Abstract
Cloud storage plays an important role in the data processing of edge computing. It is very necessary to protect the integrity of these data and the privacy of users. Recently, a cloud auditing scheme which can be used to smart cities has been proposed, which is lightweight and privacy-preserving. Although this scheme has very good performance and is a very valuable work, we find that there is insecurity in it. By giving two kinds of attacks, we prove that a malicious cloud server provider (CSP) can forge auditing proof and can successfully pass the verification of the third-party auditor (TPA) even if the CSP deletes the user’s data. Then, based on this scheme, we propose an improved scheme, which can resist the forgery attack from malicious CSP. Through security analysis, our scheme improves the security compared to the original scheme without reducing the efficiency.
1. Introduction
The rise of the Internet of Things and the 5G network has led to many new services, including intelligent transportation, smart city, location service, and so on [1, 2]. The number of smartphones, wearable devices, Internet-connected televisions, and other sensor devices shows an explosive growth trend, followed by “sea-scale” data generated by these Internet of Things terminals [3–6].
In edge computing, some or all of the private data of end users need to be outsourced to third parties (such as cloud computing data centers and edge data centers) [7–9]. By using the cheap storage and computing services provided by the cloud server, users with limited resources can be freed from the complex hardware system, reduce the storage burden, and at the same time be able to easily access their own data [10–12]. Compared to the traditional cloud computing model which relies solely on the computing center, the edge computing can handle the big data at the network edge effectively.
However, the users’ data stored in the third-party data center have the features of separation of control, storage randomization, and so on, which can easily lead to data security problems such as data loss, data leakage, and so on [13, 14]. When the integrity of users’ data is destroyed, the interests of these users may receive huge losses. Therefore, it is significant to design a cloud auditing scheme for edge computing.
1.1. Related Work
Recently, in order to meet different application requirements, various cloud storage audit schemes have been proposed. At present, the research on data integrity audit is mainly focused on four functional requirements, namely, dynamic audit, batch audit, privacy protection, and lightweight computing.
At the CCS conference in 2007, Jules and Ateniese et al. proposed proofs of retrievability (POR) and provable data possession (PDP), respectively, to audit cloud storage data [15, 16]. Both of them use the idea of sampling testing to audit the integrity of the data. That is, only a small part of the data in the cloud can ensure the integrity and reliability of all data with a high probability. Then, Ateniese et al. proposed a scalable PDP scheme based on the original PDP [17], which is the first verifiable data holding protocol that supports partial dynamic operation. The design of this protocol provides a new idea for the construction of the cloud audit protocol and takes an important step towards the more practical PDP protocol. Inspired by Ateniese et al., Erway et al. [18] extended the above PDP protocol and designed a protocol that supports the dynamic update of cloud data. The audit protocol uses jump tables to support complete dynamic operation of data. Compared with the protocol of Ateniese et al., it has a greater breakthrough in practical value and the probability of detecting cloud data errors. However, the protocol does not have the performance of privacy protection, batch auditing, and so on.
Wang et al. [19] proposed a distributed data audit system to protect privacy in order to solve the problems of privacy disclosure and batch audit in the process of data integrity audit. The system uses a third-party audit platform to perform integrity audits, and the data owner can delete the local original data after the data are outsourced and stored to the cloud server. At the same time, homomorphic MAC and random mask technology are used to ensure that the third-party audit platform cannot know the content of the stored data in the effective audit process to achieve privacy protection. Subsequently, Wang et al. further improved the scheme in reference [20] by constructing a Merkle hash tree structure based on block authentication tags to improve the proof of the storage model. A study [20] further improved the bilinear aggregation signature method and improved the batch audit efficiency of TPA. Yang et al. [21] proposed an efficient and privacy-protected dynamic auditing protocol, which can be extended to realize dynamic data operations and batch auditing. At the same time, combining cryptography and bilinear properties, this scheme can protect the data privacy. In view of mobile devices with insufficient computing power, a lightweight integrity audit scheme supporting privacy protection is proposed in reference [22]. This scheme uses an online/offline signature method where the offline phase undertakes a lot of computing work. When the data file to be outsourced is given, the user just needs to construct the outsourced data signature in the online phase, which is lightweight.
1.2. Motivation
At present, in most public audit systems, in order to ensure the integrity of user data, the third-party auditor usually initiates an integrity challenge to the CSP, and then the CSP generates evidence to prove that it honestly stores user data. In this model, we first need to ensure that the cloud service provider cannot complete the forgery attack; that is, the forged evidence cannot be verified by the third-party auditor.
Recently, a public cloud auditing scheme has been proposed by Jing Han et al. [23]. This scheme is pairing-free and allows a third-party auditor to generate authentication metasets on behalf of users, which can achieve lightweight computing. It can protect the privacy of a user’s data by blinding the raw data before storing them in the CSP and sending to the third-party auditor. At the same time, this scheme can realize batch auditing. Their proposed scheme is very valuable.
However, we find this scheme is not secure. A malicious CSP can easily forge auditing proof. Even if the CSP deletes all the data of a user, it can still generate the correct data possession proof to pass the verification of TPA. According to our findings, we have carried out the following work:(1)We give two attack methods to prove the insecurity of Han’s scheme. The first attack proves that the audit proof can be forged by the CSP, and the second attack proves that the CSP can pass the verification of the TPA even if it deletes the user’s data.(2)Based on the original scheme, we propose an improved scheme, which can effectively resist the forgery attack from CSP.
2. System Model and Design Goals
2.1. The System Model
The cloud storage system (CSS) includes three entities as depicted in Figure 1: users, CSP, and TPA. The specific definitions are as follows:(1)Users: the owner of the data, outsources the data to the CSP for storage, and delivers the audit work to the TPA.(2)CSP : a provider of cloud storage services, has large storage space and powerful computing capabilities, and can realize data sharing.(3)TPA : the third-party auditor, generates the authentication metaset for users’ data and audits the integrity of data stored in the cloud for users.
As depicted in Figure 2, the workflow of this scheme is as follows:(1)When a user needs to store a data file in the cloud server, they blind it and send the blinded data file to the CSP and TPA. Then, they delete the local data;(2)After receiving the blinded data from user, the TPA generates the tags for the data and sends it to the CSP;(3)In order to ensure whether their data is correctly stored in the cloud server, the user sends an auditing request to TPA;(4)Upon receiving the auditing request, the TPA randomly selects a small set of data blocks as the audit objects and sends an auditing challenge to the CSP;(5)The cloud server, based on the challenge and the authentication metaset, generates a proof and sends it to the TPA.(6)After receiving the proof, the TPA verifies the correctness of it. Finally, the TPA sends the auditing report to the user.
2.2. The Design Goals
Our cloud storage audit scheme would achieve the requirements of public auditability, correctness, and unforgeability.(1)Pubic auditability: TPA can replace the user to remotely audit the integrity of the data when the user does not need to download the data stored in the cloud.(2)Correctness: if CSP honestly stores user data, it can be audited by TPA. Otherwise, the generated proof cannot be verified by TPA.(3)Unforgeability: any party cannot forge the authentication meta set of a user's data unless it has the user's secret key.
3. Review of Han’s Scheme
Jing Han et al. (2020) proposed a public cloud auditing scheme, which consists of six algorithms as follows. Before reviewing this scheme, we first introduce the concept of HomMAC (homomorphic message authentication code). For a more specific definition, please refer to [24]. For the specific descriptions of the symbols that appear below, please refer to Table 1.
Given a data block , then computeswhere is the HomMAC of and , .(1)Setup: input a security parameter , and then outputs , which are two large primes. The CSS selects and . The CSS sets a and . Besides, the CSS set two time upper limits and , where is the longest time for CSP to generate auditing proof, is the longest time for the TPA to generate authentication meta set. Finally, the is made public.(2)KeyGen: the identifier of TPA is and . TPA generate their secret and public key . The user generates this secret/public key pair from . Besides, the user chooses random values and keeps them secret.(3)SigGen:
3.1. SigGen1
First, the user divided file into data blocks. Then, divided each data block into segments. Then, they establishe a unique tag for the file .
The user blinds each data blocks to protect the privacy of the file as follows:
Chooses a random value and then compute and , where . Blind each data block :
The blinded file is .
Finally, the user sends to TPA and sends to CSP.
3.2. SigGen2
The TPA choose a key pair , where and . Then, they computeand the HomMAC:
The TPA compute and , and then output , where is random value. Let be the authentication meta set of data blocks . Then, is sent to the CSP.
3.3. Storage
The CSP stores file .
When receiving the data from TPA, the CSP records time stamp , and computes:
If , the CSP refuse to store data. Otherwise, they store data.
Next, the CSP computes the validity of by performing the following computations:
If the (8) holds, the CSP stores the file and other information.
3.4. Challenge
The user sends an auditing request to the TPA. If it is validity, the TPA generates an auditing challenge as follows:
The TPA randomly chooses c elements as a subset and chooses a random value . Then, output . Finally, they send the to the CSP.
3.5. ProofGen
The CSP computes:
Then, the proof is sent to the TPA, in which .
ProofVer: after receiving the proof, the TPA records time stamp immediately and computes . If , stop audit work and return “Expiration” to the CSP. Otherwise, proceed to the following steps.
Compute:
Then, verify the following equation:
If the (11) does not hold, the TPA concludes that the user’s data is corrupted. Otherwise, the TPA believe the user’s data is integrity. Finally, the TPA sends the auditing report to the user.
3.6. Attack I
In this section, we will show the scheme of Jing Han et al. is not secure by giving the attack I. From the protocol of ProofVer, we can know that the TPA verifying the integrity of the data stored in the CSP by determines whether the following equation holds:
Through observation, we can obtain the following information:(1)The in this equation is the public key of user, which can be obtained by the CSP(2), the CSP can obtain the , and , and the is computed by CSP(3)The and is generated by CSP
Through the abovementioned points, the CSP can forge an auditing proof. The specific process is as follows:(1)In the audit phase, after receiving the from TPA, the CSP randomly chooses s numbers as .(2)The CSP computes the based on the :and then computes the value of .(3)The CSP randomly selects a number as , and computes (4)With the value of and , the CSP computes :(5)Finally, the CSP generates the forged proof and sends it to the TPA, where .
3.7. Attack II
Our attack II is based on this observation because the CSP can forge the auditing proof without using the blinded data of the user, which has been proved in the attack I. The malicious CSP can even delete the data stored in the cloud server but can still pass the verification of the TPA. Concretely, the attack is as follows:(1)In the storage phase, after receiving the message from the TPA, the CSP verifies the validity of it and the correctness of as the original scheme. If the message is valid and the is correct, the CSP computes:then the CSP deletes the user’s data file.(2)In the audit phase, to verify the integrity of the data in the CSP, TPA sends a challenge to the CSP. Upon receiving the , the CSP generates an auditing proof according to the method in the attack II. Note that the user’s data are not stored when the CSP generates proof at this time(3)After receiving the proof from the CSP, the TPA verifies the correctness of . First, the TPA generates and , where . Then they computebased on the from the CSP. Finally, the TPA verifies the whether the following equation holds:
Because the and in the all are generated by the CSP, here we can prove the forged proof is a valid one for the eq. holds:
4. Our Improved Scheme
In order to resist the abovementioned attack, in this section, we give our improved security scheme. The details of this scheme are as follows.
4.1. A Single-User Scenario
Based on the original scheme, our scheme consists of six algorithms: Setup, KeyGen, SigGen, Challenge, ProofGen, and ProofVer.(1)Setup: the cloud storage system (CSS) inputs a security parameter , and then outputs , which are two large primes. The CSS chooses a secure hash function a multiplicative cyclic group , where the order of is and the generator of is . The CSS sets a and . is the index set of data blocks. Besides, the CSS set two time upper limits and , where is the longest time for CSP to generate auditing proof, is the longest time for the TPA to generate authentication meta set. Finally, the is made public.(2)KeyGen : the identifier of TPA is and . TPA generate their secret and public key . The user generate this secret/public key pair from . Besides, the user chooses random values and keeps them secret.(3)SigGen : this algorithm is run by user, TPA, and CSP, including three subalgorithms SigGen1, SigGen2, and storage.
4.1.1. SigGen 1
The user processes the file and generates the tags of data blocks.
First, the user divided file into data blocks and each data block is divided into segments.
Then, they establishe a unique tag for the file , where the is the signature of the file’s name using .
The user blinds each data blocks to protect the privacy of the file as follows:
Chooses a random value and then compute and , where . Blind each data block :
The blinded file is .
Finally, the user sends to the TPA and sends to CSP.
4.1.2. SigGen 2
The TPA generates authentication meta set for the user.
The TPA choose a key pair , where and . Then, they computeand the HomMAC:
The TPA compute and , and then output , where is random value. Let be the authentication meta set of data blocks for . Then, the TPA send to the CSP and delete the file from their local record.
4.1.3. Storage
The CSP stores file .
When receiving the data from TPA, the CSP records time stamp , and computes:
If , the CSP refuse to store data. Otherwise, they store data.
Next, the CSP computes the validity of by performing the following computations:
If the (26) holds, the CSP returns “Correct” to the user and stores the file, the file tag and . Otherwise, the CSP does not store the file and returns “Error” to the user.
4.1.4. Challenge
The user sends an auditing request to the TPA. If it is validity, the TPA generates an auditing challenge as follows:
The TPA randomly chooses c elements as a subset and chooses a random value for each element . Then, output for . Finally, they send the to the CSP and record the time stamp immediately.
4.1.5. ProofGen
After receiving the , the CSP computes the proof .
The CSP computes:
Then, they generates the proof and sends it to the TPA, where . Note that CSP no longer needs to generate an element of audit proof.
4.1.6. ProofVer
After receiving the proof, the TPA records time stamp immediately and computes . If , stop audit work and return “Expiration” to the CSP. Otherwise, proceed to the following steps.
Compute:
Then, verify the following equation:
If the (29) does not hold, the TPA concludes that the user’s data are corrupted. Otherwise, the TPA believe the user’s data are integrity. Finally, the auditing report is sent to the user.
4.2. A Multiuser Scenario
In edge computing, it is common for multiple end users to apply for an audit at the same time. Compared with the single-user scheme, batch auditing can reduce the computational consumption and thus improve the auditing efficiency. In this section, we extend the scheme in section 6.1 to the one that TPA can conduct batch auditing for multiple users.
Suppose there are N users. They send their auditing requests to the TPA. In the three phases of Setup, KeyGen and SigGen, users, TPA and CSP do the same as described in section 6.1.(1)Challenge: upon receiving the auditing requests, the TPA randomly chooses c elements as a subset and chooses a random value for each element . Then, output , where includes the message of the N users. Finally, they send the to the CSP and record the time stamp immediately.(2)ProofGen : after receiving the from TPA, CSP perform the following calculations:Then, the TPA send auditing proof to the CSP, where .(3)ProofVer : after receiving the proof, the TPA records time stamp immediately and computes . If , stop audit work and return “Expiration” to the CSP. Otherwise, the TPA computes:
Then, compute:
Finally, verify the following equation:
If the (29) does not hold, the TPA concludes that the users’ data is corrupted. Otherwise, the TPA believes the users’ data is integrity. Finally, the auditing reports are sent to the users.
5. Security Analysis
In this section, we first prove the correctness of the improved scheme. Then, we prove that the auditing proof cannot be forged, which proves that our proposed scheme can resist attack I and attack II. The proof process of privacy preserving users’ data can refer to Han’s scheme.
5.1. Correctness
The correctness of verification (8) is proved as follows:
The correctness of verification (11) is elaborated as follows:
The correctness of verification (33) is proved in the following:
5.2. Unforgeability
In our improved scheme, a malicious CSP cannot forge a correct audit proof that can pass the verification of TPA.
Proof. the malicious CSP forge a proof . If it is valid, the (7) will hold.Because is valid, (38) must hold.According to (37) and (38), we can get:In the original scheme, both R and S are calculated by the CSP and sent to the TPA, so the CSP can easily calculates the value of and then forges that makes the (39) hold according to the method in attack 1. However, in our improved scheme, R is generated by TPA, so the (40) must hold.From the abovementioned equations, and must hold. Otherwise, we can easily get the value of when is given. It means that there is a solution of a DLP instance in . However, this contradicts to the proven DLP difficult problem. Therefore, a malicious CSP cannot forge a valid auditing proof to pass the verification of TPA.
5.3. Privacy Preserving
The proposed scheme provides privacy preserving for users’ data.
Proof. before sending the data to TPA and CSP, the user has blinded each data block by using random mask technique as follows:where , , , . The curious TPA or CSP may want to obtain some privacy information of user from the blinded data . Only know the value of for can they do that successfully. However, that computing given is to solve the DLP in , which is infeasible in calculation. Therefore, the curious TPA or CSP have no ability to get privacy information of user’s data.
6. Conclusion
In edge computing, it will do great harm to the running of terminal users if their data stored in the CSP can be deleted without being found. In this paper, we proved that Han’s scheme is not secure because the cloud server provider can successfully forge auditing proof to prove to TPA that it honestly stores users' data. Then, we proposed an improved scheme that can effectively avoid the forgery attack from the cloud server.
In the future, cloud storage auditing schemes will be proposed to adapt to more different situations in edge computing, but we should give more attention to the security of the schemes.
Data Availability
The data of this article are available on request from the authors.
Conflicts of Interest
There are no potential conflicts of interest.
Authors’ Contributions
Zhengge Yi and Lixian Wei contributed equally to this work. Zhengge Yi is responsible for the writing of the article and the construction of new scheme, Lixian Wei is responsible for the derivation of the formulas in the article and gives some significant ideas, Haibin Yang is responsible for the polishing of the language of the article, Xu An Wang gives the main ideas for the writing of this article, Wenyong Yuan is responsible for collecting the information related to this article, and Ruifeng Li is responsible for the verification of the security of this article.
Acknowledgments
This work is supported by the Foundation of Foundation of National Natural Science Foundation of China (No. 62172436), State Key Laboratory of Public Big Data (No. 2019BDKFJJ008), Engineering University of PAP’s Funding for Scientific Research Innovation Team (No. KYTD201805), and Engineering University of PAP’s Funding for Key Researcher (No. KYGG202011).