A Secure Certificate-Based Data Integrity Auditing Protocol with Cloud Service Providers

Abstract

With the surge in cloud storage popularity, more individuals are choosing to store large amounts of data on remote cloud service providers (CSPs) to save local storage resources. However, users’ primary worries revolve around maintaining data integrity and authenticity. Consequently, several cloud auditing methods have emerged to address these concerns. Many of these approaches rely on traditional public-key cryptography systems or are grounded in identity-based cryptography systems or certificateless cryptography systems. However, they are vulnerable to the increased costs linked with certificate management, key escrow, or the significant expenses of establishing a secure channel, respectively. To counter these limitations, Li et al. introduced a certificate-based cloud auditing protocol (LZ22), notable for its minimal tag generation overhead. Nonetheless, this protocol exhibits certain security vulnerabilities. In this paper, we devise a counterfeiting technique that allows the CSP to produce a counterfeit data block with an identical tag to the original one. Our counterfeiting method boasts a 100% success rate ∀ data block and operates with exceptional efficiency. The counterfeiting process for a single block of 10 kB, 50 kB, and 100 kB takes a maximum of 0.08 s, 0.51 s, and 1.04 s, respectively. By substituting the exponential component of homomorphic verifiable tags (HVTs) with non-public random elements, we formulate a secure certificate-based cloud auditing protocol. In comparison to the LZ22 protocol, the average tag generation overhead of our proposed protocol is reduced by 6.80%, 13.78%, and 8.66% for data sizes of 10 kB, 50 kB, and 100 kB, respectively. However, the auditing overhead of our proposed protocol shows an increase. The average overhead rises by 3.05%, 0.17%, and 0.45% over the LZ22 protocol’s overhead for data sizes of 10 kB, 50 kB, and 100 kB, correspondingly.

1. Introduction

In recent times, as wireless sensor technology advances continuously, the integration of wireless sensor technique with implantable medical electronic devices has progressively supplanted traditional portable medical devices as a focal point in global medical research and development [1]. In contrast to conventional portable medical electronic devices, implantable medical devices exhibit greater flexibility and convenience in appearance and usage. They can provide real-time health monitoring and even predict diseases. Implantable medical devices necessitate a simple chip implantation procedure within the body. Whether it involves monitoring diverse health metrics or restoring bodily functions, implantable chips offer enhanced ease, speed, accuracy, and cost efficiency. The utilization of implantable medical sensors enables users to monitor their health anytime, anywhere, thereby enhancing the efficient allocation of hospital resources to some extent.

Nevertheless, the escalating volume of health monitoring data poses challenges in terms of data storage, potentially reducing the efficiency of medical sensors. This challenge can be mitigated by cloud service providers (CSPs) equipped with robust computational capabilities and ample storage resources. The operational framework of a typical medical sensor network is depicted in Figure 1. Initially, medical sensors gather health data from users regularly, which are then transmitted via the Internet to the CSP through associated mobile Portable Personal Terminals (e.g., smartphones, smart wristbands). Subsequently, the Health Center can analyze these health data and provide feedback to users, while hospitals can leverage the monitoring data within the CSP to gain precise insights into a patient’s condition and upload diagnosis outcomes to the CSP.

However, as concerns about privacy protection continue to grow, two major issues have arisen regarding the choice of CSPs for data storage outsourcing. One concern relates to potential data leakage by the CSP, while the other focuses on ensuring the integrity of data stored within the CSP. Consequently, safeguarding the privacy and integrity of health data within CSPs is crucial for users. Data encryption technology is widely recognized as a pivotal tool for preserving data privacy, involving the encryption of data locally before transferring it to the CSP. Furthermore, data auditing techniques play a crucial role in verifying the integrity of data stored within a CSP. This method entails issuing an audit challenge to the CSP to evaluate its ability to accurately respond to the challenge, thereby ensuring data integrity.

Therefore, the data storage outsourcing capability provided by CSPs effectively addresses the challenge of overloaded local storage for wireless sensors. By utilizing outsourced storage integrated with data encryption and auditing technologies, users can ensure the privacy and integrity of their data.

1.1. Related Works

With the swift progress in wireless communication technology, wireless sensor technology has become a focal point of investigation. The small size, minimal energy consumption, and scalability of wireless sensors have established them as the preferred option for IoT applications, such as electronic medical health monitoring. Due to the limited computing and storage capacities of wireless sensors, they frequently collaborate with CSPs to securely store encrypted data in the cloud. As a result, the attention on ensuring data integrity within CSPs has significantly increased in recent years in the domain of outsourced storage security protection research.

Homomorphic encryption [2,3,4,5] enables cryptographic computing, providing secure calculations with guaranteed confidentiality, making it a significant research focus in cloud computing. However, homomorphic encryption does not ensure the integrity of the calculation process.

Some data integrity-checking protocols were proposed between 2004 and 2006 [6,7,8]. However, all of these protocols required downloading the complete data file to check the integrity of the data. This took up a lot of communication overhead, which was not practical in the era of big data with huge data volumes.

The initial introduction of the Provable Data Possession (PDP) model by Ateniese et al. in 2007 [9] marked a significant milestone. This model utilized homomorphic verifiable tags (HVTs) and random sampling methods to empower users to authenticate remote data integrity with a high level of certainty. However, the computational and storage resources demanded by the protocol were substantial due to the homomorphic nature of the RSA cryptosystem on which the HVTs were founded. In 2008, Shacham et al. led the way in integrating a third-party auditor (TPA) into the model for validating remote data integrity [10]. By delegating the verification to a TPA, the protocol alleviated the verification burden on users. By employing BLS signatures [11] to create HVTs, this protocol generated shorter tags compared to the method proposed by [9]. Nonetheless, the length of these HVTs still exceeded that of the data block itself, resulting in a storage overhead for the CSP that surpassed that of the data block.

Subsequently, in order to cater to diverse user needs and reduce the computational and storage overhead of the protocol, scholars developed a range of third-party cloud auditing protocols based on various cryptographic systems. Initially, numerous researchers devised third-party cloud auditing protocols [9,10,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26] grounded in the Public Key Infrastructure (PKI) cryptosystem [27]. While PKI-based protocols are widely used, the substantial certificate management burden associated with them cannot be ignored. To tackle this challenge, other researchers suggested protocols [28,29,30,31,32,33,34,35,36,37,38,39,40,41] based on the identity (ID) cryptosystem [42]. In the ID cryptosystem, the Private Key Generator (PKG) only needs to generate and retain the private key $sk$ corresponding to the user’s $ID$, leading to reduced storage overhead compared to the PKI-based protocols. However, the susceptibility of PKG to hacking and private key theft poses a challenge, rendering ID-based auditing protocols vulnerable to private key escrow attacks. To streamline key management and mitigate key escrow vulnerabilities, researchers have also proposed cloud auditing protocols [43,44,45,46,47,48] based on the certificateless cryptosystem [49]. These protocols prevent the exposure of the private key by distributing the key generation process between the Key Generation Center (KGC) and the user, thereby addressing the key escrow issue. However, establishing a trusted channel for transmitting part of the private key between KGC and users presents a communication overhead challenge in the certificateless cryptosystem.

To resolve the issue of communication overhead in certificate-less cryptosystems, Gentry introduced the certificate-based cryptosystem in 2003 [50]. The certificate-based cryptosystem eliminated the necessity to establish a trusted channel for each user; the certificate distribution could occur in the open channel, reducing the communication overhead resulting from establishing a trusted channel. Building upon the certificate-based cryptosystem, Ref. [51] devised an efficient third-party cloud auditing protocol. This protocol reduced the computational cost on both the user and the TPA sides compared to the aforementioned protocols by cleverly constructing the HVTs. Nonetheless, this protocol did raise some security concerns.

1.2. Our Contributions

In this paper, we design a third-party cloud auditing protocol that leveraged secure certificates to address the susceptibility of encrypted data blocks to forgery within the LZ22 protocol [51]. Our contributions are detailed below.

To begin, we devise a method for generating forged data blocks with identical tags to the original ones. This technique is capable of forging lost data blocks, enabling the successful completion of TPA challenges in cases where the user’s data block is missing due to CSP errors. Our forgery approach boasts a 100% success rate ∀ data block. Furthermore, we conduct simulation experiments to evaluate the computational overhead associated with forgery for data sizes of 10 kB, 50 kB, and 100 kB. The results demonstrate that the computational overhead for forgery is remarkably minimal, with a maximum forging time of 1.04 s per data block.

Subsequently, we develop a robust certificate-based data integrity auditing protocol to resolve the security issues present in the LZ22 protocol. By reconfiguring the homomorphic verifiable tags (HVTs) and integrating these enhanced HVTs into our cloud auditing protocols, we enhance the security of our protocol significantly. A comprehensive overview of our protocol is provided, along with an in-depth analysis of its correctness and security aspects.

Lastly, we validate the practicality and efficiency of our protocol through experimental assessments. By simulating the time overhead of Tag Generation and Auditing for various auditing protocols, including the latest PKI auditing protocol [26], ID-based auditing protocol [30], certificateless auditing protocol [46], certificate-based auditing protocol [51], and our auditing protocol, we demonstrate the superior efficiency of our protocol in Tag Generation compared to the other protocols. Additionally, our auditing efficiency matches that of the auditing protocol proposed by [51], ensuring a high level of security while maintaining operational efficiency.

1.3. Outline of the Article

The overall structure of the remaining sections in this article is outlined as follows. In Section 2, we present pertinent background information regarding the Certificate-Based Data Integrity Auditing Protocol (CBDIAP). Subsequently, in Section 3, we delve into the security vulnerabilities of the LZ22 protocol and put forth a potential forgery attack strategy. Moving on to Section 4, we introduce and scrutinize the protocol proposed in this paper, conducting both correctness and security analyses. Subsequently, in Section 5, we evaluate the overhead associated with Tag Generation and Auditing for the proposed protocol through theoretical and experimental assessments. Finally, we encapsulate the key findings and delineate future research avenues in Section 6.

2. Preliminaries

In this section, we introduce some basic knowledge, including symmetric bilinear mapping, security assumptions, and the formal definition of the CBDIAP. The details are as follows.

2.1. Symmetric Bilinear Mapping

The concept of symmetric bilinear mapping was first introduced by John Milnor, and Dale Husemoller et al. in 1973 in their published book Symmetric Bilinear Forms [52]. The details are as follows.

Choose two cyclic groups ${\mathbb{G}}_1,{\mathbb{G}}_T$. Suppose $order\left({\mathbb{G}}_1\right)=order\left({\mathbb{G}}_T\right)=p\left(pisprime\right)$, and there exists a mapping $\widehat{e}:{\mathbb{G}}_1\times {\mathbb{G}}_1\to {\mathbb{G}}_T$ satisfying the following properties:

• Bilinear: $\forall a,b\in {\mathbb{Z}}_p,g\in {\mathbb{G}}_1$, such that $\widehat{e}\left(g^a,g^b\right)=\widehat{e}{\left(g,g\right)}^{ab}$.
• Nondegeneracy: if g is the generator of ${\mathbb{G}}_1$, such that $\widehat{e}\left(g,g\right)\ne 1_{{\mathbb{G}}_T}$($1_{{\mathbb{G}}_T}$ is the identity element in the group ${\mathbb{G}}_T$) is the generator of ${\mathbb{G}}_T$.
• Computability: $\forall g_1,g_2\in {\mathbb{G}}_1$, such that $\widehat{e}\left(g_1,g_2\right)$ can be calculated efficiently.

2.2. Security Assumptions

Definition 1

(k-Collusion Attack Algorithm Problem (k-CAA) Assumption [53]). In a cyclic group $\mathbb{G}$ with order p where p is prime, ∀$x,h_1,\dots ,h_k\in {\mathbb{Z}}_p^{*}$ and $g\in \mathbb{G}$, given $g,g^x$ and pairs $\left(h_1,g^{\frac{1}{x+h_1}}\right),\dots ,\left(h_k,g^{\frac{1}{x+h_k}}\right)$, the task is to output a new pair $\left(h^{*},g^{\frac{1}{x+h^{*}}}\right)$ where $h^{*}\notin \left\{h_1,\dots ,h_k\right\}$. The k-CAA assumption is deemed valid under $\left(t,\epsilon \right)$ if there exists no probabilistic polynomial time (PPT) algorithm that can generate $\left(h^{*},g^{\frac{1}{x+h^{*}}}\right)$ in $\mathbb{G}$ with a success rate of at least ε.

Definition 2

(Weak k-CAA Problem Assumption [54]). In a cyclic group $\mathbb{G}$ with order p where p is prime, ∀$x,a,b,h_1,\dots ,h_k\in {\mathbb{Z}}_p^{*}$ and $g\in \mathbb{G}$, given $g,g^x,g^a,g^b$, and pairs $\left(h_1,g^{\frac{ab}{x+h_1}}\right),\dots ,\left(h_k,g^{\frac{ab}{x+h_k}}\right)$, the objective is to output a new pair $\left(h^{*},g^{\frac{ab}{x+h^{*}}}\right)$ or solve $g^{ab}$ where $h^{*}\notin \left\{h_1,\dots ,h_k\right\}$. The weak k-CAA assumption is considered valid under $\left(t,\epsilon \right)$ if there exists no PPT algorithm that can generate $\left(h^{*},g^{\frac{ab}{x+h^{*}}}\right)$ or solve $g^{ab}$ in $\mathbb{G}$ with a success rate of at least ε.

Definition 3

(Computational Diffie–Hellman Problem (CDH) Assumption [11]). In a cyclic group $\mathbb{G}$ with order p where p is prime, ∀$a,b\in {\mathbb{Z}}_p^{*}$ and $g\in \mathbb{G}$, given $g,g^a,g^b$, the aim is to solve $g^{ab}$. The CDH assumption is considered valid under $\left(t,\epsilon \right)$ if there exists no PPT algorithm that can solve $g^{ab}$ in $\mathbb{G}$ with a success rate of at least ε.

2.3. The Formal Definition of the CBDIAP

The CBDIAP is a third-party data integrity auditing protocol that relies on certificate-based cryptographic systems. The protocol involves three key entities: the CSP, TPA, and user, each with distinct responsibilities. The CSP is tasked with system initialization, user certificate distribution, and encrypted data block storage. On the other hand, the TPA’s role is to audit the CSP to guarantee the integrity of the data stored within it. The formal specification of this protocol can be found in Definition 4.

Definition 4.

The CBDIAP consists of four PPT algorithms [51]:

1. 

System setup $\left({\mathbf{1}}^{\lambda }\right)\to \left(\mathit{msk},\mathit{pp}\right):$ with input security parameter λ, CSP initializes the data integrity auditing system to generate the system master private key $msk$ and broadcast the system parameters $pp$.

2. 

User registration $\left(\mathit{ID},{\mathit{upk}}_{\mathit{ID}}\right)\to \left({\mathit{Cert}}_{\mathit{ID}}\right):$ The user sends their $ID$ and public key $up{k}_{ID}$ to the CSP. Then, the CSP returns a valid certificate $Cer{t}_{ID}$ to the user.

3. 

Outsourcing storage $\left(\mathit{F}={\left\{{\mathit{m}}_{\mathit{i}}\right\}}_{\mathit{i}=\mathbf{1}}^{\mathit{m}},\mathit{ds},\mathit{t}\right)\to \left(\tau ,{\left\{{\sigma }_{\mathit{i}}\right\}}_{\mathit{i}=\mathbf{1}}^{\mathit{m}}\right):$ Given an encrypted dataset $F={\left\{m_i\right\}}_{i=1}^m$ named $ds$, timestamp t, the user uploads the encrypted dataset $F={\left\{{\mathit{m}}_i\right\}}_{i=1}^m$, the dataset label τ, and the data block tags ${\left\{{\sigma }_i\right\}}_{i=1}^m$ to the CSP.

4. 

Auditing $\left(\mathit{ID},\mathit{ds},\mathit{chal}\right)\to$(0/1): The TPA sends the user’s $ID$, $ds$, and the audit challenge $chal$ to the CSP. The CSP generates a Data Integrity Proof $PF$ to be returned to the TPA. The TPA output is one, which proves that the data are intact on the CSP, or, conversely, outputs zero.

2.3.1. Correctness

Definition 5.

If the CBDIAP is correct, the following conditions need to be met [51]:

1. 

For the certificate $Cer{t}_{ID}$ returned by the CSP, the user must verify that the certificate $Cer{t}_{ID}$ sent by the CSP matches his or her own $ID$ and $up{k}_{ID}$ to check whether the certificate is valid.

2. 

$\forall ID\in {\left\{0,1\right\}}^{*},ds,chal\in \left\{\left(i,c_i\right):i\in I\right\}$, if the CSP received $\left(ID,ds,chal\right)$ from the TPA, the CSP can generate $PF$. Then, the CSP sends PF to the TPA. Finally, the TPA checks whether the $PF$ matches the dataset label τ and checks whether the $PF$ is evidence of the dataset $ds$.

3. 

For ${\left\{{\sigma }_{\mathit{i}}\right\}}_{\mathit{i}=\mathbf{1}}^{\mathit{m}}$, the TPA checks the integrity of the data in the CSP by testing whether ${\left\{{\mathit{m}}_i\right\}}_{i=1}^m$ and ${\left\{{\sigma }_i\right\}}_{i=1}^m$ match.

2.3.2. Security Model

In the CBDIAP, the forgery of adversary $\mathcal{A}$ is said to be successful if the forged $P{F}^{\prime }$ can pass the auditing algorithm, and the forged dataset with arbitrary data block $m^{*}\notin {\left\{{\mathit{m}}_i\right\}}_{i=1}^m$ is not interrogated.

Definition 6.

If the probability that any PPT adversary $\mathcal{A}$ can win the following game is negligible, then we consider CBDIAP secure.

Initialization: challenger $\mathcal{C}$ generates system parameters $pp$ and system master private key $msk$, stores the $msk$ itself, and sends the $pp$ to adversary $\mathcal{A}$.

TagGen query: Adversary $\mathcal{A}$ sends the user’s $ID$, the encrypted dataset $\mathit{F}={\left\{{\mathit{m}}_{\mathit{i}}\right\}}_{\mathit{i}=\mathbf{1}}^{\mathit{m}}$ named $ds$, and the corresponding timestamp t to challenger $\mathcal{C}$. Then, $\mathcal{C}$ returns the corresponding dataset label $\tau$ and all the data block tags ${\left\{{\sigma }_i\right\}}_{i=1}^m$ to $\mathcal{A}$.

ProofCheck query: ∀ dataset, $\mathcal{C}$ sends $chal$ to $\mathcal{A}$, $\mathcal{A}$ generates the corresponding $PF$.

Forge: $\mathcal{A}$ generates $proof$ $P{F}^{\prime }$, where $P{F}^{\prime }$ corresponds to an unvisited dataset, i.e., none of the data blocks in the new dataset have undergone the TagGen query process.

3. Data Block Forgery of LZ22 Protocol

First, we analyze the security problems of the LZ22 protocol in the outsourcing storage process in detail and propose our forgery method. Then, we experimentally analyze the time overhead required for forgery.

3.1. Security Problems of LZ22

In reality, a secure cloud auditing protocol requires that the CSP cannot generate a valid attestation without having the complete raw data [55]. Here, we first assume that the TPA needs to audit the integrity of an encrypted dataset $F=({\mathbf{m}}_1,\dots ,{\mathbf{m}}_m)$ with identity ID and dataset name $ds$. Then, after the CSP receives the audit challenge $(ID,ds,chal=\{\left(i,c_i\right):i\in I\})$ from the TPA, it generates a valid proof $PF=(\mathbf{m},\sigma )$, where $\mathbf{m}={\sum }_{i\in I}{c}_i{\mathbf{m}}_i$, $\sigma ={\prod }_{i\in I}{\sigma }_i^{c_i}$. At this point, if the CSP is still able to generate a proof $P{F}^{*}=({\mathbf{m}}^{*},{\sigma }^{*})$ that can be verified despite the loss of a data block ${\mathbf{m}}_k,k\in I$, then this cloud auditing protocol is unsafe.

In the LZ22 protocol [51], the data block ${\mathbf{m}}_i$ has a tag ${\sigma }_i={\left(H_3\left(ID,i,\tau \right)·{\beta }^{{\sum }_{j=1}^n{H}_4\left(ID,j\right)·{\mathit{m}}_{ij}}\right)}^r$. For each data block ${\mathbf{m}}_i$, the CSP can pre-determine an intermediate value $M_i={\sum }_{j=1}^n$$H_4\left(ID,j\right)·{\mathit{m}}_{ij}$ for tag ${\sigma }_i$ and store $M_i$ in the CSP. In this way, when a certain data block ${\mathbf{m}}_k,k\in I$ is lost, the CSP can forge a data block ${\mathbf{m}}_k^{*}=\left({\mathit{m}}_{k1}^{*},\dots ,{\mathit{m}}_{kn}^{*}\right)$. As long as ${\sum }_{j=1}^n{H}_4\left(ID,j\right)·{\mathit{m}}_{kj}^{*}={\sum }_{j=1}^n{H}_4\left(ID,j\right)·{\mathit{m}}_{kj}=M_k$, then the forged data block ${\mathbf{m}}_k^{*}$ has the same tag ${\sigma }_k$ as the real data block ${\mathbf{m}}_k$. In this way, the CSP can send a proof $P{F}^{*}=\left({\mathbf{m}}^{*},\sigma \right)$, where ${\mathbf{m}}^{*}={\sum }_{i\in I,i\ne k}{c}_i{\mathbf{m}}_i+c_k{\mathbf{m}}_k^{*}=(m_1^{*},\dots ,m_n^{*}),\sigma ={\prod }_{i\in I}{\sigma }_i^{c_i}$. We verify the algorithm by substituting $P{F}^{*}=({\mathbf{m}}^{*},\sigma )$ into the Equation (1):

$$\begin{array}{cc}\hfill \widehat{e}(\sigma ,g)& =\widehat{e}\left(\prod _{i\in I}{\sigma }_i^{c_i},g\right)\hfill \\ \hfill & =\widehat{e}\left(\prod _{i\in I}{\left(H_3{(ID,i,\tau )}^{c_i}·{\beta }^{c_i·{\sum }_{j=1}^n{H}_4(ID,j)·{\mathbf{m}}_{ij}}\right)}^r,g\right)\hfill \\ \hfill & =\widehat{e}\left(\prod _{i\in I}{H}_3{(ID,i,\tau )}^{c_i}·{\beta }^{{\sum }_{i\in I}{\sum }_{j=1}^n{H}_4(ID,j)·c_i·{\mathbf{m}}_{ij}},R\right)\hfill \\ \hfill & =\widehat{e}\left(\prod _{i\in I}{H}_3{(ID,i,\tau )}^{c_i}·{\beta }^{\left({\sum }_{i\in I,i\ne k}{\sum }_{j=1}^n{H}_4(ID,j)·c_i·{\mathit{m}}_{ij}\right)+\left({\sum }_{j=1}^n{H}_4\left(ID,j\right)·c_k·{\mathit{m}}_{kj}\right)},R\right)\hfill \\ \hfill & =\widehat{e}\left(\prod _{i\in I}{H}_3{(ID,i,\tau )}^{c_i}·{\beta }^{\left({\sum }_{i\in I,i\ne k}{\sum }_{j=1}^n{H}_4(ID,j)·c_i·{\mathit{m}}_{ij}\right)+c_k·{\mathit{m}}_k},R\right)\hfill \\ \hfill & =\widehat{e}\left(\prod _{i\in I}{H}_3{(ID,i,\tau )}^{c_i}·{\beta }^{\left({\sum }_{i\in I,i\ne k}{\sum }_{j=1}^n{H}_4(ID,j)·c_i·{\mathit{m}}_{ij}\right)+\left({\sum }_{j=1}^n{H}_4\left(ID,j\right)·c_k·{\mathit{m}}_{kj}^{*}\right)},R\right)\hfill \\ \hfill & =\widehat{e}\left(\prod _{i\in I}{H}_3{(ID,i,\tau )}^{c_i}·{\beta }^{{\sum }_{j=1}^n{H}_4\left(ID,j\right)·\left({\sum }_{i\in I,i\ne k}{c}_i·{\mathit{m}}_{ij}+c_k{\mathit{m}}_{kj}^{*}\right)},R\right)\hfill \\ \hfill & =\widehat{e}\left(\prod _{i\in I}{H}_3{(ID,i,\tau )}^{c_i}·{\beta }^{{\sum }_{j=1}^n{H}_4\left(ID,j\right)·{\mathit{m}}_j^{*}},R\right)\hfill \end{array}$$

(1)

That is, the proof $P{F}^{*}=({\mathbf{m}}^{*},\sigma )$ returned by the CSP to the TPA can pass the verification. Since data block ${\mathbf{m}}^{*}$ is forged by the CSP, the LZ22 protocol is not secure.

Below, we consider specifically how to construct the data block ${\mathbf{m}}_k^{*}=\left({\mathit{m}}_{k1}^{*},\dots ,{\mathit{m}}_{kn}^{*}\right)$ such that ${\sum }_{j=1}^n{H}_4\left(ID,j\right)·{\mathit{m}}_{kj}^{*}=M_k$. Since $H_4\left(ID,j\right),j\in \{1,\dots ,n\}$ are all values that can be calculated by the CSP, ${\mathit{m}}_{k1}^{*},\dots ,{\mathit{m}}_{k(n-1)}^{*}$ can be chosen arbitrarily. It is sufficient that ${\mathit{m}}_{kn}^{*}=\frac{(M_k-{\sum }_{j=1}^{n-1}{H}_4\left(ID,j\right)·{\mathit{m}}_{kj}^{*})}{H_4\left(ID,n\right)}$ holds, at which point ${\mathbf{m}}_k^{*}=\left({\mathit{m}}_{k1}^{*},\dots ,{\mathit{m}}_{k\left(n-1\right)}^{*},\frac{(M_k-{\sum }_{j=1}^{n-1}{H}_4\left(ID,j\right)·{\mathit{m}}_{kj}^{*})}{H_4\left(ID,n\right)}\right)$ holds. An extreme case is to make ${\mathit{m}}_{kj}^{*}=0,j\in \{1,\dots ,(n-1)\}$, ${\mathit{m}}_{kn}^{*}=\frac{M_k}{H_4\left(ID,n\right)}$ hold, when ${\mathbf{m}}_k^{*}=\left(0,\dots ,0,\frac{M_k}{H_4\left(ID,n\right)}\right)$. From the analysis, it is clear that the forging success rate of our proposed method for forging data blocks is 100%.

Note that this method of masking data loss by the CSP requires an additional value $M_i={\sum }_{j=1}^n{H}_4\left(ID,j\right)·{\mathit{m}}_{ij}$ to be computed for each data block ${\mathbf{m}}_i$ when storing the user dataset, and thus the CSP needs to prepare an additional $\frac{1}{n}$ of the original dataset size of the storage space for storing $M_i$. Figure 2 compares the difference between the legitimate CSP and the dishonest CSP in the auditing phase.

3.2. Data Block Forgery Experiments

In this section, we delve into the time overhead associated with the CSP’s ability to counterfeit a data block. Given that the data block ${\mathrm{m}}_k^{*}$ targeted for forgery shares an identical tag ${\sigma }_k$ with the authentic data block ${\mathrm{m}}_k$, there is no necessity to fabricate the tag ${\sigma }_k$.

Our simulation used the Pycharm IDE, with the compiler version being Python 3.8. Our simulation ran on a Linux 5.10.0-8-generic system, using the 11th Gen Intel (R) Core (TM) i7-11800H @ 2.30-GHz processor. The parameters used in the simulation were all standard parameters of the Pypbc library [56]. To design an 80-bit secure auditing algorithm, the length of any element in the group ${\mathbb{G}}_1$ needed 160 bits (20 bytes). We analyzed the time overhead required for forgery with dataset sizes of 10 kB, 50 kB, and 100 kB, respectively.

In the data block forgery method proposed in the previous section, the CSP needs to additionally compute a value $M_i={\sum }_{j=1}^n{H}_4\left(ID,j\right)·{\mathit{m}}_{ij}$ for each data block ${\mathbf{m}}_i$ and store $M_i,i\in \{1,\dots ,m\}$ locally after receiving the dataset $F=({\mathbf{m}}_1,\dots ,{\mathbf{m}}_m)$ uploaded by the user. After an experimental simulation, we concluded that the time overhead required by the CSP to compute each $M_i$ was related to the number of sector n in each data block as shown in Figure 3.

After the CSP receives an audit challenge $(ID,ds,chal=\{\left(i,c_i\right):i\in I\})$ from the TPA, if it finds that a block of data ${\mathbf{m}}_k,k\in I$ is missing, it can then forge a block of data ${\mathbf{m}}_k^{*}=\left({\mathit{m}}_{k1}^{*},\dots ,{\mathit{m}}_{kn}^{*}\right)$ using the previously stored value $m_k$. The forgery method that minimizes the time overhead is to make ${\mathit{m}}_{kj}^{*}=0,j\in \{1,\dots ,(n-1)\}$, ${\mathit{m}}_{kn}^{*}=\frac{M_k}{H_4\left(ID,n\right)}$ and obtain ${\mathbf{m}}_k^{*}=\left(0,\dots ,0,\frac{M_k}{H_4\left(ID,n\right)}\right)$. When the number of missing data blocks is more than one, the same method can be used to forge the other missing data blocks. We derived the time required by the forgery method with the lowest overhead for the CSP forgery of each ${\mathbf{m}}_k^{*}$ related to the number of sector n in each data block as shown in Figure 4.

To make the forged data block look more real, the values of ${\mathit{m}}_{k1}^{*},\dots ,{\mathit{m}}_{k(n-1)}^{*}$ can be assigned one by one by the CSP according to the numerical characteristics of the existing data block, as long as the last element of the forged data block ${\mathbf{m}}_k^{*}$ satisfies ${\mathit{m}}_{kn}^{*}=\frac{(M_k-{\sum }_{j=1}^{n-1}{H}_4\left(ID,j\right)·{\mathit{m}}_{kj}^{*})}{H_4\left(ID,n\right)}$. At this point, ${\mathbf{m}}_k^{*}=\left({\mathit{m}}_{k1}^{*},\dots ,{\mathit{m}}_{k\left(n-1\right)}^{*},\frac{(M_k-{\sum }_{j=1}^{n-1}{H}_4\left(ID,j\right)·{\mathit{m}}_{kj}^{*})}{H_4\left(ID,n\right)}\right)$, and the forgery process will require a greater amount of calculation. When the number of missing data blocks is more than one, the same method can be used to forge the other missing data blocks. The time required for the CSP to forge each more realistic ${\mathbf{m}}_k^{*}$ versus the number of sector n in each data block is shown in Figure 5.

In the following, we analyze the total time overhead required for CSPs to forge data blocks in the LZ22 protocol using the forgery method proposed in this paper. First, for a given encrypted dataset $F=\left({\mathbf{m}}_1,\dots ,{\mathbf{m}}_m\right)$, the CSP needs to compute an extra value $M_i={\sum }_{j=1}^n{H}_4\left(ID,j\right)·{\mathit{m}}_{ij}$ for each data block ${\mathbf{m}}_i$. Then, the CSP forges the lost data block through the challenge. If the CSP uses the lowest overhead forgery method, the number of sectors n for each data block versus the total time overhead is shown in Figure 6. If the CSP uses a more realistic forgery method, the number of sectors n of each data block versus the total time overhead is shown in Figure 7.

From Figure 3, Figure 4, Figure 5, Figure 6 and Figure 7, we can see that the time overhead of our forgery method is minimal. With sufficient storage resources (i.e., sufficient storage space to store the intermediate value $M_i$), the CSP needs at most 1.1 s to forge a lost data block and pass the audit challenge. Otherwise, even if auditing is required during the user outsourcing storage process (i.e., the CSP needs to calculate the intermediate value $M_i$ and forge the missing data block ${\mathit{m}}_k$ at the same time), it takes at most 5.5 s for the CSP to be able to complete the forgery of a particular missing data block and pass the auditing challenge.

4. The Proposed Protocol

In this section, we introduce an enhanced protocol designed to address the security vulnerabilities present in the LZ22 protocol. Subsequently, a comprehensive analysis of the correctness of our protocol is conducted. Finally, we provide a rigorous proof of the security guarantees offered by our proposed protocol.

4.1. Concrete Structure

From Section 3, it is clear that the encrypted data block ${\mathit{m}}_k$ stored by the CSP in the LZ22 protocol can be forged with 100% probability. In our protocol, we make it impossible for the attacker to calculate the exponential part of ${\sigma }_k$ by changing the $H_4\left(ID,j\right),j\in [1,n]$ function of tag ${\sigma }_k$ in the LZ22 protocol to pick n random numbers $a_j\in {\mathbb{Z}}_q^{*},j\in [1,n]$, which makes it impossible to forge any data block. The specific details of our protocol are as follows.

The proposed protocol comprises four algorithms illustrated in Figure 8. Initially, the system setup algorithm is executed by the CSP to generate initialization parameters $pp$. Then, the CSP sends $pp$ to the user and TPA. Subsequently, in the user registration algorithm, the user creates $(ID,up{k}_{ID})$ and transmits it to the CSP. The CSP then responds by sending $Cer{t}_{ID}$ to the user. Then, the user verifies the legitimacy of the certificate. Following this, the outsourcing storage algorithm is activated by the user, tasked with labeling encrypted datasets and transmitting $(\tau ,\left\{{({\mathit{m}}_i,{\sigma }_i)}_{i=1}^m\right\})$ to the CSP and $\tau$ to the TPA. Lastly, the auditing algorithm is initiated by the TPA, responsible for issuing audit challenges to the CSP to verify the integrity of the stored data. Upon receiving an audit challenge from the TPA, the CSP must present the necessary proof of integrity ($PF$) to the TPA for assessment in order to verify the data integrity. A detailed description of each algorithm is provided below.

4.1.1. System Setup

Input security parameter $1^{\lambda }$; then, the CSP randomly selects the cyclic group ${\mathbb{G}}_1$ of order prime q, and the symmetric bilinear mapping $\widehat{e}:{\mathbb{G}}_1\times {\mathbb{G}}_1\to {\mathbb{G}}_T$. Then, the CSP randomly selects the generator element $g\in {\mathbb{G}}_1$ and an integer $s\in {\mathbb{Z}}_q^{*}$ to compute the master public key $pk=g^s$. Then, the CSP randomly selects three collision-resistant hash functions: $H_1:{\left\{0,1\right\}}^{*}\times {\mathbb{G}}_1\to {\mathbb{G}}_1$, $H_2:{\left\{0,1\right\}}^{*}\times {\mathbb{G}}_1\times {\mathbb{G}}_1\to {\mathbb{Z}}_q$, $H_3:{\left\{0,1\right\}}^{*}\times {\mathbb{Z}}_q\times {\mathbb{G}}_1\to {\mathbb{G}}_1$. Finally, the CSP announces the above system public parameter $pp=(q,{\mathbb{G}}_1,{\mathbb{G}}_T,\widehat{e},g,pk,H_1,H_2,H_3)$ and sets s as the system master key $msk$.

4.1.2. User Registration

The user registration algorithm is divided into three phases: UserKeyGen, certify, and authentication.

• UserKeyGen: the user randomly chooses $x\in {\mathbb{Z}}_q$ as secret key $us{k}_{ID}$, computes the user public key as $up{k}_{ID}=g^x$, and then sends $ID$ and $up{k}_{ID}$ to CSP.
• Certify: The CSP generates certificate ${\mathrm{Cert}}_{ID}=H_1{\left(ID,up{k}_{ID}\right)}^{msk}$ and sends it to the user.
• Authentication: The user verifies the legitimacy of the certificate $\mathrm{Cer}{\mathrm{t}}_{ID}$ through equation $\widehat{e}\left({\mathrm{Cert}}_{ID},g\right)=\widehat{e}(H_1\left(ID,up{k}_{ID}\right),pk)$.

4.1.3. Outsourcing Storage

The outsourcing storage algorithm is divided into two phases: data processing and data uploading.

• Data processing:

  (1)

  Given an encrypted dataset $F\in {\left\{0,1\right\}}^{*}$ with timestamp t and dataset name $ds$, the user initially divides the dataset F into m data blocks $({\mathit{m}}_1,\dots ,{\mathit{m}}_m)$, each comprising n sectors. Specifically, $F={\left({\mathit{m}}_{i,j}\right)}_{m\times n}$, where ${\mathit{m}}_{i,j}\in {\mathbb{Z}}_q$.

  (2)

  The user then randomly selects $r,a_1,\dots ,a_n\in {\mathbb{Z}}_q^{*}$, calculates $R=g^r,{\left\{g_j\right\}}_{j=1}^n:=$${\left\{g^{a_j}\right\}}_{j=1}^n$, and $U={\left({\mathrm{Cert}}_{ID}\right)}^{\frac{1}{us{k}_{ID}+H_2\left(ID,ds,t,{\left\{g_j\right\}}_{j=1}^n,R,m,n\right)}}$. The user assigns the label $\tau =({\left\{g_j\right\}}_{j=1}^n,R,U,ds,t,m,n)$ of dataset F and retains $a_1,\dots ,a_n$.

  (3)

  For each data block ${\mathit{m}}_i$, the user computes the corresponding tag into Equation (2):

  $${\sigma }_i:={\left(H_3\left(ID,i,\tau \right)·g^{{\sum }_{j=1}^n{a}_j{\mathit{m}}_{ij}}\right)}^r.$$

  (2)

• Data uploading: The user uploads dataset label $\tau$, data blocks ${\mathit{m}}_1,\dots ,{\mathit{m}}_m$, and corresponding tags ${\sigma }_1,\dots ,{\sigma }_m$ to the CSP. At the same time, the user sends dataset label $\tau$ to the TPA.

4.1.4. Auditing

In the Auditing algorithm, three distinct phases, namely challenge, proof generation, and proof verification, are delineated for execution.

• Challenge: The TPA randomly selects a non-empty subset I with element $i\in \{1,\dots ,m\}$. For each i, the TPA randomly chooses $c_i\in {\mathbb{Z}}_q^{*}$. Subsequently, the TPA transmits the user $ID$, dataset name $ds,$ and challenge $chal=\{\left(i,c_i\right):i\in I\}$ to the CSP.
• Proof generation: Upon reception of $(ID,ds,chal)$, the CSP computes $\mathbf{m}$ and $\sigma$ in Equation (3):

  $$\mathbf{m}=\sum _{i\in I}{c}_i{\mathbf{m}}_i,\sigma =\prod _{i\in I}{\sigma }_i^{c_i}$$

  (3)
  Subsequently, the CSP sends $PF=(\mathbf{m},\sigma )$ back to the TPA.
• Proof verification: Upon receipt of $PF$, the TPA initially verifies the validity of the label $\tau$ using Equation (4).

  $$\widehat{e}\left(U,up{k}_{ID}·g^{H_2\left(ID,ds,t,{\left\{g_j\right\}}_{j=1}^n,R,m,n\right)}\right)=\widehat{e}(H_1\left(ID,up{k}_{ID}\right),pk)$$

  (4)
  If Equation (4) is satisfied, the TPA confirms the integrity of the user’s data stored by the CSP through Equation (5).

  $$\widehat{e}\left(\sigma ,g\right)=\widehat{e}(\prod _{i\in I}{H}_3{\left(ID,i,\tau \right)}^{c_i}·\prod _{j=1}^n{g}_j^{{\mathit{m}}_j},R)$$

  (5)
  If both equations Equations (4) and (5) are satisfied, the TPA can ascertain the integrity of the dataset stored in the CSP; otherwise, it indicates either nonintegrity or tampering of the dataset.

4.2. Correctness

According to Definition 5, in this section, we verify the correctness of the proposed protocol in terms of certificate validity, legitimacy of dataset label $\tau$, and data integrity verification. To verify the correctness of the proposed protocol, we assume that all participants in this section faithfully execute the proposed protocol.

4.2.1. Certificate Validity

Claim 1.

$\forall \left(ID,up{k}_{ID},Cer{t}_{ID}\right),\widehat{e}\left(\mathrm{Cer}{\mathrm{t}}_{ID},g\right)=\widehat{e}(H_1\left(ID,up{k}_{ID}\right),pk)$ is constant holds.

Proof. 

$$\begin{array}{cc}\hfill \widehat{e}\left(Cer{t}_{ID},g\right)& =\widehat{e}\left(H_1{\left(ID,up{k}_{ID}\right)}^s,g\right)\hfill \\ \hfill & =\widehat{e}\left(H_1\left(ID,up{k}_{ID}\right),g^s\right)\hfill \\ \hfill & =\widehat{e}\left(H_1\left(ID,up{k}_{ID}\right),pk\right)\hfill \end{array}$$

(6)

□

4.2.2. Legitimacy of Dataset Label $\tau$

Claim 2.

$\forall \left(PF,\tau ,up{k}_{ID},ID\right)$,$\widehat{e}\left(U_{ID},up{k}_{ID}·g^{H_2\left(ID,ds,t,{\left\{g_j\right\}}_{j=1}^n,R,m,n\right)}\right)$

$=\widehat{e}(H_1\left(ID,up{k}_{ID}\right),pk)$ is constant holds. (here we let $\gamma =H_2\left(ID,ds,t,{\left\{g_j\right\}}_{j=1}^n,R,m,n\right)$).

Proof. 

$$\begin{array}{cc}\hfill \widehat{e}\left(U,up{k}_{ID}·g^{\gamma }\right)& =\widehat{e}\left({\left({\mathrm{Cert}}_{ID}\right)}^{\frac{1}{x+\gamma }},{g^{x}g}^{\gamma }\right)\hfill \\ \hfill & =\widehat{e}\left({\mathrm{Cert}}_{ID},g^{\frac{x+\gamma }{x+\gamma }}\right)\hfill \\ \hfill & =\widehat{e}\left(H_1{\left(ID,up{k}_{ID}\right)}^s,g\right)\hfill \\ \hfill & =\widehat{e}\left(H_1\left(ID,up{k}_{ID}\right),g^s\right)\hfill \\ \hfill & =\widehat{e}\left(H_1\left(ID,up{k}_{ID}\right),pk\right)\hfill \end{array}$$

(7)

□

4.2.3. Data Integrity Verification

Claim 3.

$\forall \left(PF,\tau ,up{k}_{ID},ID\right)$,$\widehat{e}\left(\sigma ,g\right)=\widehat{e}({\prod }_{i\in I}{H}_3{\left(ID,i,\tau \right)}^{c_i}·{\prod }_{j=1}^n{g}_j^{{\mathit{m}}_j},R)$ is constant holds.

Proof. 

$$\begin{array}{cc}\hfill \widehat{e}\left(\sigma ,g\right)& =\widehat{e}\left(\prod _{i\in I}{\sigma }_i^{c_i},g\right)\hfill \\ \hfill & =\widehat{e}\left({\prod _{i\in I}\left(H_3\left(ID,i,\tau \right)·g^{{\sum }_{j=1}^n{a}_j{\mathit{m}}_{ij}}\right)}^{r·c_i},g\right)\hfill \\ \hfill & =\widehat{e}\left({\prod _{i\in I}\left(H_3\left(ID,i,\tau \right)·({g^{{\sum }_{j=1}^n{a}_j})}^{{\mathit{m}}_{ij}}\right)}^{c_i},g^r\right)\hfill \\ \hfill & =\widehat{e}\left({\prod _{i\in I}\left(H_3\left(ID,i,\tau \right)·({g^{{\sum }_{j=1}^n{a}_j})}^{{\mathit{m}}_{ij}}\right)}^{c_i},R\right)\hfill \\ \hfill & =\widehat{e}\left(\prod _{i\in I}{H}_3{\left(ID,i,\tau \right)}^{c_i}·\prod _{j=1}^n{g}_j^{{c_i·\mathit{m}}_{ij}},R\right)\hfill \\ \hfill & =\widehat{e}\left(\prod _{i\in I}{H}_3{\left(ID,i,\tau \right)}^{c_i}·\prod _{j=1}^n{g}_j^{m_j},R\right)\hfill \end{array}$$

(8)

□

4.3. Security Analysis

In our proposed protocol, following Definitions 1–3, we delineate three classes of PPT algorithmic adversaries. Adversary $\left({\mathcal{A}}_I\right)$ simulates an eavesdropper with the ability to substitute the $up{k}_{ID}$ of the user yet lacks access to $\mathrm{Cer}{\mathrm{t}}_{ID}$. On the other hand, adversary $\left({\mathcal{A}}_{II}\right)$ behaves like a malicious CSP possessing knowledge of $msk$ but lacking the capability to alter $up{k}_{ID}$. Lastly, adversary $\left({\mathcal{A}}_{III}\right)$ replicates a compromised CSP with the capacity to fabricate $P{F}^{\prime }$ but without the ability to retrieve the user’s randomly generated $a_1,\dots ,a_n$. None of the three adversaries, ${\mathcal{A}}_I$, ${\mathcal{A}}_{II}$, and ${\mathcal{A}}_{III}$, have privileges to access $\mathrm{Cer}{\mathrm{t}}_{ID}$, $us{k}_{ID}$ or $a_1,\dots ,a_n$. The security guarantees of our protocol are substantiated by Theorems 1–3.

Theorem 1.

Assuming the weak k-CAA problem assumption holds in ${\mathbb{G}}_1$, it is infeasible ∀ PPT adversary ${\mathcal{A}}_I$ to generate a valid proof with a significant advantage ${\epsilon }_{{\mathcal{A}}_I}$.

Proof. 

The detailed proof is elaborated in Appendix A. □

Theorem 2.

Given the k-CAA assumption in ${\mathbb{G}}_1$, no PPT adversary ${\mathcal{A}}_{II}$ can counterfeit a valid proof with a non-negligible advantage ${\epsilon }_{{\mathcal{A}}_{II}}$.

Proof. 

The thorough proof is accessible in Appendix B. □

Theorem 3.

In the scenario where the CDH assumption holds in $\widehat{e}:{\mathbb{G}}_1\times {\mathbb{G}}_1\to {\mathbb{G}}_T$, it is computationally infeasible ∀ PPT adversary ${\mathcal{A}}_{III}$ to generate a valid proof with a notable advantage ${\epsilon }_{{\mathcal{A}}_{III}}$.

Proof. 

The detailed proof can be found in Appendix C. □

5. Performance Analysis

In this section, we conduct a theoretical analysis of the computational complexity associated with Tag Generation and Auditing in various cryptographic protocols, including those proposed by Han et al. [26], Li et al. [30], Shen et al. [46], Li et al. [51], and the protocol presented in this work. Then, we also experimentally simulate these two properties. The specific theoretical and experimental analyses are as follows.

5.1. Analysis of Theoretical Effectiveness

We provide the operational notations in

Table 1. Notations.

Notation	Meaning
$T_{M_1}$	Multiplication operations on the group ${\mathbb{G}}_1$
$T_{M_2}$	Multiplication operations on the group ${\mathbb{G}}_T$
$T_{M_3}$	Multiplication operations on the domain ${\mathbb{Z}}_q^{*}$
$T_{E_1}$	Exponential operations on the group ${\mathbb{G}}_1$
$T_{E_2}$	Exponential operations on the group ${\mathbb{G}}_T$
$T_{E_3}$	Exponential operations on the domain ${\mathbb{Z}}_q^{*}$
$T_{H_1}$	Mapping to the hash operation on the group ${\mathbb{G}}_1$
$T_{H_2}$	Mapping to the hash operation on the domain ${\mathbb{Z}}_q^{*}$
$T_P$	Bilinear pairing operation
m	Number of data blocks
n	Number of sectors for each data block
c	Number of audit challenges

. The theoretical analysis outcomes of the above protocols are presented in

Table 2. Theoretical analysis.

Protocol	TagGen.comp Cost	Auditing.comp Cost	Cryptographic System
[26]	$2m{nT}_{E_1}+m{nT}_{H_1}$ $+mn{T}_{M_1}$	$\left(c+2\right)T_{E_1}+c{T}_{M_1}$ $+c{T}_{H_1}+2T_P$	PKI-based
[30]	$2m{T}_{E_1}+2m{T}_{M_1}$ $+mn{T}_{M_3}$	$\left(c+n+1\right)T_{E_1}$ $+\left(c+n-1\right)T_{M_1}$ $+\left(c+1\right)T_{H_1}+T_{M_2}$ $+3T_P$	ID-based
[46]	$2m{T}_{E_1}+2m{T}_{M_1}$ $+mn{T}_{M_3}+m{T}_{H_1}$	$\left(2c+n\right)T_{E_1}$ $+\left(c+n-1\right)T_{M_1}$ $+T_{M_2}+T_{H_1}+3T_P$	Certificateless
[51]	$\left(2m+1\right)T_{E_1}+m{T}_{M_1}$ $+m{T}_{H_1}+mn{T}_{M_3}$ $+\left(mn+1\right)T_{H_2}$	$\left(c+1\right)T_{E_1}+c{T}_{M_1}$ $+c{T}_{H_1}+n{T}_{M_3}$ $+n{T}_{H_2}+2T_P$	Certificate-based
Our protocol	$\left(2m+1\right)T_{E_1}+m{T}_{M_1}$ $+m{T}_{H_1}+mn{T}_{M_3}$ $+T_{H_2}$	$\left(c+n\right)T_{E_1}$ $+\left(c+n-1\right)T_{M_1}$ $+c{T}_{H_1}+2T_P$	Certificate-based

.

5.2. Analysis of Experimental Simulations

In this section, we present the results of the experimental simulations conducted to evaluate the computational costs associated with Tag Generation and Auditing in various protocols, including the above five protocols. The simulations were performed using the PyCharm IDE with Python 3.8 compiler version. The experiments were conducted on a Linux 5.10.0-8-generic system equipped with an 11th Gen Intel Core i7-11800H @ 2.30-GHz processor. For the design of an 80-bit secure auditing protocol, each element in the group ${\mathbb{G}}_1$ was required to have a length of 160 bits (20 bytes).

Figure 9, Figure 10 and Figure 11 illustrate the correlation between the time cost of tag generation and the number of data block sectors (n) for the aforementioned protocols, considering dataset sizes of 10 kB, 50 kB, and 100 kB, respectively. From Figure 9, Figure 10 and Figure 11, we find that the time overhead of the protocol proposed in this paper and the time overhead of the protocol proposed by [51] exhibit a gradual decrease as the number of sectors of each block increases. Upon analysis, it is evident that when the dataset size is constant, an increase in the number of sectors for each data block n results in a decrease in the relative value of m. Operations related to m predominantly involve operations on the group, while those associated with n involve operations on the finite field. It is noteworthy that the efficiency of operations on the group is notably lower compared to operations on the finite field, which gives rise to the aforementioned phenomenon. The figures indicate that the computational overhead of the protocol proposed by [51] and our protocol is the lowest among the five protocols. Nevertheless, our proposed protocol exhibits superior security performance.

Figure 12, Figure 13 and Figure 14 display the relationship between the time cost of auditing and the number of auditing challenges (c) for the aforementioned protocols, considering dataset sizes of 10 kB, 50 kB, and 100 kB, respectively. From Figure 12, Figure 13 and Figure 14, the time overhead of the five protocols discussed earlier (excluding the protocol proposed by [46]) increases proportionally with the number of audit challenges. The examination reveals that as the audit file size remains constant, the value of n diminishes with the increase in c. Therefore, based on the expression, it can be inferred that the audit overhead exhibits an almost linear correlation with the rise in c (excluding the protocol proposed by [46]). The figures reveal that the computational overhead of the protocol proposed by [51] and our protocol is the lowest among the five protocols. However, our proposed protocol demonstrates superior security performance.

6. Conclusions

In this study, we initially identified a forgery method capable of forging arbitrary data blocks within the [51] protocol with minimal time overhead. Subsequently, we introduced a secure certificate-based cloud auditing protocol. Analyses affirmed that the efficiency of the protocol presented in this paper surpassed that of the five compared protocols.