Efficient Pairing-Free Privacy-Preserving Auditing Scheme for Cloud Storage in Distributed Sensor Networks

Abstract

With the rapid growth of the distributed sensor networks, the distributed sensor network data security problems begin to attract the attention of people. The previous research of distributed sensor network security has focused on secure information in communication; however the research of secure data storage has been overlooked. As we know, cloud data storage and retrieval have become popular for efficient data management in distributed sensor networks; thus they can enjoy the on-demand high-quality cloud storage service. Meanwhile, it also introduces new security challenges. To tackle with these security challenges, many classic auditing schemes of cloud storage have been proposed. However, these schemes all need very expensive pairing computation, which is not suitable for sensor networks. In this paper, we propose an efficient pairing-free auditing scheme for data storage of distributed sensor networks. We exploit homomorphic message authentication codes (MACs) to reduce the space used to store the verification information. We also employ the random masking technique to make sure the TPA cannot recover the primitive data blocks of the sensor networks data manager. Experimental results show that our auditing scheme is more light-weight than previous auditing schemes and more practical in applied distributed sensor networks environments.

1. Introduction

Nowadays, distributed sensor networks have been rapidly applied in many practical environments in our social life [1, 2]. With distributed sensor networks being applied widely, the sensor network data managers often need to collect massive data and choose to be stored in the cloud server, while the security and privacy of sensor networks storage data become increasingly important [3, 4]. As we know, cloud computing is an alternative to conventional computing model since it can provide a flexible, resilient, and cost-effective infrastructure [5]. So it is suitable option to store the massive sensor network data on cloud server [6]. While cloud storage is an important service of cloud computing, which allows cloud users to move data from their local computing systems to the cloud, by data outsourcing, the cloud users can be relieved from the burden of local data storage and maintenance. Thus the cloud servers can concentrate on their core business issues and operate other business applications through the Internet, rather than incurring substantial hardware, software, and personnel costs involved in deploying and maintaining applications in-house.

Although the cloud storage service makes these advantages more appealing than ever before, it also introduces new security challenges towards user's outsourced data [7–9]. Firstly, the cloud users would worry their data could be misused or accessed by unauthorized users. Many researches have been done on this security issue of data hosting [10–12]. Secondly, the cloud users would worry their data could be lost in the cloud. This is because data loss could happen in any infrastructure, no matter what high degree of reliable measures the cloud service providers would take [13, 14]. Sometimes, the cloud service providers may be dishonest and they may discard the data which have not been accessed or rarely accessed to save the storage space or keep fewer replicas than promised. Moreover, the cloud service providers may choose to hide data loss and claim that the data are still correctly stored in the cloud. Consequently, the cloud users need to be convinced that their data are correctly stored in the cloud.

As the cloud users no longer physically possess the storage of their data, traditional cryptographic primitives for the purpose of data security protection can not be directly adopted. Thus how to efficiently verify the integrity of outsourced cloud data without the local copy of data files becomes a big challenge for data storage security in cloud computing. Checking on retrieval is a common method for checking the data integrity, which means cloud users check the data integrity when accessing their data. This method has been used in peer-to-peer storage systems [15], network file systems [16, 17], web-service object stores [18], and database systems [19]. However, checking on retrieval is not sufficient to check the integrity for all the data stored in the cloud. There is usually a large amount of data stored in the cloud; the ability to audit the correctness of the data in a cloud environment can be formidable and expensive for the cloud users [20, 21]. Therefore, in order to save the communication resources as well as the online burden potentially brought by the periodic storage correctness verification, cloud users can delegate a third party (TPA) to perform security auditing tasks as it is not economically feasible for them to handle it by themselves. Meanwhile, the cloud users also hope to keep their data private from the TPA and the cloud server.

1.1. Related Work

Until now, a number of auditing schemes have been proposed in the context of ensuring remotely stored data integrity without the knowledge of the entire data with different requirements [20, 22–24]. However, these schemes need the expensive pairing computation; it is a burden for the sensor network. And most of these schemes [20, 22, 24] do not consider the privacy protection of user's data. Indeed, the user's data may be revealed to some curious adversaries. This shortcoming will greatly affect the security of these schemes in cloud computing. In the view of protecting the data privacy, the users can rely on the TPA for the storage security of their data, and they also do not want this auditing process to introduce new vulnerabilities of unauthorized information leakage toward their data security [25]. The unauthorized data leakage still remains possible due to the potential exposure of decryption keys. In 2013, Wang et al.'s [26] has presented a privacy-preserving public auditing scheme for cloud storage; it resorts to the homomorphic authenticator technique and random masking technique to achieve privacy-preserving public auditing and utilizes the technique of bilinear aggregate signature to realize batch auditing. However it also acquires very expensive pairing computation, which is time-consuming. Therefore, how to design an efficient privacy-preserving auditing scheme for cloud storage in distributed sensor networks, especially without needing the expensive pairing computation, is the important work we are going to do in this paper.

1.2. Our Contribution

Motivated by the above, in this paper, we propose an efficient pairing-free privacy-preserving auditing scheme for cloud storage in distributed sensor networks. In particular, we utilize the modified Schnorr signature to construct homomorphic authenticator so that the TPA can verify the integrity of the data without retrieving the entire data. Additionally, we exploit homomorphic MACs [27] to reduce the space used to store the verification information. As a necessary tradeoff, we allow the TPA to share a private key pair with the DSN data manager, which we refer to as authorized auditing. Due to the function of the random masking, even if the authorized TPA possesses the private key pair, the TPA cannot recover the primitive data blocks of the DSN data manager. As the individual auditing of these growing auditing tasks can be tedious, we extend our basic scheme to support batch auditing for multiuser, which can thus enable the TPA to efficiently perform multiple auditing tasks in a batch manner simultaneously. Furthermore, compared with the previous classic auditing scheme [26], our experimental results show that our auditing scheme is more light-weight, and this is mainly because our auditing scheme does not need the expensive pairing operations, which can satisfy the requirement of the sensor network.

1.3. Organization

The rest of this paper is organized as follows. We introduce the preliminaries of our work in Section 2. We give the formal pairing-free privacy-preserving auditing scheme for cloud storage with distributed sensor networks in Section 3. We give the analysis of the proposed auditing scheme in Section 4. We make a performance comparison in Section 5. We make a conclusion in Section 6.

2. Preliminaries

2.1. The Cloud Data Storage Model in Sensor Network

We exemplify the security needs in data storage with a distributed sensor networks application scenario. Here, for simplicity, after collecting the data by the sink node, we assume that we assume that a DSN (distributed sensor network) data storage manager processes and transfers sensor networks data to the cloud sever. Since DSN data storage manager does not own additional computing resources, it only takes advantage of the limited computing capacity of the sink node to finish the secure DSN data storage. For the part of DSN, it can be considered as a data storage manager, while, for the part of the CSP (cloud service provider), it can be considered as a special cloud user. In our distributed sensor networks application scenario, we suppose Pob is a DSN data owner; his business is that to collect sensor network data which are processed to supply various service to clients. Since he does not have enough money to buy devices and hire professionals, he wishes to turn to CSP and outsource his data to CSP. However, he will worry about the following questions: (1) he cannot physically control the data, and CSP may repudiate that the data are lost, which makes him verify the integrity of data at any time; (2) CSP is honest and curious, Pob wants to guarantee his data confidentiality, and he must assure his storage mode has the function of privacy-preserving; (3) Pob's main work is responsible for sensor network, and he needs an efficient audit scheme to complete this task.

As illustrated in Figure 1, sensor nodes collect data from the target setting and send them to sink node; Pob is a distributed sensor networks data owner; he can assign a DSN data storage manager to sign and encrypt data, then outsource data and tags to CSP, and delete local data simultaneously. If the DSN data storage manager wants to verify data integrity stored in the cloud server, he makes a request for TPA; TPA verifies tags after it receives the requests. If it is true, it generates a challenge message. After receiving the challenge message request, CSP supplies the response proof to TPA; TPA verifies the response proof message and returns the verified result to the DSN data storage manager. Finally, the DSN data storage manager submits the auditing result to Pob.

Figure 1

DSN data storage in the CSP.

The sensor network (DSN) data manager can rely on the cloud server for cloud data storage and maintenance. They may also dynamically interact with the cloud server to access and update their stored data for various application purposes. The DSN data manager may resort to the TPA for ensuring the storage security of their outsourced data, while hoping to keep their data private from the TPA. We consider that a semitrusted cloud server exists. Namely, in most of time it behaves properly and does not deviate from the prescribed protocol execution. However, during providing the cloud data storage based services, for the benefits the cloud server might neglect to keep or deliberately delete rarely accessed data files which belong to the DSN data manager. Moreover, the cloud server may decide to hide the data corruptions caused by server hacks or failures to maintain reputation. We assume that the TPA, who is in the business of auditing, is reliable and independent and thus has no incentive to collude with either the cloud server or the DSN data manager during the auditing process. The TPA should be able to efficiently audit the cloud data storage without local copy of data and without bringing in additional online burden to the DSN data manager. However, any possible leakage of DSN manager's outsourced data towards the TPA through the auditing protocol should be prohibited.

2.2. Design Goals

To enable privacy-preserving auditing for cloud data storage under the aforementioned model, our auditing scheme should achieve the following security and performance guarantee:

• (i)

public auditability: to allow the TPA to verify the correctness of the cloud data on demand without retrieving a copy of the whole data or introducing additional online burden to the DSN data manager,

(ii)

storage correctness: to ensure that there is not a cheating cloud server that can pass the auditing from the TPA without indeed storing DSN data manager data intact,

(iii)

privacy-preserving: to ensure that there exists no way for the TPA to derive DSN data managers’ data content from the information collected during the auditing process,

(iv)

batch auditing: to enable the TPA with secure and efficient auditing capability to cope with multiple auditing delegations from possibly large number of different DSN data managers simultaneously,

(v)

lightweight: to allow the TPA to perform auditing with minimum communication and computation overhead.

2.3. Cryptographic Definition

Definition 1.

Discrete Logarithm problem states that, given a multiplicative cyclic group of order of p and $g,d\in G$ as input, compute $\eta \in Z_p$ such that $d=g^{\eta }$ .

The Discrete Logarithm assumption holds in G if no polynomial time algorithm has a nonnegligible probability in solving the Discrete Logarithm problem, which means it is computationally infeasible to solve the Discrete Logarithm problem in G.

Now we introduce homomorphic MAC, described in [27].

Definition 2 (Homomorphic MAC).

Given a data block $m_j=(m_{j,\mathrm{1}},\dots ,m_{j,k})\in Z_q^k$ , the homomorphic MAC of this data block can be computed as $t_j={\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{m}_{j,\mathcal{l}}+{\omega }_j\in Z_q$ , where $\rho =({\rho }_{\mathrm{1}},\dots ,{\rho }_k)$ is generated by a pseudorandom generator and a secret key $\text{s}{\text{k}}_{\text{prg}}$ and ${\omega }_j$ is calculated by a pseudorandom function and a secret key $\text{s}{\text{k}}_{\text{prf}}$ .

We know that, given $t_{\mathrm{1}}$ and $t_{\mathrm{2}}$ , an intermediate node can compute a valid MAC of a new date block $m^{\prime }=m_1+m_2$ by calculating $t^{\prime }=t_{\mathrm{1}}+t_{\mathrm{2}}$ without knowing the secret key pair $(\text{s}{\text{k}}_{\text{prg}},\text{s}{\text{k}}_{\text{prf}})$ .

3. Pairing-Free Privacy-Preserving Auditing Scheme for Cloud Storage in Distributed Sensor Networks

In this section, we propose our privacy-preserving authorized auditing scheme for cloud storage in distributed sensor networks, and our scheme does not need pairing computation and thus can reduce much computation cost. The privacy-preserving auditing scheme is illustrated in Table 1. Here, we need to define a semitrusted TPA, who is only responsible for auditing the integrity of data blocks honestly; however, it is curious and may try to reveal the DSN managers’ primitive data blocks based on verification information. Our scheme consists of the following four algorithms. They are Setup, SigGen, ProofGen, and ProofVerify, respectively.

Table 1

The privacy-preserving auditing scheme.

TPA		The cloud server
(1) Retrieve file $$tag$$ , verify its signature, and quit if it failed.
(2) Generate a challenge message $$chal=\{(j,{\mathrm{\nu }}_j){\}}_{j\in \mathcal{J}}$$ .	$$\overrightarrow{chal=\{(j,{\mathrm{\nu }}_j){\}}_{j\in \mathcal{J}}}$$	(3) Compute $$r={\prod }_{j\in \mathcal{J}}\mathrm{‍}{r}_j^{{\mathrm{\nu }}_j{r}_j}$$ mod p and compute $$s={{\displaystyle \sum }}_{j\in \mathcal{J}}\mathrm{‍}{v}_j{s}_j\mathrm{mod}q$$ , $${\mathrm{\mu }}_{\mathcal{l}}^{\prime }={{\displaystyle \sum }}_{j\in \mathcal{J}}\mathrm{‍}{\mathrm{\nu }}_j{m}_{j,\mathcal{l}}^{\prime }\in Z_p$$ , where $$\mathcal{l}\in \{\mathrm{1},\dots ,k\}$$ .
		(4) Choose a random element $${\mathrm{\eta }}_{\mathcal{l}}\leftarrow Z_q$$ and calculate $$W_{\mathcal{l}}=y^{{\mathrm{\eta }}_{\mathcal{l}}}$$ .
		(5) Compute $$\mathrm{\mu }=({\mathrm{\mu }}_{\mathrm{1}},\dots ,{\mathrm{\mu }}_k)$$ , where $${\mathrm{\mu }}_{\mathcal{l}}={\mathrm{\mu }}_{\mathcal{l}}^{\prime }+{\mathrm{\eta }}_{\mathcal{l}}h(W_{\mathcal{l}})$$ and $$W=(W_{\mathrm{1}},\dots ,W_k)$$ .
	$$\overleftarrow{\{\mathrm{\mu },r,s,W,\{{\text{id}}_j{\}}_{j\in \mathcal{I}}\}}$$
(6) Generate $$\mathrm{\rho }=({\mathrm{\rho }}_{\mathrm{1}},\dots ,{\mathrm{\rho }}_k)\leftarrow \text{PRG}({\text{sk}}_{\text{prg}})\in Z_q^k$$ and $${\mathrm{\rho }}_j\leftarrow \text{PRF}({\text{sk}}_{\text{prf}},{\text{id}}_j)\in Z_q$$ .
(7) Compute $${\mathrm{\lambda }}_{\mathrm{1}}={{\displaystyle \sum }}_{\mathcal{l}=\mathrm{1}}^k\mathrm{‍}{\mathrm{\rho }}_{\mathcal{l}}{\mathrm{\mu }}_{\mathcal{l}}+{{\displaystyle \sum }}_{j\in \mathcal{J}}\mathrm{‍}{\mathrm{\nu }}_j{\mathrm{\omega }}_j\in Z_q$$ , $${\mathrm{\lambda }}_{\mathrm{2}}={{\displaystyle \sum }}_{\mathcal{l}=\mathrm{1}}^k\mathrm{‍}{{\displaystyle \sum }}_{j\in \mathcal{J}}\mathrm{‍}{\mathrm{\rho }}_{\mathcal{l}}{\mathrm{\nu }}_j{f}_{\mathrm{\tau }}(\mathcal{l},{\text{id}}_j)\in Z_q$$ , and $$h(W_{\mathcal{l}})$$ , where $$\mathcal{l}\in \{\mathrm{1},\dots ,k\}$$ , and then verify $$\{\mathrm{\mu },r,s,W,\{{\text{id}}_j{\}}_{j\in \mathcal{J}}\}$$ via the verification equation.

Setup. The initial system chooses two large prime numbers p and q, satisfying that q is a prime factor of $p-\mathrm{1}$ . Choose an integer g, such that $g^q\equiv \mathrm{1}\mathrm{mod}p$ ; g is a generator of multiplicative cyclic group of order q; denote it by G. Data file M is divided into n blocks, and each data block is further divided into k elements of $Z_q$ . Therefore, M can be presented as $M=(m_{\mathrm{1}},m_{\mathrm{2}},\dots ,m_n)\in Z_q^{n\times k}$ ; each $m_j=(m_{j,\mathrm{1}},m_{j,\mathrm{2}},\dots ,m_{j,k})\in Z_q^k$ , $\mathrm{1}\le j\le n$ . The system sets a pseudorandom generator $\text{PRG}:{\mathcal{K}}_{\text{prg}}\to Z_q^k$ and a pseudorandom function $\text{PRF}:{\mathcal{K}}_{\text{prf}}\times \mathcal{I}\to Z_q$ , where ${\mathcal{K}}_{\text{prg}}$ and ${\mathcal{K}}_{\text{prf}}$ denote the set of secret keys for $\text{PRG}$ and $\text{PRF}$ , respectively, and $\mathcal{I}$ denotes the set of all identities of each data block in data file M. Then, the DSN data manager selects $x\leftarrow Z_q$ randomly, and $x\ne \mathrm{0}$ computes $y=g^x\mathrm{mod}p$ . Meanwhile, the DSN data manager also randomly computes a secret key pair $\text{skp}=(\text{s}{\text{k}}_{\text{prg}},\text{s}{\text{k}}_{\text{prf}})$ , where $\text{s}{\text{k}}_{\text{prg}}\in {\mathcal{K}}_{\text{prg}}$ and $\text{s}{\text{k}}_{\text{prf}}\in {\mathcal{K}}_{\text{prf}}$ . The system sets a lightweight symmetry encryption algorithm f, with its private key being τ. The system also sets a secure hash function $h:G\to Z_q$ . In particular, to generate the data block tag, the DSN data manager chooses a random signing key pair $(\text{spk},\text{ssk})$ . Thus the public parameters are $\text{pk}=\{G,g,y,\text{spk}\}$ , and the private parameters are $\text{sk}=\{x,\tau ,\text{ssk}\}$ .

SigGen. Given a data block $m_j=(m_{j,\mathrm{1}},\dots ,m_{j,k})$ , this data block's identifier ${\text{id}}_j\in \mathcal{I}$ . To ensure the integrity of unique data block identity, the DSN data manager computes ${\text{tag}}_j={\text{id}}_j\parallel \text{SSi}{\text{g}}_{\text{ssk}}({\text{id}}_j)$ as the data block tag for $m_j$ . The DSN data manager computes $\rho =({\rho }_{\mathrm{1}},\dots ,{\rho }_k)\leftarrow \text{PRG}(\text{s}{\text{k}}_{\text{prg}})\in Z_q^k$ and ${\omega }_j\leftarrow \text{PRF}(\text{s}{\text{k}}_{\text{prf}},{\text{id}}_j)\in Z_q$ . Then the DSN data manager calculates the homomorphic MAC of data block $m_j=(m_{j,\mathrm{1}},\dots ,m_{j,k})$ as $t_j={\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{m}_{j,\mathcal{l}}+{\omega }_j\in Z_q$ . The DSN data manager begins to compute the signature of $t_j$ as follows:

• (1)

choose $k_j\leftarrow Z_q$ and compute $r_j\equiv g^{k_j}\mathrm{mod}p$ and $r_j^{\prime }\equiv r_j\mathrm{mod}q$ ;

(2)

$s_j=(r_j^{\prime }{k}_j+t_{j}x)\mathrm{mod}q$ ;

(3)

output ${\sigma }_j=(r_j,s_j)$ as the signature of $t_j$ .

Denote the set of signatures by $\Phi =\{{\sigma }_j{\}}_{\mathrm{1}\le j\le n}$ . Meanwhile, to guarantee the confidentiality of the data file, the DSN data manager employs the lightweight symmetry encryption algorithm f to encrypt each data block $m_j=(m_{j,\mathrm{1}},\dots ,m_{j,k})$ as $m_j^{\prime }=(m_{j,\mathrm{1}}+f_{\tau }(\mathrm{1},{\text{id}}_j),\dots ,m_{j,k}+f_{\tau }(k,{\text{id}}_j))$ under the symmetry private key τ. Thus, the data file $M=(m_{\mathrm{1}},\dots ,m_n)$ is encrypted to be $M^{\prime }=(m_1^{\prime },\dots ,m_n^{\prime })$ . Finally, the DSN data manager sends $\{M^{\prime },{\text{tag}}_{\mathrm{1}\le j\le n},\Phi \}$ to the cloud server and deletes them from local storage.

ProofGen. In this phase, for each data block $m_j$ , the TPA first retrieves the data block tag, verifies the signature $\text{SSi}{\text{g}}_{\text{ssk}}({\text{id}}_j)$ with $\text{spk}$ , and aborts if the verification fails. Otherwise, the DSN data manager recovers ${\text{id}}_j$ .

Now it comes to the important part of the auditing process. To audit the integrity of data file, a DSN data manager first sends an auditing request to the TPA. After receiving an auditing request, the TPA generates an auditing challenge message as follows.

• (1)

Randomly choose a c-element subset $\mathcal{J}$ of set $\{\mathrm{1},\dots ,n\}$ to locate the c selected data blocks in this auditing task.

(2)

For each $j\in \mathcal{J}$ , the TPA also chooses a random value ${\nu }_j$ .

(3)

Output an auditing challenge message $\text{chal}=\{(j,{\nu }_j){\}}_{j\in \mathcal{J}}$ and send it to the cloud server; the $\text{chal}$ message specifies the positions of the data blocks required to be checked.

After receiving an auditing challenge message $\text{chal}$ , the cloud server generates a response proof of possession of selected data blocks storage correctness as follows.

• (1)

Compute $r={\prod }_{j\in \mathcal{J}}‍r_j^{{\nu }_j{r}_j}\mathrm{mod}p$ .

(2)

Compute $s={\sum }_{j\in \mathcal{J}}‍{\nu }_j{s}_j\mathrm{mod}q$ .

(3)

Compute ${\mu }_{\mathcal{l}}^{\prime }$ as the linear combination of sampled blocks: ${\mu }_{\mathcal{l}}^{\prime }={\sum }_{j\in \mathcal{J}}‍{\nu }_j{m}_{j,\mathcal{l}}^{\prime }\in Z_q$ , where $\mathcal{l}\in \{\mathrm{1},\dots ,k\}$ .

To blind ${\mu }_{\mathcal{l}}^{\prime }$ , the cloud server chooses a random element ${\eta }_{\mathcal{l}}\leftarrow Z_q$ , and then it calculates $W_{\mathcal{l}}=y^{{\eta }_{\mathcal{l}}}$ and ${\mu }_{\mathcal{l}}={\mu }_{\mathcal{l}}^{\prime }+{\eta }_{\mathcal{l}}h(W_{\mathcal{l}})$ . Finally, the cloud server sends $\{\mu ,r,s,W,\{{\text{id}}_j{\}}_{j\in \mathcal{J}}\}$ to the TPA for auditing, where $\mu =({\mu }_{\mathrm{1}},\dots ,{\mu }_k)$ and $W=(W_{\mathrm{1}},\dots ,W_k)$ .

ProofVerify. Given an auditing response proof $\{\mu ,r,s,W,\{{\text{id}}_j{\}}_{j\in \mathcal{J}}\}$ , an auditing message $\text{chal}=\{(j,{\nu }_j){\}}_{j\in \mathcal{J}}$ . The TPA verifies the correctness of this proof as follows.

• (1)

Generate $\rho =({\rho }_{\mathrm{1}},\dots ,{\rho }_k)\leftarrow \text{PRG}(\text{s}{\text{k}}_{\text{prg}})\in Z_q^k$ and ${\omega }_j\leftarrow \text{PRF}(\text{s}{\text{k}}_{\text{prf}},{\text{id}}_j)\in Z_q$ , $j\in \mathcal{J}$ .

(2)

Compute ${\lambda }_{\mathrm{1}}={\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\mu }_{\mathcal{l}}+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_j\in Z_q$ , ${\lambda }_{\mathrm{2}}={\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\sum }_{j\in \mathcal{J}}‍{\rho }_{\mathcal{l}}{\nu }_j{f}_{\tau }(\mathcal{l},{\text{id}}_j)\in Z_q$ , and $h(W_{\mathcal{l}})$ , where $\mathcal{l}\in \{\mathrm{1},\dots ,k\}$ .

(3)

Verify the response proof by checking whether the verification equation $g^s=r{y}^{{\lambda }_{\mathrm{1}}-{\lambda }_{\mathrm{2}}}{\prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\mathcal{l}}^{-{\rho }_{\mathcal{l}}h(W_{\mathcal{l}})}\mathrm{mod}p$ holds or not.

If the verification equation $g^s=r{y}^{{\lambda }_{\mathrm{1}}-{\lambda }_{\mathrm{2}}}{\prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\mathcal{l}}^{-{\rho }_{\mathcal{l}}h(W_{\mathcal{l}})}\mathrm{mod}p$ holds, the DSN data manager can believe that the integrity of the data file stored in the cloud server is correct, it is not modified by others, and, with the random masking codes $W_{\{\mathrm{1}\le \mathcal{l}\le k\}}$ , the TPA can never recover the primitive data blocks from the DSN manager's data file.

4. Analysis of the Proposed Auditing Scheme

In this section, we begin to analyze the proposed auditing scheme, including its correctness, unforgeability, and privacy-preserving. Considering the scalability of the auditing scheme, we also extend it to support batch auditing.

4.1. Correctness

According to the ProofVerify phase of the auditing scheme, the correctness of the verification equation is elaborated as follows:

$$\begin{array}{l}{g}^s=g^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j{s}_j}=g^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j\left(r_j^{\prime }{k}_j+t_{j}x\left(\mathrm{mod}q\right)\right)}\mathrm{mod}p\\ =g^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j{r}_j^{\prime }{k}_j}{g}^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j{t}_{j}x}\mathrm{mod}p\\ ={\displaystyle \prod }_{j\in \mathcal{J}}‍r_j^{{\nu }_j{r}_j}{y}^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j{t}_j}\mathrm{mod}p\\ =r{y}^{{\sum }_{j\in \mathcal{J}}‍\left({\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{m}_{j,\mathcal{l}}+{\omega }_j\right){\nu }_j}\mathrm{mod}p\\ =r{y}^{{\sum }_{j\in \mathcal{J}}‍{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\nu }_j{m}_{j,\mathcal{l}}+{\sum }_{j\in \mathcal{J}}‍{\omega }_j{\nu }_j}\mathrm{mod}p\\ =r{y}^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\sum }_{j\in \mathcal{J}}‍{\nu }_j{m}_{j,\mathcal{l}}+{\sum }_{j\in \mathcal{J}}‍{\omega }_j{\nu }_j}\mathrm{mod}p\\ =r{y}^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}\left({\mu }_{\mathcal{l}}-{\sum }_{j\in \mathcal{J}}‍{\nu }_j{f}_{\tau }\left(\mathcal{l},{\text{id}}_j\right)-{\eta }_{\mathcal{l}}h\left(W_{\mathcal{l}}\right)\right)+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_j}\mathrm{mod}p\\ =r{y}^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\mu }_{\mathcal{l}}+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_j}\\ ·y^{-{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\sum }_{j\in \mathcal{J}}‍{\rho }_{\mathcal{l}}{\nu }_j{f}_{\tau }\left(\mathcal{l},{\text{id}}_j\right)}{y}^{-{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\eta }_{\mathcal{l}}h\left(W_{\mathcal{l}}\right)}\mathrm{mod}p\\ =r{y}^{{\lambda }_{\mathrm{1}}-{\lambda }_{\mathrm{2}}}{\displaystyle \prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\mathcal{l}}^{-{\rho }_{\mathcal{l}}h\left(W_{\mathcal{l}}\right)}\mathrm{mod}p.\end{array}$$

(1)

Thus the verification equation $g^s=r{y}^{{\lambda }_{\mathrm{1}}-{\lambda }_{\mathrm{2}}}{\prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\mathcal{l}}^{-{\rho }_{\mathcal{l}}h(W_{\mathcal{l}})}\mathrm{mod}p$ holds.

4.2. Unforgeability

Theorem 3.

With the from DSN data manager's data file $M^{\prime }$ and the corresponding signatures stored in the cloud server, a malicious cloud server is computationally infeasible to generate an invalid auditing response proof that can pass the verification equation.

In the proposed auditing scheme, we make use of homomorphic MACs to compress each data block to efficiently decrease the amount of storage space needed to store verification information. According to the discussions and proofs in [27], we know that the probability for an adversary to break one homomorphic MAC on a data block is $\mathrm{1}/q$ , which is negligible.

Besides generating a forgery of a homomorphic MAC, if the malicious cloud server can win Game 1, it can generate an invalid auditing response proof for the challenged data blocks and enable this invalid auditing response proof to successfully pass the verification. Now we describe Game 1 as follows.

Game 1. After receiving an auditing message from the DSN data manager, the TPA sends an auditing challenge message $\text{chal}=\{(j,{\nu }_j){\}}_{j\in \mathcal{J}}$ to the cloud server, and the correct auditing response proof should be $\{\mu ,r,s,W,\{{\text{id}}_j{\}}_{j\in \mathcal{J}}\}$ , where $\mu =({\mu }_{\mathrm{1}},\dots ,{\mu }_k)$ , $W=(W_{\mathrm{1}},\dots ,W_k)$ . The response proof can pass the verification equation. Now, instead of generating the correct auditing response proof, the malicious cloud server generates an invalid auditing proof as $\{{\mu }^{*},r,s,W,\{{\text{id}}_j{\}}_{j\in \mathcal{J}}\}$ based on the corrupted data file $M^{\prime *}$ , where ${\mu }^{*}=({\mu }_{\mathrm{1}}^{*},\dots ,{\mu }_k^{*})$ , ${\mu }_{\mathcal{l}}^{*}={\mu }_{\mathcal{l}}^{\prime *}+{\eta }_{\mathcal{l}}h(W_{\mathcal{l}})$ , and ${\mu }_{\mathcal{l}}^{\prime *}={\sum }_{j\in \mathcal{J}}‍{\nu }_j{m}_{j,\mathcal{l}}^{\prime *}\in Z_q$ . Define $\Delta {\mu }_{\mathcal{l}}={\mu }_{\mathcal{l}}^{*}-{\mu }_{\mathcal{l}}$ for $\mathrm{1}\le \mathcal{l}\le k$ , since $M^{\prime }\ne M^{\prime *}$ , and thus there is at least one element of $\{\Delta {\mu }_{\mathcal{l}}{\}}_{\mathrm{1}\le \mathcal{l}\le k}$ which is nonzero. If this invalid response proof can still pass the verification, the malicious cloud wins Game 1. Otherwise, it fails.

Now we begin to show that if the malicious cloud can win the above Game 1, we can find a solution to the Discrete Logarithm problem. We first assume that the malicious cloud wins Game 1. Then, according to the verification equation, we have $g^s=r{y}^{{\lambda }_{\mathrm{1}}^{*}-{\lambda }_{\mathrm{2}}}{\prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\mathcal{l}}^{-{\rho }_{\mathcal{l}}h(W_{\mathcal{l}})}\mathrm{mod}p$ , where ${\lambda }_{\mathrm{1}}^{*}={\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\mu }_{\mathcal{l}}^{*}+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_j\in Z_q$ . Since $\{\mu ,r,s,W,\{{\text{id}}_j{\}}_{j\in \mathcal{J}}\}$ is the correct auditing response proof, we also have $g^s=r{y}^{{\lambda }_{\mathrm{1}}-{\lambda }_{\mathrm{2}}}{\prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\mathcal{l}}^{-{\rho }_{\mathcal{l}}h(W_{\mathcal{l}})}\mathrm{mod}p$ . Then, according to the two verification equations, we learn that $y^{{\lambda }_{\mathrm{1}}^{*}}=y^{{\lambda }_{\mathrm{1}}}$ . Thus

$$\begin{array}{cc}& y^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\mu }_{\mathcal{l}}^{*}+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_j}=y^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\mu }_{\mathcal{l}}+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_j},\\ y^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\mu }_{\mathcal{l}}^{*}}=y^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}{\mu }_{\mathcal{l}}},\\ y^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\mathcal{l}}\Delta {\mu }_{\mathcal{l}}}={\displaystyle \prod }_{\mathcal{l}=\mathrm{1}}^k‍{\left(y^{{\rho }_{\mathcal{l}}}\right)}^{\Delta {\mu }_{\mathcal{l}}}=\mathrm{1}.\end{array}$$

(2)

Because G is a multiplicative cyclic group of order q, for two random elements $\alpha ,\beta \in G$ , there exists $\eta \in Z_q$ such that $\beta ={\alpha }^{\eta }$ . Without loss of generality, given $\alpha ,\beta \in G$ , each $y^{{\rho }_{\mathcal{l}}}$ is able to randomly and correctly be generated by computing $y^{{\rho }_{\mathcal{l}}}={\alpha }^{{\xi }_{\mathcal{l}}}{\beta }^{{\gamma }_{\mathcal{l}}}$ , where ${\xi }_{\mathcal{l}}$ and ${\gamma }_{\mathcal{l}}$ are random values in $Z_q$ . Then we get

$$\begin{array}{l}\mathrm{1}={\displaystyle \prod }_{\mathcal{l}=\mathrm{1}}^k‍{\left(y^{{\rho }_{\mathcal{l}}}\right)}^{\Delta {\mu }_{\mathcal{l}}}\\ ={\displaystyle \prod }_{\mathcal{l}=\mathrm{1}}^k‍{\left({\alpha }^{{\xi }_{\mathcal{l}}}{\beta }^{{\gamma }_{\mathcal{l}}}\right)}^{\Delta {\mu }_{\mathcal{l}}}\\ ={\alpha }^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\xi }_{\mathcal{l}}\Delta {\mu }_{\mathcal{l}}}·{\beta }^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\gamma }_{\mathcal{l}}\Delta {\mu }_{\mathcal{l}}}.\end{array}$$

(3)

Obviously, we can find a solution to the Discrete Logarithm problem. Particularly, given α, $\beta ={\alpha }^{\eta }\in G$ , we can output $\beta ={\alpha }^{\eta }={\alpha }^{-{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\xi }_{\mathcal{l}}\Delta {\mu }_{\mathcal{l}}/{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\gamma }_{\mathcal{l}}\Delta {\mu }_{\mathcal{l}}}$ ; thus $\eta =-{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\xi }_{\mathcal{l}}\Delta {\mu }_{\mathcal{l}}/{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\gamma }_{\mathcal{l}}\Delta {\mu }_{\mathcal{l}}$ , unless the denominator is zero. However, as we defined in Game 1, there is at least one element of $\{\Delta {\mu }_{\mathcal{l}}\}$ which is nonzero, and ${\gamma }_{\mathcal{l}}$ is a random element of $Z_q$ . Therefore, the denominator is zero with probability of $\mathrm{1}/q$ , which is negligible. It means that once the malicious cloud wins Game 1, we can find a solution to the Discrete Logarithm problem with a nonnegligible probability of $\mathrm{1}-\mathrm{1}/q$ , which contradicts to the assumption that Discrete Logarithm problem is computationally infeasible in G.

Moreover, if the malicious cloud server tries to forge the aggregate signature, that means the cloud server generates an invalid response proof as $\{\mu ,r^{\prime },s^{\prime },W,\{{\text{id}}_j{\}}_{j\in J}\}$ , this invalid response proof can still pass the verification equation $g^{s^{\prime }}=r^{\prime }{y}^{{\lambda }_{\mathrm{1}}-{\lambda }_{\mathrm{2}}}{\prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\mathcal{l}}^{-{\rho }_{\mathcal{l}}h(W_{\mathcal{l}})}\mathrm{mod}p$ , and the malicious cloud server can succeed. As we know that the correct auditing response proof should be $\{\mu ,r,s,W,\{\text{id}{\}}_{j\in J}\}$ , which can pass the verification equation $g^s=r{y}^{{\lambda }_{\mathrm{1}}-{\lambda }_{\mathrm{2}}}{\prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\mathcal{l}}^{-{\rho }_{\mathcal{l}}h(W_{\mathcal{l}})}\mathrm{mod}p$ , according to the two verification equations, we get that $g^{s^{\prime }-s}=r^{\prime }{r}^{-\mathrm{1}}\mathrm{mod}p$ ; thus we get $s=s^{\prime }$ and $r=r^{\prime }$ , or we can find a solution of the Discrete Logarithm problem between g and d (here we set $d=r^{\prime }{r}^{-\mathrm{1}}$ ), and these two results both contradict to our assumption.

Therefore, it is computationally infeasible for the malicious cloud to generate an invalid auditing proof, which can pass the verification equation.

4.3. Privacy-Preserving

Theorem 4.

Given an auditing response proof message $proof=\{\mu ,r,s,W,\{{id}_j{\}}_{j\in \mathcal{J}}\}$ from the cloud server, it is computationally infeasible for the curious TPA to reveal any private data block from the data file of the DSN data manager.

Proof.

If the combined message ${\mu }_{\mathcal{l}}^{\prime }={\sum }_{j\in \mathcal{J}}‍{\nu }_j{m}_{j,\mathcal{l}}^{\prime }\in Z_q$ , which is a linear combination of elements in data blocks, is directly sent to the TPA, the curious TPA can learn the content of data blocks by solving linear equations after collecting a sufficient number of linear combinations. To preserve private data blocks from the TPA, the combined message is computed with random masking as ${\mu }_{\mathcal{l}}={\mu }_{\mathcal{l}}^{\prime }+{\eta }_{\mathcal{l}}h(W_{\mathcal{l}})$ . In order to still solve linear equations, the TPA must know the value of ${\eta }_{\mathcal{l}}$ . However, given y, $W_{\mathcal{l}}=y^{{\eta }_{\mathcal{l}}}\in G$ , computing ${\eta }_{\mathcal{l}}$ is as hard as solving the Discrete Logarithm problem in G, which is computationally infeasible. Therefore, given the auditing response proof message, the TPA cannot directly obtain any linear combination of elements in data blocks and cannot further reveal any private data block from the data file by solving linear equations.

4.4. Support for Batch Auditing

With the usage of privacy-preserving auditing scheme in the cloud storage, the TPA may receive amount of multiple auditing requests from different DSN data managers in a short time. Unfortunately, allowing the TPA to execute the separate auditing task can be tedious and very inefficient. Therefore, we further extend our scheme to support batch auditing. Batch auditing not only allows the TPA to execute the multiple auditing tasks simultaneously, but also dramatically decreases the computation cost on the TPA side. This is because aggregating L verification equations into one helps save a considerable amount of auditing time. The details are described as follows.

Setup Phase. The DSN data managers just perform setup independently. Suppose there are L DSN data managers in the auditing system, and each DSN data manager θ has a data file $M_{\theta }=\{m_{\theta ,\mathrm{1}},\dots ,m_{\theta ,n}\}$ to be outsourced to the cloud server, where $m_{\theta ,j}=(m_{\theta ,j,\mathrm{1}},\dots ,m_{\theta ,j,k})$ , $j=\mathrm{1,2},\dots ,n$ . For simplicity, we assume each data file $M_{\theta }$ has the same number of  n data blocks. Particularly, for a DSN data manager θ, denote his private parameters by $(x_{\theta },\text{ss}{\text{k}}_{\theta },\text{s}{\text{k}}_{\text{pr}{\text{g}}_{\theta }},\text{s}{\text{k}}_{\text{pr}{\text{f}}_{\theta }})$ and the corresponding public parameters by $(G,g,y_{\theta },\text{sp}{\text{k}}_{\theta })$ , where $y_{\theta }=g^{x_{\theta }}$ . As it is similar to the single DSN data manager case, each DSN data manager θ has already randomly chosen a different identity ${\text{id}}_{\theta ,j}$ for the data block $m_{\theta ,j}$ and has correctly generated the corresponding data block ${\text{tag}}_{\theta ,j}={\text{id}}_{\theta ,j}\parallel \text{SSi}{\text{g}}_{\text{ss}{\text{k}}_{\theta }}({\text{id}}_{\theta ,j})$ .

Then each DSN data manager θ computes ${\rho }_{\theta }=({\rho }_{\theta ,\mathrm{1}},\dots ,{\rho }_{\theta ,k})\leftarrow \text{PRG}(\text{s}{\text{k}}_{\text{pr}{\text{g}}_{\theta }})\in Z_q^k$ and ${\omega }_{\theta ,j}\leftarrow \text{PRF}(\text{s}{\text{k}}_{\text{pr}{\text{f}}_{\theta }},{\text{id}}_{\theta ,j})\in Z_q$ . Then the DSN data manager calculates the homomorphic MAC of data block $m_{\theta ,j}=(m_{\theta ,j,\mathrm{1}},\dots ,m_{\theta ,j,k})$ as $t_{\theta ,j}={\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\theta ,\mathcal{l}}{m}_{\theta ,j,\mathcal{l}}+{\omega }_{\theta ,j}\in Z_q$ . The DSN data manager begins to compute the signature of $t_{\theta ,j}$ as follows.

• (1)

Choose $k_{\theta ,j}\leftarrow Z_q$ and compute $r_{\theta ,j}\equiv g^{k_{\theta ,j}}\mathrm{mod}p$ and $r_{\theta ,j}^{\prime }\equiv r_{\theta ,j}\mathrm{mod}q$ ;

(2)

$s_{\theta ,j}=(r_{\theta ,j}^{\prime }{k}_{\theta ,j}+t_{\theta ,j}x)\mathrm{mod}q$ ,

(3)

output ${\sigma }_{\theta ,j}=(r_{\theta ,j},s_{\theta ,j})$ as the signature of $t_{\theta ,j}$ .

Denote the set of signatures by ${\Phi }_{\theta }=\{{\sigma }_{\theta ,j}{\}}_{\mathrm{1}\le j\le n}$ . Meanwhile, to guarantee the confidentiality of the data file, the DSN data manager employs the lightweight symmetry encryption algorithm f to encrypt each data block $m_{\theta ,j}=(m_{\theta ,j,\mathrm{1}},\dots ,m_{\theta ,j,k})$ as $m_{\theta ,j}^{\prime }=(m_{\theta ,j,\mathrm{1}}+f_{{\tau }_{\theta }}(\mathrm{1},{\text{id}}_{\theta ,j}),\dots ,m_{\theta ,j,\text{k}}+f_{{\tau }_{\theta }}(k,{\text{id}}_{\theta ,j}))$ under the symmetry private key ${\tau }_{\theta }$ . Thus, the data file $M_{\theta }=(m_{\theta ,\mathrm{1}},\dots ,m_{\theta ,n})$ is encrypted to be $M_{\theta }^{\prime }=(m_{\theta ,\mathrm{1}}^{\prime },\dots ,m_{\theta ,n}^{\prime })$ . Finally, the DSN data manager θ sends $\{M_{\theta }^{\prime },\{{\text{tag}}_{\theta ,j}{\}}_{\mathrm{1}\le j\le n},{\Phi }_{\theta }\}$ to the cloud server and deletes them from local storage.

Audit Phase. The TPA first retrieves and verifies the data block ${\text{tag}}_{\theta ,j}$ for each DSN data manager θ for later auditing. If the verification fails, the TPA aborts. Otherwise, the TPA recovers ${\text{id}}_{j,\theta }$ and sends the auditing challenge message $\text{chal}=\{(j,{\nu }_j){\}}_{j\in \mathcal{J}}$ to the cloud server. Meanwhile, for each DSN data manager θ, the cloud server chooses ${\eta }_{\theta ,\mathcal{l}}\in Z_q$ randomly as before and computes $W_{\theta ,\mathcal{l}}=y_{\theta }^{{\eta }_{\theta ,\mathcal{l}}}$ and ${\mu }_{\theta ,\mathcal{l}}={\sum }_{j\in \mathcal{J}}‍{\nu }_j{m}_{\theta ,j,\mathcal{l}}^{\prime }+{\eta }_{\theta ,\mathcal{l}}h(W_{\theta ,\mathcal{l}})$ ; thus, the cloud server can compute ${\mu }_{\theta }=({\mu }_{\theta ,\mathrm{1}},\dots ,{\mu }_{\theta ,\mathcal{l}},\dots ,{\mu }_{\theta ,k})$ . Then the cloud server makes the aggregation as $r={\Pi }_{\theta =\mathrm{1}}^L{\Pi }_{j\in \mathcal{J}}{r}_{\theta ,j}^{{\nu }_j{r}_{\theta ,j}}\mathrm{mod}p$ and $s={\Sigma }_{\theta =\mathrm{1}}^L{\Sigma }_{j\in \mathcal{J}}{\nu }_j{s}_{\theta ,j}\mathrm{mod}q$ . Finally, the cloud server responses with $(\{{\mu }_{\theta }{\}}_{\mathrm{1}\le \theta \le L},r,s,\{W_{\theta }{\}}_{\mathrm{1}\le \theta \le L},\{{\text{id}}_{\theta ,j}{\}}_{j\in \mathcal{J},\mathrm{1}\le \theta \le L})$ , where $W_{\theta }=(W_{\theta ,\mathrm{1}},\dots ,W_{\theta ,\mathcal{l}},\dots ,W_{\theta ,k})$ .

To verify the response, the TPA first does as follows.

• (1)

Generate ${\rho }_{\theta }=({\rho }_{\theta ,\mathrm{1}},\dots ,{\rho }_{\theta ,k})\leftarrow \text{PRG}(\text{s}{\text{k}}_{\text{pr}{\text{g}}_{\theta }})\in Z_q^k$ and ${\omega }_{\theta ,j}\leftarrow \text{PRF}(\text{s}{\text{k}}_{\text{pr}{\text{f}}_{\theta }},{\text{id}}_{\theta ,j})\in Z_q$ , $j\in \mathcal{J}$ .

(2)

Compute ${\lambda }_{\theta ,\mathrm{1}}={\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\theta ,\mathcal{l}}{\mu }_{\theta ,\mathcal{l}}+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_{\theta ,j}\in Z_q$ , ${\lambda }_{\theta ,\mathrm{2}}={\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\sum }_{j\in \mathcal{J}}‍{\rho }_{\theta ,\mathcal{l}}{\nu }_j{f}_{{\tau }_{\theta }}(\mathcal{l},i{d}_{\theta ,j})\in Z_q$ , and $h(W_{\theta ,\mathcal{l}})$ , where $\mathrm{1}\le \mathcal{l}\le k$ and $\mathrm{1}\le \theta \le L$ .

Then the TPA checks if the following verification equation holds: $g^s=r{\prod }_{\theta =\mathrm{1}}^L‍y_{\theta }^{{\lambda }_{\theta ,\mathrm{1}}-{\lambda }_{\theta ,\mathrm{2}}}({\prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\theta ,\mathcal{l}}^{-{\rho }_{\theta ,\mathcal{l}}h(W_{\theta ,\mathcal{l}})})\mathrm{mod}p$ . The correctness of the verification equation can be shown as follows:

$$\begin{array}{ll}\text{(4)}& g^s=g^{{\Sigma }_{\theta =\mathrm{1}}^L{\Sigma }_{j\in \mathcal{J}}{\nu }_j{s}_{\theta ,j}}\mathrm{mod}p\\ ={\displaystyle \prod }_{\theta =\mathrm{1}}^L‍g^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j{s}_{\theta ,j}}\mathrm{mod}p\\ ={\displaystyle \prod }_{\theta =\mathrm{1}}^L‍g^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j\left(r_{\theta ,j}^{\prime }{k}_{\theta ,j}+t_{\theta ,j}{x}_{\theta }\left(\mathrm{mod}q\right)\right)}\mathrm{mod}p\\ ={\displaystyle \prod }_{\theta =\mathrm{1}}^L‍g^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j{r}_{\theta ,j}^{\prime }{k}_{\theta ,j}}{g}^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j{t}_{\theta ,j}{x}_{\theta }}\mathrm{mod}p\\ ={\displaystyle \prod }_{\theta =\mathrm{1}}^L‍{\displaystyle \prod }_{j\in \mathcal{J}}‍r_{\theta ,j}^{{\nu }_j{r}_{\theta ,j}}{y}_{\theta }^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j{t}_{\theta ,j}}\mathrm{mod}p\\ =r{\displaystyle \prod }_{\theta =\mathrm{1}}^L‍y_{\theta }^{{\sum }_{j\in \mathcal{J}}‍{\nu }_j\left({\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\theta ,\mathcal{l}}{m}_{\theta ,j,\mathcal{l}}+{\omega }_{\theta ,j}\right)}\mathrm{mod}p\\ =r{\displaystyle \prod }_{\theta =\mathrm{1}}^L‍y_{\theta }^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\theta ,\mathcal{l}}{\sum }_{j\in \mathcal{J}}‍{\nu }_j{m}_{\theta ,j,\mathcal{l}}+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_{\theta ,j}}\mathrm{mod}p\\ =r{\displaystyle \prod }_{\theta =\mathrm{1}}^L‍y_{\theta }^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\theta ,\mathcal{l}}\left({\mu }_{\theta ,\mathcal{l}}-{\sum }_{j\in \mathcal{J}}‍{\nu }_j{f}_{{\tau }_{\theta }}\left(\mathcal{l},{\text{id}}_{\theta ,j}\right)-{\eta }_{\theta ,\mathcal{l}}h\left(W_{\theta ,\mathcal{l}}\right)\right)+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_{\theta ,j}}\mathrm{mod}p\\ =r{\displaystyle \prod }_{\theta =\mathrm{1}}^L‍y_{\theta }^{{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\theta ,\mathcal{l}}{\mu }_{\theta ,\mathcal{l}}+{\sum }_{j\in \mathcal{J}}‍{\nu }_j{\omega }_{\theta ,j}-{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\sum }_{j\in \mathcal{J}}‍{\rho }_{\theta ,\mathcal{l}}{\nu }_j{f}_{{\tau }_{\theta }}\left(\mathcal{l},{\text{id}}_{\theta ,j}\right)-{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\theta ,\mathcal{l}}{\eta }_{\theta ,\mathcal{l}}h\left(W_{\theta ,\mathcal{l}}\right)}\mathrm{mod}p\\ =r{\displaystyle \prod }_{\theta =\mathrm{1}}^L‍y_{\theta }^{{\lambda }_{\theta ,\mathrm{1}}-{\lambda }_{\theta ,\mathrm{2}}}{y}_{\theta }^{-{\sum }_{\mathcal{l}=\mathrm{1}}^k‍{\rho }_{\theta ,\mathcal{l}}{\eta }_{\theta ,\mathcal{l}}h\left(W_{\theta ,\mathcal{l}}\right)}\mathrm{mod}p\\ =r{\displaystyle \prod }_{\theta =\mathrm{1}}^L‍y_{\theta }^{{\lambda }_{\theta ,\mathrm{1}}-{\lambda }_{\theta ,\mathrm{2}}}\left({\displaystyle \prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\theta ,\mathcal{l}}^{-{\rho }_{\theta ,\mathcal{l}}h\left(W_{\theta ,\mathcal{l}}\right)}\right)\mathrm{mod}p.\end{array}$$

(4)

Thus the verification equation $g^s=r{\prod }_{\theta =\mathrm{1}}^L‍y_{\theta }^{{\lambda }_{\theta ,\mathrm{1}}-{\lambda }_{\theta ,\mathrm{2}}}({\prod }_{\mathcal{l}=\mathrm{1}}^k‍W_{\theta ,\mathcal{l}}^{-{\rho }_{\theta ,\mathcal{l}}h(W_{\theta ,\mathcal{l}})})\mathrm{mod}p$ holds.

5. Performance Comparison

In this section, we begin to compare the performance of our privacy-preserving auditing scheme for cloud storage with the auditing scheme in [26]. We first focus on discussing the computation cost and the communication cost. Then we evaluate the performance comparison between the two schemes in experiments to show our auditing scheme advantages.

5.1. Computation Cost

We first give the computation cost of our pairing-free auditing scheme for cloud storage with the auditing scheme in [26]. The main cryptographic operations used in our scheme include multiplications, additions, and hash operations. For simplicity, we omit the computation cost of the pseudorandom number generator $\text{PRG}$ and pseudorandom function $\text{PRF}$ because they are much easier to be computed than the three types of operations mentioned above. Here, we denote ${\text{Mult}}_G$ , ${\text{Add}}_G$ , and ${\text{Exp}}_G$ by multiplication, addition, and modular exponentiation operation in group G, respectively; we also denote ${\text{Hash}}_G$ by hash operation into the group G, and we denote ${\text{pair}}_{G_{\mathrm{1}},G_{\mathrm{2}}}$ by pairing operation.

During the auditing process, the TPA first generates some random values to construct the auditing message, which only introduces a small cost in computation. Then, after receiving the auditing message, the cloud server needs to compute a proof $\{\mu ,r,s,W,\{{\text{id}}_j{\}}_{j\in \mathcal{J}}\}$ to the TPA for auditing, where $\mu =({\mu }_{\mathrm{1}},\dots ,{\mu }_k)$ and $W=(W_{\mathrm{1}},\dots ,W_k)$ . The computation cost of a proof is about $(kc+\mathrm{2}c+k){\text{Mult}}_{Z_p}+c{\text{Mult}}_{Z_q}+kc{\text{Add}}_{Z_p}+(c-\mathrm{1}){\text{Add}}_{Z_q}+k{\text{Exp}}_{Z_p}+k{\text{Hash}}_{Z_p}$ , while the computation cost of a proof in [26] is about $(c-\mathrm{1}){\text{Mult}}_{G_{\mathrm{1}}}+(c+\mathrm{1}){\text{Mult}}_{Z_p}+c{\text{Exp}}_{G_{\mathrm{1}}}+{\text{Exp}}_{G_T}+c{\text{Add}}_{Z_p}+{\text{Hash}}_{Z_p}$ .

To check the correctness of the proof, the TPA verifies it based on verification equation and the computation cost of verifying the auditing proof is $(\mathrm{2}k+c+\mathrm{2}ck){\text{Mult}}_{Z_q}+k{\text{Mult}}_{Z_p}+(k+\mathrm{2}){\text{Exp}}_{Z_p}+(ck+c+k-\mathrm{2}){\text{Add}}_{Z_q}+\mathrm{2}k{\text{Hash}}_{Z_q}+c{\text{Enc}}_{\varepsilon }$ , while the computation cost of verifying the auditing proof in [26] is $(c+\mathrm{1}){\text{Mult}}_{G_{\mathrm{1}}}+{\text{Mult}}_{G_T}+(c+\mathrm{3}){\text{Exp}}_{G_{\mathrm{1}}}+\mathrm{2}{\text{Pair}}_{G_{\mathrm{1}},G_{\mathrm{2}}}+{\text{Hash}}_{Z_p}+c{\text{Hash}}_{G_{\mathrm{1}}}$ .

5.2. Communication Cost

The communication cost of our scheme is mainly introduced by two factors: the auditing message and the auditing proof. For the auditing message $\text{chal}=\{(j,{\nu }_j){\}}_{j\in \mathcal{J}}$ , the auditing proof information generated by the cloud server is $\{\mu ,r,s,W,\{{\text{id}}_j{\}}_{j\in \mathcal{J}}\}$ , where $\mu =({\mu }_{\mathrm{1}},\dots ,{\mu }_k)$ and $W=(W_{\mathrm{1}},\dots ,W_k)$ ; thus the total communication cost of our auditing scheme is $\left(c+k+\mathrm{1}\right)\left|q\right|+c\left|n\right|+(k+\mathrm{1})\left|p\right|$ , while the total communication cost of the auditing scheme in [26] is $c(|p|+|n|)+\left|p\right|+\left|G_{\mathrm{1}}\right|+\left|G_T\right|+\left|\text{id}\right|$ , where $\left|n\right|$ is the length of an index and $\left|G_T\right|$ is the length of an element of $G_T$ . Moreover, the communication overhead of $\left|G_{\mathrm{1}}\right|$ and $\left|G_T\right|$ in [26] is much larger than others; therefore our auditing scheme is more light-weight than [26] in communication cost.

5.3. Experimental Results

We now compare the cloud server computation cost and the TPA auditing computational cost of our auditing scheme with the work of [26] in experiments. Since the random mask needs one exponentiation operation, one multiplication operation, one hash and one addition operation, so the sum of the extra cost that resulted from the random mask only needs a constant, ${\text{Exp}}_{G_T}+{\text{Mult}}_{Z_p}+{\text{Hash}}_{Z_p}+{\text{Add}}_{Z_p}$ , which has nothing to do with the number of sampled blocks c. When c is set to be $\mathrm{400}$ to $\mathrm{600}$ for high assurance of auditing, the extra cost on the cloud server side for privacy-preserving guarantee would be negligible against the total server computation for response generation. Therefore, the main computation cost of the cloud server in [26] is $(c-\mathrm{1}){\text{Mult}}_{G_{\mathrm{1}}}+c{\text{Mult}}_{Z_p}+c{\text{Exp}}_{G_{\mathrm{1}}}+(c-\mathrm{1}){\text{Add}}_{Z_p}$ in our experiments. However, in our auditing scheme, the extra cost resulting from the random masking is only a small constant: $k({\text{Exp}}_{Z_p}+{\text{Mult}}_{Z_p}+{\text{Hash}}_{Z_q}+{\text{Add}}_{Z_q})$ , where k is much less than the practical challenge number of the data blocks. Here we can omit the computation cost $k({\text{Mult}}_{Z_p}+{\text{Hash}}_{Z_q}+{\text{Add}}_{Z_q})$ . Therefore, in our experiments we set the main cloud server computation cost to be $(kc+\mathrm{2}c){\text{Mult}}_{Z_p}+c{\text{Mult}}_{Z_q}+(kc-k){\text{Add}}_{Z_p}+(c-\mathrm{1}){\text{Add}}_{Z_q}+k{\text{Exp}}_{Z_p}$ .

As also discussed in [26], the extra cost resulting from the random masking is only a constant: ${\text{Mult}}_{G_T}+\mathrm{2}{\text{Exp}}_{G_{\mathrm{1}}}+{\text{Hash}}_{Z_p}$ , which has nothing to do with the number of sampled blocks c. As considering the relatively expensive pairing operations, the extra cost for privacy-preserving guarantee would be also negligible against the overall cost of response validation. Therefore, here we set the main auditing computation cost of the TPA to be $c{\text{Mult}}_{G_{\mathrm{1}}}+(c+\mathrm{1}){\text{Exp}}_{G_{\mathrm{1}}}+\mathrm{2}{\text{Pair}}_{G_{\mathrm{1}},G_{\mathrm{2}}}+c{\text{Hash}}_{G_{\mathrm{1}}}$ in our experiments. However, in our auditing scheme, the extra cost resulting from the random masking is $k({\text{Mult}}_{Z_p}+{\text{Mult}}_{Z_q}+{\text{Hash}}_{Z_q}+{\text{Exp}}_{Z_p})$ , where k is much less than the practical challenge number of the data blocks. Since the modular exponentiation operation is much larger than others, here we can omit the computation cost $k({\text{Mult}}_{Z_p}+{\text{Mult}}_{Z_q}+{\text{Hash}}_{Z_q})$ . For consistence, we also set the main auditing computation cost of the TPA to be $(k+c+\mathrm{2}ck){\text{Mult}}_{Z_q}+(k+\mathrm{2}){\text{Exp}}_{Z_p}+(ck+c+k-\mathrm{2}){\text{Add}}_{Z_q}+k{\text{Hash}}_{Z_q}+c{\text{Enc}}_{\varepsilon }$ .

Our experiments are implemented on a Windows 7 system with an Intel Core 2 i5 CPU running at 2.53 GHz, 2 GB DDR 3 of RAM (1.74 GB available). All algorithms are implemented by C language, and our code uses the MIRACL library version 5.6.1. The elliptic curve we use is a MNT curve, the base field size is 159 bits, and the embedding degree is 6. The security level is chosen to be 80 bit, and $\left|p\right|=\left|q\right|=\mathrm{160}$ . For simplicity, we also set $k=\mathrm{20}$ . All the results of experiments are represented as the average of 30 trials.

As described in Figures 2 and 3, the experimental results show that, compared with the auditing scheme in [26], the computation cost of the cloud server and the TPA auditing time of our auditing scheme are much more light-weight than [26]. More specifically, with the increasing of the number of challenge data blocks, our auditing scheme is more advantageous than [26] in computation cost. This is mainly because the auditing scheme in [26] needs very expensive pairing computation which is much more time-consuming.

Figure 2

Comparison on the computation cost of cloud server.

Figure 3

Comparison on the auditing time between our scheme and the scheme in [26].

6. Conclusions

Data outsourcing, one of the fundamental components of cloud computing, centralizes DSN data manager's data to the cloud server and enables the DSN data managers to enjoy high quality service. However, the DSN data managers do not have physical possession on their own data; hence it is indispensable to create schemes on how to protect the security of the data, unlike the previous auditing schemes [26] which need expensive pairing operations. In this paper, we propose a pairing-free privacy-preserving auditing scheme for data storage security in distributed sensor networks. We employ the homomorphic linear authenticator and random masking to guarantee that the TPA would not only eliminate the burden of the DSN data managers from the tedious and possible expensive auditing task, but also alleviate the DSN data managers’ fear of their outsourced data leakage. We also utilize homomorphic MACs to effectively reduce the amount of storage space needed to store verification information. Moreover, we further extend our auditing scheme to support batch auditing for multiple DSN data managers, where the TPA can perform multiple auditing tasks simultaneously. Extensive security and performance compared analysis shows that the proposed auditing scheme is more light-weight and more practical in distributed sensor networks environments.