism which bears heavy cost of certificate management.To eliminate certificate management, the identity-based cryptography (IBC) mechanism is used by many researchers to construct PDP schemes. Until now, several IBC-based PDP schemes have been proposed. For instance, Wang et al. [26] designed the first IBC-based data integrity checking scheme and proved its security under the defined security model. Yu et al. [27] presented an IBC-based PDP scheme which supported the dynamic group and data privacy protection. Tan and Jia [28] relied on an IBC-based signature scheme to propose a PDP scheme which also alleviated the users’ fear of losing their keys. To improve the applicability of cloud storage, Zhang et al. [29] proposed a proxy-oriented identity-based encryption with a keyword search scheme from lattices for cloud storage, which was postquantum secure. Furthermore, Zhang et al. [29] proposed a scheme CIPPPA to check the integrity of medical data generated by wireless body area networks (WBANs). CIPPPA can not only achieve conditional identity privacy of patients in WBANs but also validate malicious auditing behaviors with the help of ethereum blockchain.Unfortunately, IBC also has its own inherent drawback named “key escrow.” To address this problem, PDP schemes based on CLC were proposed in many articles. Wang et al. [31] first presented a CLC-based PDP scheme for auditing cloud data. In this scheme, KGC computed the partial key for each user, but KGC did not know the user’s secret value, so the user’s private key was protected against KGC which avoided the key escrow problem. However, He et al. [32] thought the scheme in [31] is insecure because it did not give the formal security model. Subsequently, they proposed a CLC-based PDP scheme for checking the data of WBANs. Nevertheless, this scheme is proved insecure [33] either. To improve verification efficiency, Kim and Jeong [34] proposed a CLC-based PDP scheme with constant verification time. Similarly, Yang et al. [35] presented a PDP scheme for shared data integrity audition based on certificateless cryptography. The scheme claimed that it was able to guarantee user identity, but in the verification phase, TPA got the relationship between data and the public keys. Thus, it did not really realize user privacy preserving. Li et al. [36] presented a PDP protocol of group shared data based on certificateless cryptography, but the scheme lost the user privacy preservation feature. Kang et al. [37] proposed a certificateless public auditing scheme with privacy preserving for cloud-assisted WBANs which protected the data from being directly exposed to the TPA. Ming and Shi [38] proposed an efficient CLC-based PDP scheme with user privacy protection. Wu et al. [39] also designed a PDP scheme for multiusers setting with user privacy preserving, but the overheads of both communication and computation were too heavy especially in the challenge phase.


## 2. Preliminaries

We first review some preliminary cryptography knowledge throughout this study.


### 2.1. Bilinear Maps

Assume that two multiplicative cyclic groupsG1 and G2 have large prime order q. Let g∈G1 to be one generator of G1. Define e:G1×G1⟶G2 is a bilinear map with the following properties.(a)
Computability: for anyu,v∈G1, and there exist efficient algorithms to calculate the value of eu,v.(b)
Bilinearity: for anyx,y∈Zq∗ and u,v∈G1, and it has eux,vy=eu,vxy.(c)
Nondegeneracy:∃u,v∈G1, so that eu,v≠1G2.


### 2.2. Assumption

Definition 1.
Computational Diffie–Hellman assumption:g is a generator of the multiplicative cyclic group G1. Given g,ga,gb, to get gab is computationally intractable with unknown a,b∈Zq∗. For any adversary A, the probability for A to solve this problem is negligible. We define the CDH problem as(1)PrACDℋg,ga,gb=gab∈G1:a,b←RZq≤ε.


## 2.1. Bilinear Maps

Assume that two multiplicative cyclic groupsG1 and G2 have large prime order q. Let g∈G1 to be one generator of G1. Define e:G1×G1⟶G2 is a bilinear map with the following properties.(a)
Computability: for anyu,v∈G1, and there exist efficient algorithms to calculate the value of eu,v.(b)
Bilinearity: for anyx,y∈Zq∗ and u,v∈G1, and it has eux,vy=eu,vxy.(c)
Nondegeneracy:∃u,v∈G1, so that eu,v≠1G2.


## 2.2. Assumption

Definition 1.
Computational Diffie–Hellman assumption:g is a generator of the multiplicative cyclic group G1. Given g,ga,gb, to get gab is computationally intractable with unknown a,b∈Zq∗. For any adversary A, the probability for A to solve this problem is negligible. We define the CDH problem as(1)PrACDℋg,ga,gb=gab∈G1:a,b←RZq≤ε.


## 3. System Model and Security Model

### 3.1. System Model

There are four participants in our scheme: KGC, CSP, user group, and TPA.(1)
KGC is a trusted organization which generates the partial key for user. We assume the partial key is transmitted by secure channels.(2)
CSP is the cloud storage service provider who maintains user’s data and generates integrity proofs to prove the data integrity when received the challenge from TPA.(3)
A user group has several users, and every user can upload data blocks to CSP by which all users share their data to each other.(4)
TPA is responsible for auditing the integrity of data shared in a group. TPA sends an integrity challenge to CSP and gets a proof from CSP. Then, TPA validates the rightness of the proof and informs the checking result to users.The system model of the proposed scheme is shown in Figure1. It assumed that CSP is semitrusted. Namely, it can execute audition protocol honestly, but lies to TPA when data are broken. TPA is honest-but-curious, that is, TPA audits the data integrity honestly and responds the real audition result to data user, but it is curious about the identity of data uploader.Figure 1
System model of our scheme.Our certificateless auditing scheme for group shared data with user privacy preserving consisted of seven algorithms:Setup, PartialKeyGen, SecretValueGen, PublicKeyGen, TagGen, Challenge, Proof, and Audit.Setup: with the security parameter k, this algorithm generates public parameters pp and master private key msk.PartialKeyGen: KGC runs this algorithm to compute user’s partial key. It inputs the identity idi of the user ui and outputs ui’s partial key di.SecretValueGen: each user ui performs this algorithm to compute the secret value siPublicKeyGen: each user ui performs this algorithm to compute the public key PIDiTagGen: this algorithm generates an authentication tag for each data block. It inputs user ui’s secret key ski=di,si, and the block mj outputs its tag Ti,j.Challenge: this algorithm is performed by TPA to select a data integrity challenge chalProof: the algorithm generates the data integrity proof P for each challenge chal. It takes the inputs of shared data F, tags collection T, and the challenge chal.Audit: this algorithm is used to audit the rightness of integrity proof. It takes the inputs of the challenge chal, proof P, and data identity Fid. If P passes the verification, the algorithm returns “1;” otherwise, it returns “0.”


### 3.2. Security Model

Referring to [32, 42], the security model of our proposed scheme contains two types of adversaries. The first one denoted by A1 cannot access the master key but can replace the user’s public key. The second one denoted by A2 knows the master key but cannot replace the user’s public key. We utilize a game to cover the security characters of our scheme; the game involves a super adversary A∈A1,A2 and a challenger C.Setup phase:C calls Setup to generate the master private key msk and the public parameter pp. If A is the first type adversary A1, C gives pp to A. If A is the second type adversary A2, C gives both the pp and msk to A.Queries phase:A makes four types of query to C for polynomial times. C returns the results to A.(a)
Hash query. AdversaryA queries about hash values of any hash function in the scheme. C replies the hash value to A.(b)
Partial key query. AdversaryA can query any user’s partial key with the identity idi. C calculates the partial key di by the algorithm PartialKeyGen and returns di to A (this step is executed only by the first type adversary A1).(c)
Secret value query.A can query any user’s secret value with any identity idi. C computes the secret value si by the algorithm SecretValueGen and returns si to A.(d)
Tag query. AdversaryA can randomly select blocks and query their tags generated by any user in the group. C generates the tag of the queried block and sends the tag back to A. If C does not have user’s private key in this step, he can compute the key by PartialKeyGen and SecretValueGen algorithms.Public key replacement:C can change any user’s public key to any other value (this step is executed only by A1)Forge phase: finally,A submits to C a forged proof P∗ for any idi∗,mj∗ with the public key PIDi∗. If the proof satisfies the following three conditions, A wins this game.(1)
P∗ passes the audition with idi∗ and PIDi∗(2)
IfA is the first type adversary A1, the partial key and secret value of idi∗ have not been queried. If A is the second type adversary A2, the secret value of idi∗ has never been queried.(3)
mj∗ has never been performed the tag query with user identity idi∗ and PIDi∗Definition 2.
A public certificateless PDP scheme for group shared data with user privacy preserving is secure, if for any adversaryA, to win the game above only with negligible probability.
User privacy preserving is another security feature of the scheme. Since multiple users share data with each other in a group, each one can upload data to the group. In many cases, users prefer to keep anonymous against TPA. An honest-but-curious TPA tries to distinguish the identity of data uploader during the data verification process. If the user information is revealed and leaked by TPA, the data uploader may face potential security threats. Thus, the scheme should guarantee user’s anonymity against TPA.Definition 3.
A public certificateless PDP scheme for group shared data is user privacy preserving, if no information about the user identity is revealed by TPA within the procedure of data audition.


## 3.1. System Model

There are four participants in our scheme: KGC, CSP, user group, and TPA.(1)
KGC is a trusted organization which generates the partial key for user. We assume the partial key is transmitted by secure channels.(2)
CSP is the cloud storage service provider who maintains user’s data and generates integrity proofs to prove the data integrity when received the challenge from TPA.(3)
A user group has several users, and every user can upload data blocks to CSP by which all users share their data to each other.(4)
TPA is responsible for auditing the integrity of data shared in a group. TPA sends an integrity challenge to CSP and gets a proof from CSP. Then, TPA validates the rightness of the proof and informs the checking result to users.The system model of the proposed scheme is shown in Figure1. It assumed that CSP is semitrusted. Namely, it can execute audition protocol honestly, but lies to TPA when data are broken. TPA is honest-but-curious, that is, TPA audits the data integrity honestly and responds the real audition result to data user, but it is curious about the identity of data uploader.Figure 1
System model of our scheme.Our certificateless auditing scheme for group shared data with user privacy preserving consisted of seven algorithms:Setup, PartialKeyGen, SecretValueGen, PublicKeyGen, TagGen, Challenge, Proof, and Audit.Setup: with the security parameter k, this algorithm generates public parameters pp and master private key msk.PartialKeyGen: KGC runs this algorithm to compute user’s partial key. It inputs the identity idi of the user ui and outputs ui’s partial key di.SecretValueGen: each user ui performs this algorithm to compute the secret value siPublicKeyGen: each user ui performs this algorithm to compute the public key PIDiTagGen: this algorithm generates an authentication tag for each data block. It inputs user ui’s secret key ski=di,si, and the block mj outputs its tag Ti,j.Challenge: this algorithm is performed by TPA to select a data integrity challenge chalProof: the algorithm generates the data integrity proof P for each challenge chal. It takes the inputs of shared data F, tags collection T, and the challenge chal.Audit: this algorithm is used to audit the rightness of integrity proof. It takes the inputs of the challenge chal, proof P, and data identity Fid. If P passes the verification, the algorithm returns “1;” otherwise, it returns “0.”


## 3.2. Security Model

Referring to [32, 42], the security model of our proposed scheme contains two types of adversaries. The first one denoted by A1 cannot access the master key but can replace the user’s public key. The second one denoted by A2 knows the master key but cannot replace the user’s public key. We utilize a game to cover the security characters of our scheme; the game involves a super adversary A∈A1,A2 and a challenger C.Setup phase:C calls Setup to generate the master private key msk and the public parameter pp. If A is the first type adversary A1, C gives pp to A. If A is the second type adversary A2, C gives both the pp and msk to A.Queries phase:A makes four types of query to C for polynomial times. C returns the results to A.(a)
Hash query. AdversaryA queries about hash values of any hash function in the scheme. C replies the hash value to A.(b)
Partial key query. AdversaryA can query any user’s partial key with the identity idi. C calculates the partial key di by the algorithm PartialKeyGen and returns di to A (this step is executed only by the first type adversary A1).(c)
Secret value query.A can query any user’s secret value with any identity idi. C computes the secret value si by the algorithm SecretValueGen and returns si to A.(d)
Tag query. AdversaryA can randomly select blocks and query their tags generated by any user in the group. C generates the tag of the queried block and sends the tag back to A. If C does not have user’s private key in this step, he can compute the key by PartialKeyGen and SecretValueGen algorithms.Public key replacement:C can change any user’s public key to any other value (this step is executed only by A1)Forge phase: finally,A submits to C a forged proof P∗ for any idi∗,mj∗ with the public key PIDi∗. If the proof satisfies the following three conditions, A wins this game.(1)
P∗ passes the audition with idi∗ and PIDi∗(2)
IfA is the first type adversary A1, the partial key and secret value of idi∗ have not been queried. If A is the second type adversary A2, the secret value of idi∗ has never been queried.(3)
mj∗ has never been performed the tag query with user identity idi∗ and PIDi∗Definition 2.
A public certificateless PDP scheme for group shared data with user privacy preserving is secure, if for any adversaryA, to win the game above only with negligible probability.
User privacy preserving is another security feature of the scheme. Since multiple users share data with each other in a group, each one can upload data to the group. In many cases, users prefer to keep anonymous against TPA. An honest-but-curious TPA tries to distinguish the identity of data uploader during the data verification process. If the user information is revealed and leaked by TPA, the data uploader may face potential security threats. Thus, the scheme should guarantee user’s anonymity against TPA.Definition 3.
A public certificateless PDP scheme for group shared data is user privacy preserving, if no information about the user identity is revealed by TPA within the procedure of data audition.


## 4. Construction of Our Scheme

We show the detailed construction of our certificateless PDP scheme for group shared data, which realizes public verification and user privacy protection.Suppose the dataF is shared in a group with N users denoted as u1,u2,…,uN. F is split into n blocks, and each block is denoted by mi, where i is the block index. Different blocks may be uploaded by different users. The algorithms in our scheme are defined as follows.Setup1k⟶pp,msk: KGC first sets the value of security parameter k and selects a big random prime number q with q=k. Select cyclic multiplicative groups G1 and G2 with order q and a bilinear map e:G1×G1⟶G2. KGC selects a generator g of G1 and three different hash functions: h1:0,1⟶G1, h2:0,1⟶G1, and h3:0,1⟶G1. Then, KGC randomly selects x∈Zq∗ and sets the master private key msk=x, so the master public key is P0=gx. The system parameter is pp=q,g,G1,G2,e,P0,h1,h2,h3.PartialKeyGenidi⟶di: on receiving the identity idi of the ui, KGC computes di=h1idix as ui’s partial key and sends it to ui by a secure channelSecretValueGen⟶si: ui randomly selects a value λi∈Zq∗ and sets the secret value si=λiPublicKeyGen⟶PIDi: with secret value si, ui computes the public key PIDi=g1/siTagGendi,si,mj⟶Ti,j: ui computes the value U=h3P0,n and generates the tag for the block mj by the following equation.(2)Ti,j=di⋅h2Fid,j⋅Umjsi.Here,Fid is the unique identification of the data F. Finally, ui uploads mj,Ti,j,idi to CSP. CSP validates the rightness of the tag by the following equation:(3)eTi,j,PIDi=eh1idi,P0⋅eh2Fid,j⋅Umj,g.It can be confirmed as follows:(4)eTi,j,PIDi=eh1idix⋅h2Fid,j⋅Umjλi,g1/λi=eh1idix,g⋅eh2Fid,j⋅Umj,g=eh1idi,P0⋅eh2Fid,j⋅Umj,g.ChallengeFid⟶chal: to challenge the integrity of the data named Fid, TPA randomly chooses c numbers from the set 1,2,…,n to get a subset C⊆1,2,…,n, where C=c. For each number l∈C, CSP randomly selects a value vl∈Zq∗ and sets the chal=l,vl|l∈C. TPA submits chal=l,vl|l∈C to CSP.ProofF,T,chal⟶P: with chal=l,vl|l∈C, CSP finds out all the challenged tuples Θ=ml,Ti,l,ui|l∈C. Then, CSP randomly selects a value α∈G1 and computes(5)σ1=α⋅∏ml,Ti,l,idi∈Θh1idivl,σ2=eα,P0⋅∏ml,Ti,l,idi∈ΘeTi,lvl,PIDi,M=∑ml,Ti,l,idi∈Θvlml.Finally, CSP sends the proofP=σ1,σ2,M to TPAAuditchal,P,Fid⟶0,1: when receiving P returned from CSP, TPA computes U=h3P0,n and checks the following equation:(6)σ2=eσ1,P0⋅e∏ml,Ti,l,idi∈Θh2Fid,lvl⋅UM,g.If equation (6) holds, returns 1; otherwise, returns 0.The equation (6) can be confirmed as follows:(7)σ2=eσ1,P0⋅e∏ml,Ti,l,idi∈Θh2Fid,lvl⋅UM,g=eα,P0⋅e∏ml,Ti,l,idi∈Θh1idivl,gx⋅e∏ml,Ti,l,idi∈Θh2Fid,lvl⋅U∑ml,Ti,l,idi∈Θvlml,g=eα,P0⋅e∏ml,Ti,l,idi∈Θh1idixvl⋅∏ml,Ti,l,idi∈Θh2Fid,l⋅Umlvl,g=eα,P0⋅e∏ml,Ti,l,idi∈Θh1idix⋅h2Fid,l⋅Umlvl,g=eα,P0⋅e∏ml,Ti,l,idi∈Θh1idix⋅h2Fid,l⋅Umlλivl,g1/λi=eα,P0⋅∏ml,Ti,l,idi∈ΘeTi,j,PIDi.


## 5. Security Proof

In this section, we show the security proof of our new scheme under the security model defined in Section3.2. In our proof, three hash functions h1,h2,h3 used in our scheme are all random oracles.Lemma 1.
If the CDH problemg,G1,ga,gb is hard for the group G1, our scheme is secure against A1.Proof.
If the adversaryA1 wins the game, a simulator β can be designed to solve the CDH hard problem resorting to A1. Let g,G1,ga,gb to be one CDH instance, and β computes gab by following steps.Setup:β sets the master public key P0=ga, where a is unknown to β. β randomly selects public parameters and gives them to A1.h1 query: A1 adaptively queries the hash value of any identity id∗. β keeps a table tab1=id,h1¯,q1,τ for the h1 query. If tab1 contains the row id,∗,∗,∗, β gets the row id∗,h1∗¯,q1∗,τ∗ from tab1 and returns q1∗ to A1. Otherwise, β selects a random number h1∗¯∈Zq∗ and tosses a coin τ∈0,1. Suppose the probability of τ=1 is γ and the probability of τ=0 is 1−γ. If τ=1, β computes q1∗=gbh1∗¯. Otherwise, β computes q1∗=gh1∗¯. β responds q1∗ to A1 and appends a new row id∗,h1∗¯,q1∗,τ∗ in table tab1.Partial key query:A1 sends any identity id∗ to β for querying the partial key. β maintains a table tab2=id,d,s,pk and searches the row id∗,d∗,∗,∗. If the row exists, β returns d∗ to A1. If the row does not exist, β first gets id∗,h1∗¯,q1∗,τ∗ from tab1. If τ∗=1, β aborts and exits the game, and if τ∗=0, β sets d∗=q1∗a=gah1∗¯ and inserts the new row id∗,d∗,⊥,⊥ to tab2.Secret value query: with the queryid∗, β searches the row id∗,∗,s∗,∗. If the row exists, β sends s∗ to A1. Otherwise, ℬ randomly chooses a value s∗∈Zq∗, returns s∗ to A1, and inserts the row id∗,⊥,s∗,g1/s∗ to tab2.Public key query: for the queriedid∗, β searches the row id∗,∗,s∗,pk∗; if it exists, β returns pk∗ to A1. Otherwise, ℬ selects a random value s∗∈Zq∗, sends g1/s∗ to A1, and inserts the row id∗,⊥,s∗,g1/s∗ to tab2.Public key replacement:A1 sends id∗, ns∗, npk∗ to β to replace user’s id∗ public key with new value ns∗, npk∗. β searches the row id∗,∗,s∗,pk∗; if it exists, β returns and update the row to id∗,∗,ns∗, npk∗. If the row does not exist, β insert a new row id∗,⊥, ns∗, npk∗ to tab2.h2 query: A1 can query the hash value of Fid,j at any time. For this query, β keeps a list tab3 with tuple Fid,j,q2. If the row Fid,j,∗ exists in tab3, β retrieves q2 and returns it to A1. Otherwise, β randomly chooses a value q2∗∈G1 and returns q2∗ to A1. β inserts a new row Fid,j,q2∗ into tab3.h3 query: A1 can query the hash value of P0,v at any time. For this query, β keeps a list tab4 with tuple P0,v,q3. If the row P0,v,∗ exists in tab4, β retrieves q3 and returns it to A1. Otherwise, β randomly chooses q3∗∈G1 and returns q3∗ to A1. Then, β inserts a new row P0,v,q3∗ into tab4.Tag query: for the tag queryFid,j,mj,id,v, β gets the row id,h1¯,q1,τ from tab1. If τ=1, β aborts and exits. Otherwise, β searches id,d,s,pk, Fid,j,q2, and P0,v,q3 from tab2, tab3, and tab4, respectively. β computes the tag: Ti,j=d⋅q2⋅q3mjs=gah1¯⋅q2⋅q3mjs and returns it to A1.Forge: at last,A1 gives a forged tag Ti∗,j∗′ for block mj∗′ with the identity idi∗′, block number v′, and npki∗′. It is restricted that mj∗′ has not executed the tag query under such conditions before.Analysis: it is not difficult to see that ifA1 wins the game, the equation eTi∗,j∗′,PIDi∗=eh1idi∗′,ga⋅eh2Fid,j∗⋅Umj∗′,g must hold according to equation (3). Then, β gets the row idi∗′,h1¯′,q1′,τ′ from tab1. If τ′=0, β aborts and exits. Otherwise, β continues to find the row idi∗′,d′,ns′,npk′ from tab2, Fid,j∗,q2′ from tab3, and P0,v′,q3′ from tab4. Thus, the equation above can be changed to eTi∗,j∗′,g1/ns′=egabh1¯′⋅q2′⋅q3′mj∗′,g. We can compute the result of given CDH instance: gab=Ti∗,j∗′1/ns′/q2′⋅q3′mj∗′1/h1¯′.
We can see that ifτ=0, the game is perfect. Assume A1 makes qK times partial key query and qT times tag query; the game is performed successfully with the probability of 1−γqK+qT. Therefore, if A1 wins the game with the probability ε, β can successfully output the result of gab with the probability ε′≥1−γqK+qT⋅γ⋅ε. As known, CDH problem g,G1,ga,gb is hard for the group G1, so our proposal is secure against A1.Lemma 2.
If the CDH problemg,G1,ga,gb is hard for the group G1, our scheme is secure against A2.Proof.
If the adversaryA2 wins the game, a simulator β can be designed to solve the CDH hard problem resorting to A2. Let g,G1,ga,gb to be one CDH instance, and β computes gab by following steps.Setup:β picks a random number x∈Zq∗ as the master private key. ℬ gives A2 all the public parameters as well as the master private key x.h1 query: ℬ makes a list tab1=id,h1¯ for the h1 query. If the user identity id queried exists in tab1, ℬ retrieves the row id,h1¯ and responds the value gh1¯ to A2. Otherwise, ℬ selects a random number of h1∗¯∈Zq∗, responds gh1∗¯ to A2, and inserts id∗,h1∗¯ to tab1.Secret value query:A2 can query the secret value for any user identity id∗. ℬ makes a list tab2=id,pk,s to trace the results for this query. If id∗ existing in tab2, ℬ returns s to A2. Otherwise, ℬ selects a random number s∗∈Zq∗ and computes pk∗=g1/s∗. ℬ inserts the row id∗,pk∗,s∗ to tab2 and returns s∗ to A2.Public key query:A2 can query the public key for any user identity id∗. ℬ searches id∗ from tab2. If id∗ existing in tab2, ℬ responds pk∗ to A2. Otherwise, ℬ chooses a random value s∗∈Zq∗ and computes pk∗=ga1/s∗. ℬ inserts the row id∗,pk∗,s∗ to tab2 and returns pk∗ to A2.h2 query: A2 can query the hash value of Fid,j at any time. For this query, β keeps a list tab3 with tuple Fid,j,h2¯. If the row Fid,j,∗ exists in tab3, β retrieves h2¯ and returns gbh2¯ to A2. Otherwise, β randomly chooses h2∗¯∈Zq∗ and returns gbh2¯ to A2. β inserts a new row Fid,j,h2∗¯ into tab3.h3 query: A2 can query the hash value of P0,v∗ at any time. For this query, β keeps a list tab4 with tuple P0,v,q3,h3¯ and presets a special row P0,V,gah3¯,h3¯. If the row P0,v∗,∗,∗ exists in tab4, β retrieves q3∗ and returns it to A2. Otherwise, β randomly chooses h3∗¯∈G1 and sets q3∗=gh3∗¯. β inserts a new row P0,v∗,q3∗,h3∗¯ into tab4.Tag query: for the tag queryFid,j,mj,id,v, β gets the rows id,h1¯, id,pk,s, Fid,j,h2¯, and P0,v,q3,h3¯ from tab1, tab2, tab3, and tab4, respectively. Then, β computes the tag Ti,j=gxh1¯⋅gbh2¯⋅q3mjs and returns it to A2.Forge: at last,A2 gives a forged tag Ti∗,j∗′ for block mj∗′ with the identity idi∗′.and total block number v′. The block mj∗′ has not be executed the tag query under such conditions before.Analysis: ifA2 wins the game, the following equation eTi∗,j∗′,PIDi∗=eh1idi∗′,gx⋅eh2Fid,j∗⋅Umj∗′,g must hold according to equation (3). Then, β gets the row idi∗′,h1¯′, idi∗′,pk′,s′, Fid,j∗,h2¯′, and P0,v′,q3′,h3¯′ from tab1, tab2, tab3, and tab4. If v′≠V, β aborts and exits. Otherwise, β changes the equation above to eTi∗,j∗′,g1/s′=egh1′¯,gx⋅egabh2′¯h3′¯mj∗′,g. We can compute that the result of given CDH instance is gab=Ti∗,j∗′1/s′/gxh1¯′1/h2¯′h3¯′mj∗′.
According to the analysis, ifv′=V, β can successfully output the result of gab. Assume A2 makes qK times h3 query, and also, there are qK rows in the tab4. Thus, if A2 wins the game with the probability ε, β can get the value of gab with the probability ε/qK. Because CDH problem is hard for the group G1, our proposal is secure against for A2.
According to the Lemmas1 and 2, our proposed scheme can resist both the adversaries of A1 and A2. Therefore, we can give Theorem 1 asTheorem 1.
If the CDH problem is hard for the groupG1, our proposed data integrity auditing scheme is secure in the random oracle model.Theorem 2.
TPA cannot reveal the identity of data uploader within the process of data auditing.Proof.
From the audition algorithm of our scheme, it is not difficult to prove that TPA cannot know the data uploader of challenged data. First, the user’s identity is stored by CSP privately, and no one knows the relation between data and user identity except CSP and users themselves. In the verification phase, TPA checks the proof by equation (6) without any information about user identity. Moreover, CSP also hides the user identity in the proof σ1=α⋅∏ml,Ti,l,idi∈Θh1idivl by random value α. Therefore, our scheme can guarantee the user privacy against TPA.


## 6. Performance Analysis

### 6.1. Performance Evaluation

We summary the performance of our protocol from aspects of computational and communicational cost, which are shown as follows (Table1 ).Computational cost: letTp, Texp−G1, and Texp−G2 represent the computational cost of pairing, exponentiation on G1, and exponentiation on G2, respectively. Others like hash function, addition, and multiplication on Zq are omitted because they only incur negligible cost. It is easy to see that the algorithms such as Setup, PartialKeyGen, SecretValueGen, PublicKeyGen, and Challenge only need negligible cost, so we omit the performance analysis about these algorithms. The algorithm TagGen needs 2Texp−G1 for generating one tag. Thus, the computational cost for generating all tags is 2nTexp−G1. Proof algorithm is performed by CSP to generate proof which needs cost of 2cTexp−G1+c+1Tp. The algorithm Audit is run by TPA, and it costs 2Tp+c+1⋅Texp−G1. Moreover, we compare the computational cost of our scheme with that in other three similar schemes in Table 1, in which U is the count of group users.From Table1, we can get that the tag generation cost of our scheme is almost the same as that in [31, 36], which is much lower than that of [37]. In the proof generation step, our scheme has the highest cost than that of other three, that is, because our scheme does more work to hide the relationship of data and data uploader, so as to realize the user privacy preserving. We can see that only our scheme can preserve user privacy against TPA, while other three cannot. In the proof audition step, our scheme is the most efficient one compared with other three schemes. In summary, our scheme is computationally efficient.Communicational cost: in our scheme, a tag is one element ofG1, so the communication cost for data transfer form is nG1+F+id, where F denotes the size of outsourced data and id is the size of user identity. The size of each challenge is bounded of 4c+cZq, and the proof size is Zq+G1+G2.Table 1
Comparison of computational cost.
SchemesTag generationProof generationProof auditionUser privacy preserving[31]2Texp−G1cTexp−G13Tp+2c⋅Texp−G1No[36]2Texp−G1cTexp−G1U+2Tp+c+U⋅Texp−G1No[37]4Texp−G1cTexp−G14Tp+2c+2⋅Texp−G1NoOur scheme2Texp−G1c+1Tp+2cTexp−G12Tp+c+1⋅Texp−G1Yes


### 6.2. Experiment Results

We implemented a prototype of our scheme with PBC library [43], which is based on the library of GMP [44]. Our experiments are executed in the Ubuntu Kylin-15.10 operating system with VMware workstation. We give 1 CPU and 1G Ram to the virtual machine and use the Lenovo laptop X270 as the host which installs the Win10 operation system with Core i5 CPU and 8G Ram. We choose the typical “Type A” elliptic curve supplied by PBC in our experiments. In order to accurately show the advantage of our scheme, we implement schemes in [31], [36], and [37] simultaneously.We first make experiments to evaluate the efficiency of tag generation. We prepare 1000 randomly selected data blocks and run ten experiments with different number of tags. The results are shown in Figure2. We can see that the computation cost increases linearly with the number of tags rising, which is consistent with the theoretical analysis. However, computing 1000 tags only costs about 9.8 seconds which is feasible.Figure 2
The cost of tag generation.Second, we make experiments to test the performance of proof generation. In this experiment, we simulate 100 different users and change the number of challenged blocks from 100 to 500 with total 1000 blocks. The experiment data are shown in Figure3. From Figure 3, we can see that our scheme costs much more time than that of other three. The reason for this situation is analyzed before; specifically, we embed the relationship of challenged data and data uploader into the proof while other three schemes compute the proof only with data and tags without hiding the relationship. When checking the proof, TPA in other three schemes should use the data owner’s public key which exposes the relationship of challenged data and the data owner.Figure 3
The cost of proof generation.The cost of proof audition is shown in Figure4. The schemes in [31, 37] have the similar cost, the gap of which is very small. The cost of scheme in [36] is associated with the number of group users, so it has the most cost in the beginning. However, with the number of challenged blocks increasing, the audition cost of [31, 37] exceeds that of the scheme [36]. Overall, our scheme is the most efficient, one in this step, which needs only 2.5 seconds for 500 challenged blocks.Figure 4
The cost of proof audition.It is well known that CSP has great computation ability, but TPA is usually a normal workstation or personal computer. Although our scheme costs more time when generating the proof in the experiments, it is done by CSP which makes the gap be negligible in real environment. However, the different of TPA in our experiments and in real environment is very small, so the advantage of proof audition in our scheme is the very important.To improve the efficiency of the data integrity audition scheme, we can assign more workload to CSP but less to TPA. We summary the computation cost of CSP and TPA in the four schemes with 500 challenged blocks. The results are shown in Figure5, from which we can see that our scheme assigns the most workload to CSP but the lightest workload to TPA. Thus, compared with recent researches, our scheme is efficient especially for TPA.Figure 5
Computation cost of TPA and CSP.


## 6.1. Performance Evaluation

We summary the performance of our protocol from aspects of computational and communicational cost, which are shown as follows (Table1 ).Computational cost: letTp, Texp−G1, and Texp−G2 represent the computational cost of pairing, exponentiation on G1, and exponentiation on G2, respectively. Others like hash function, addition, and multiplication on Zq are omitted because they only incur negligible cost. It is easy to see that the algorithms such as Setup, PartialKeyGen, SecretValueGen, PublicKeyGen, and Challenge only need negligible cost, so we omit the performance analysis about these algorithms. The algorithm TagGen needs 2Texp−G1 for generating one tag. Thus, the computational cost for generating all tags is 2nTexp−G1. Proof algorithm is performed by CSP to generate proof which needs cost of 2cTexp−G1+c+1Tp. The algorithm Audit is run by TPA, and it costs 2Tp+c+1⋅Texp−G1. Moreover, we compare the computational cost of our scheme with that in other three similar schemes in Table 1, in which U is the count of group users.From Table1, we can get that the tag generation cost of our scheme is almost the same as that in [31, 36], which is much lower than that of [37]. In the proof generation step, our scheme has the highest cost than that of other three, that is, because our scheme does more work to hide the relationship of data and data uploader, so as to realize the user privacy preserving. We can see that only our scheme can preserve user privacy against TPA, while other three cannot. In the proof audition step, our scheme is the most efficient one compared with other three schemes. In summary, our scheme is computationally efficient.Communicational cost: in our scheme, a tag is one element ofG1, so the communication cost for data transfer form is nG1+F+id, where F denotes the size of outsourced data and id is the size of user identity. The size of each challenge is bounded of 4c+cZq, and the proof size is Zq+G1+G2.Table 1
Comparison of computational cost.
SchemesTag generationProof generationProof auditionUser privacy preserving[31]2Texp−G1cTexp−G13Tp+2c⋅Texp−G1No[36]2Texp−G1cTexp−G1U+2Tp+c+U⋅Texp−G1No[37]4Texp−G1cTexp−G14Tp+2c+2⋅Texp−G1NoOur scheme2Texp−G1c+1Tp+2cTexp−G12Tp+c+1⋅Texp−G1Yes


## 6.2. Experiment Results

We implemented a prototype of our scheme with PBC library [43], which is based on the library of GMP [44]. Our experiments are executed in the Ubuntu Kylin-15.10 operating system with VMware workstation. We give 1 CPU and 1G Ram to the virtual machine and use the Lenovo laptop X270 as the host which installs the Win10 operation system with Core i5 CPU and 8G Ram. We choose the typical “Type A” elliptic curve supplied by PBC in our experiments. In order to accurately show the advantage of our scheme, we implement schemes in [31], [36], and [37] simultaneously.We first make experiments to evaluate the efficiency of tag generation. We prepare 1000 randomly selected data blocks and run ten experiments with different number of tags. The results are shown in Figure2. We can see that the computation cost increases linearly with the number of tags rising, which is consistent with the theoretical analysis. However, computing 1000 tags only costs about 9.8 seconds which is feasible.Figure 2
The cost of tag generation.Second, we make experiments to test the performance of proof generation. In this experiment, we simulate 100 different users and change the number of challenged blocks from 100 to 500 with total 1000 blocks. The experiment data are shown in Figure3. From Figure 3, we can see that our scheme costs much more time than that of other three. The reason for this situation is analyzed before; specifically, we embed the relationship of challenged data and data uploader into the proof while other three schemes compute the proof only with data and tags without hiding the relationship. When checking the proof, TPA in other three schemes should use the data owner’s public key which exposes the relationship of challenged data and the data owner.Figure 3
The cost of proof generation.The cost of proof audition is shown in Figure4. The schemes in [31, 37] have the similar cost, the gap of which is very small. The cost of scheme in [36] is associated with the number of group users, so it has the most cost in the beginning. However, with the number of challenged blocks increasing, the audition cost of [31, 37] exceeds that of the scheme [36]. Overall, our scheme is the most efficient, one in this step, which needs only 2.5 seconds for 500 challenged blocks.Figure 4
The cost of proof audition.It is well known that CSP has great computation ability, but TPA is usually a normal workstation or personal computer. Although our scheme costs more time when generating the proof in the experiments, it is done by CSP which makes the gap be negligible in real environment. However, the different of TPA in our experiments and in real environment is very small, so the advantage of proof audition in our scheme is the very important.To improve the efficiency of the data integrity audition scheme, we can assign more workload to CSP but less to TPA. We summary the computation cost of CSP and TPA in the four schemes with 500 challenged blocks. The results are shown in Figure5, from which we can see that our scheme assigns the most workload to CSP but the lightest workload to TPA. Thus, compared with recent researches, our scheme is efficient especially for TPA.Figure 5
Computation cost of TPA and CSP.


## 7. Conclusion

In this article, we propose a public certificateless PDP scheme for cloud storage. Our scheme not only inherits the advantages of certificateless cryptography but also has the merit of user identity privacy protection. With our scheme, TPA can audit the integrity of group shared data rightly without revealing the data uploader so as to preserve user’s privacy. We formalize the security model of our scheme with two types of adversaries and prove its security in the random oracle model. Experimental result demonstrates that our proposal is efficient.



---

*Source: 6639634-2021-05-28.xml*