Identity-Based Distributed Provable Data Possession in Multicloud Storage

Identity-Based Distributed Provable Data
Possession in Multicloud Storage
Huaqun Wang
Abstract—Remote data integrity checking is of crucial importance in cloud storage. It can make the clients verify whether their
outsourced data is kept intact without downloading the whole data. In some application scenarios, the clients have to store their
data on multicloud servers. At the same time, the integrity checking protocol must be efficient in order to save the verifier’s cost. From
the two points, we propose a novel remote data integrity checking model: ID-DPDP (identity-based distributed provable data
possession) in multicloud storage. The formal system model and security model are given. Based on the bilinear pairings, a concrete
ID-DPDP protocol is designed. The proposed ID-DPDP protocol is provably secure under the hardness assumption of the standard
CDH (computational Diffie-Hellman) problem. In addition to the structural advantage of elimination of certificate management,
our ID-DPDP protocol is also efficient and flexible. Based on the client’s authorization, the proposed ID-DPDP protocol can realize
private verification, delegated verification, and public verification.
Index Terms—Cloud computing, provable data possession, identity-based cryptography, distributed computing, bilinear pairings
Ç
1 INTRODUCTION
OVER the last years, cloud computing has become an
important theme in the computer field. Essentially, it
takes the information processing as a service, such as
storage, computing. It relieves of the burden for storage
management, universal data access with independent
geographical locations. At the same time, it avoids of
capital expenditure on hardware, software, and personnel
maintenances, etc. Thus, cloud computing attracts more
intention from the enterprise.
The foundations of cloud computing lie in the outsourc-
ing of computing tasks to the third party. It entails the
security risks in terms of confidentiality, integrity and
availability of data and service. The issue to convince the
cloud clients that their data are kept intact is especially vital
since the clients do not store these data locally. Remote data
integrity checking is a primitive to address this issue. For
the general case, when the client stores his data on
multicloud servers, the distributed storage and integrity
checking are indispensable. On the other hand, the
integrity checking protocol must be efficient in order to
make it suitable for capacity-limited end devices. Thus,
based on distributed computation, we will study distrib-
uted remote data integrity checking model and present the
corresponding concrete protocol in multicloud storage.
1.1 Motivation
We consider an ocean information service corporation
Cor in the cloud computing environment. Cor can
provide the following services: ocean measurement
data, ocean environment monitoring data, hydrological
data, marine biological data, GIS information, etc. Besides
of the above services, Cor has also some private
information and some public information, such as the
corporation’s advertisement. Cor will store these different
ocean data on multiple cloud servers. Different cloud
service providers have different reputation and charging
standard. Of course, these cloud service providers need
different charges according to the different security-
levels. Usually, more secure and more expensive. Thus,
Cor will select different cloud service providers to store
its different data. For some sensitive ocean data, it will
copy these data many times and store these copies on
different cloud servers. For the private data, it will store
them on the private cloud server. For the public
advertisement data, it will store them on the cheap
public cloud server. At last, Cor stores its whole data on
the different cloud servers according to their importance
and sensitivity. Of course, the storage selection will take
account into the Cor’s profits and losses. Thus, the
distributed cloud storage is indispensable. In multicloud
environment, distributed provable data possession is an
important element to secure the remote data.
In PKI (public key infrastructure), provable data pos-
session protocol needs public key certificate distribution
and management. It will incur considerable overheads
since the verifier will check the certificate when it checks
the remote data integrity. In addition to the heavy
certificate verification, the system also suffers from the
other complicated certificates management such as certifi-
cates generation, delivery, revocation, renewals, etc. In
cloud computing, most verifiers only have low computa-
tion capacity. Identity-based public key cryptography can
. The author is with the School of Information Engineering, Dalian Ocean
University, Dalian 116023, China, and also with the State Key Laboratory
of Information Security, Institute of Information Engineering, Chinese
Academy of Sciences, 100049, China. E-mail: wanghuaqun8@gmail.com.
Manuscript received 6 Jan. 2013; revised 5 Apr. 2013; accepted 16 Nov. 2013.
Date of publication 10 Mar. 2014; date of current version 10 Apr. 2015.
For information on obtaining reprints of this article, please send e-mail to:
reprints@ieee.org, and reference the Digital Object Identifier below.
Digital Object Identifier no. 10.1109/TSC.2014.1
1939-1374 Ó 2014 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
IEEE TRANSACTIONS ON SERVICES COMPUTING, VOL. 8, NO. 2, MARCH-APRIL 2015328

eliminate the complicated certificate management. In order
to increase the efficiency, identity-based provable data
possession is more attractive. Thus, it will be very
meaningful to study the ID-DPDP.
1.2 Related Work
In cloud computing, remote data integrity checking is an
important security problem. The clients’ massive data is
outside his control. The malicious cloud server may
corrupt the clients’ data in order to gain more benefits.
Many researchers proposed the corresponding system
model and security model. In 2007, provable data posses-
sion (PDP) paradigm was proposed by Ateniese et al. [1].
In the PDP model, the verifier can check remote data
integrity with a high probability. Based on the RSA, they
designed two provably secure PDP schemes. After that,
Ateniese et al. proposed dynamic PDP model and concrete
scheme [2] although it does not support insert operation.
In order to support the insert operation, in 2009, Erway et al.
proposed a full-dynamic PDP scheme based on the authen-
ticated flip table [3]. The similar work has also been done by
F. Sebe´ et al. [4]. PDP allows a verifier to verify the remote
data integrity without retrieving or downloading the whole
data. It is a probabilistic proof of possession by sampling
random set of blocks from the server, which drastically
reduces I/O costs. The verifier only maintains small
metadata to perform the integrity checking. PDP is an
interesting remote data integrity checking model. In 2012,
Wang proposed the security model and concrete scheme of
proxy PDP in public clouds [5]. At the same time, Zhu et al.
proposed the cooperative PDP in the multicloud storage [6].
Following Ateniese et al.’s pioneering work, many
remote data integrity checking models and protocols
have been proposed [7], [8], [9], [10], [11], [12]. In 2008,
Shacham presented the first proof of retrievability (POR)
scheme with provable security [13]. In POR, the verifier can
check the remote data integrity and retrieve the remote
data at any time. The state of the art can be found in [14],
[15], [16], [17]. On some cases, the client may delegate the
remote data integrity checking task to the third party. It
results in the third party auditing in cloud computing [18],
[19], [20], [21]. One of benefits of cloud storage is to enable
universal data access with independent geographical
locations. This implies that the end devices may be mobile
and limited in computation and storage. Efficient integrity
checking protocols are more suitable for cloud clients
equipped with mobile end devices.
1.3 Contributions
In identity-based public key cryptography, this paper
focuses on distributed provable data possession in multi-
cloud storage. The protocol can be made efficient by
eliminating the certificate management. We propose the
new remote data integrity checking model: ID-DPDP. The
system model and security model are formally proposed.
Then, based on the bilinear pairings, the concrete ID-DPDP
protocol is designed. In the random oracle model, our ID-
DPDP protocol is provably secure. On the other hand, our
protocol is more flexible besides the high efficiency. Based
on the client’s authorization, the proposed ID-DPDP
protocol can realize private verification, delegated verifi-
cation and public verification.
1.4 Paper Organization
The rest of the paper is organized as follows. Section 2
formalizes the ID-DPDP model. Section 3 presents our ID-
DPDP protocol with a detailed performance analysis.
Section 4 evaluates the security of the proposed ID-DPDP
protocol. Finally, Section 5 concludes the paper.
2 SYSTEM MODEL AND SECURITY MODEL
OF ID-DPDP
The ID-DPDP system model and security definition are
presented in this section. An ID-DPDP protocol comprises
four different entities which are illustrated in Fig. 1. We
describe them below:
1. Client: an entity, which has massive data to be
stored on the multicloud for maintenance and
computation, can be either individual consumer or
corporation.
2. CS (Cloud Server): an entity, which is managed by
cloud service provider, has significant storage space
and computation resource to maintain the clients’
data.
3. Combiner: an entity, which receives the storage
request and distributes the block-tag pairs to the
corresponding cloud servers. When receiving the
challenge, it splits the challenge and distributes
them to the different cloud servers. When receiving
the responses from the cloud servers, it combines
them and sends the combined response to the
verifier.
4. PKG (Private Key Generator): an entity, when
receiving the identity, it outputs the corresponding
private key.
First, we give the definition of interactive proof system.
It will be used in the definition of ID-DPDP. Then, we
present the definition and security model of ID-DPDP
protocol.
Definition 1 (Interactive Proof System) [22]. Let c; s :
N ! R be functions satisfying cðnÞ 9 sðnÞ þ ð 1
pðnÞÞ for some
polynomial pðÁÞ. An interactive pair ðP; V Þ is called a
Fig. 1. System model of ID-DPDP.
WANG: IDENTITY-BASED DISTRIBUTED PROVABLE DATA POSSESSION IN MULTICLOUD STORAGE 329

interactive proof system for the language L, with complete-
ness bound cðÁÞ and soundness bound sðÁÞ, if
1. Completeness: for every x 2 L, Pr½hP; V iðxÞ ¼ 1Š !
cðjxjÞ.
2. Soundness: for every x 62 L and every interactive
machine B, Pr½hB; V iðxÞ ¼ 1Š sðjxjÞ.
Interactive proof system is used in the definition of ID-
DPDP, i.e., Definition 2.
Definition 2 (ID-DPDP). An ID-DPDP protocol is a collection
of three algorithms ðSetup; Extract; TagGenÞ and an inter-
active proof system ðProofÞ. They are described in detail
below.
1. Setupð1k
Þ: Input the security parameter k, it outputs the
system public parameters params, the master public key
mpk and the master secret key msk.
2. Extractð1k
; params; mpk; msk; IDÞ: Input the public
parameters params, the master public key mpk, the
master secret key msk, and the identity ID of a client, it
outputs the private key skID that corresponds to the client
with the identity ID.
3. TagGenðskID; Fi; PÞ: Input the private key skID, the
block Fi and a set of CS P ¼ fCSjg, it outputs the tuple
fi; ðFi; TiÞg, where i denotes the i-th record of
metadata, ðFi; TiÞ denotes the i-th block-tag pair. Denote
all the metadata fig as .
4. ProofðP; CðCombinerÞ; V ðVerifierÞÞ: is a protocol
among P, C and V . At the end of the interactive protocol,
V outputs a bit f0j1g denoting false or true.
Besides of the high efficiency based on the communica-
tion and computation overheads, a practical ID-DPDP
protocol must satisfy the following security requirements:
1. The verifier can perform the ID-DPDP protocol
without the local copy of the file(s) to be checked.
2. If some challenged block-tag pairs are modified or
lost, the response can not pass the ID-DPDP protocol
even if P and C collude.
To capture the above security requirements, we define
the security of an ID-DPDP protocol as follows.
Definition 3 (Unforgeability). An ID-DPDP protocol is
unforgeable if for any (probabilistic polynomial) adversary A
(malicious CS and combiner) the probability that A wins the
ID-DPDP game on a set of file blocks is negligible. The ID-
DPDP game between the adversary A and the challenger C
can be described as follows:
1. Setup: The challenger C runs Setupð1k
Þ and gets
ðparams; mpk; mskÞ. It sends the public parameters
and master public key ðparams; mpkÞ to A while it keeps
confidential the master secret key msk.
2. First-Phase Queries: The adversary A adaptively makes
Extract; Hash; TagGen queries to the challenger C as
follows:
. Extract queries. The adversary A queries the
private key of the identity ID. By running
Extractðparams; mpk; msk; IDÞ, the challenger C
gets the private key skID and forwards it to A. Let
S1 denote the extracted identity set in the first-
phase.
. Hash queries. The adversary A queries hash
function adaptively. C responds the hash values
to A.
. TagGen queries. The adversary A makes block-tag
pair queries adaptively. For a block tag query Fi, the
challenger calculates the tag Ti and sends it back to
the adversary. Let ðFi; TiÞ be the queried block-tag
pair for index i 2 I1, where I1 is a set of indices that
the corresponding block tags have been queried in the
first-phase.
3. Challenge: C generates a challenge chal which defines a
ordered collection fIDÃ
; i1; i2; . . . ; icg, where IDÃ
62 S1,
fi1; i2; . . . ; icg 6 I1, and c is a positive integer. The
adversary is required to provide the data possession proof
for the blocks Fi1
; . . . ; Fic
.
4. Second-Phase Queries: Similar to the First-Phase
Queries. Let the Extract query identity set be S2 and
the TagGen query index set be I2. The restriction is that
fi1; i2; . . . ; icg 6 ðI1 [ I2Þ and IDÃ
62 ðS1 [ S2Þ.
5. Forge: The adversary A responses for the challenge
chal.
We say that the adversary A wins the ID-DPDP game if
the response can pass C’s verification.
Definition 3. States that, for the challenged blocks, the
malicious CS or C cannot produce a proof of data possession
if the blocks have been modified or deleted. On the other hand,
the definition does not state clearly the status of the blocks
that are not challenged. In practice, a secure ID-DPDP
protocol also needs to convince the client that all of his
outsourced data is kept intact with a high probability. We give
the following security definition.
Definition 4 (ð; Þ Security). An ID-DPDP protocol is
ð; Þ secure if the CS corrupted fraction of the whole blocks,
the probability that the corrupted blocks are detected is at
least .
The notations throughout this paper are listed in Table 1.
3 THE PROPOSED ID-DPDP PROTOCOL
In this section, we present an efficient ID-DPDP protocol. It
is built from bilinear pairings which will be briefly
reviewed below.
3.1 Bilinear Pairings
Let G1 and G2 be two cyclic multiplicative groups with the
same prime order q. Let e : G1 Â G1 ! G2 be a bilinear map
[25] which satisfies the following properties:
1. Bilinearity: 8g1; g2; g3 2 G1 and a; b 2 Zq,
eðg1; g2g3Þ ¼ eðg2g3; g1Þ ¼ eðg2; g1Þeðg3; g1Þ
e g1
a
; g2
b
À Á
¼ eðg1; g2Þab
:
2. Non-degeneracy: 9g4; g5 2G1 such that eðg4; g5Þ 6¼ 1G2
.

3. Computability: 8g6; g7 2 G1, there is an efficient
algorithm to calculate eðg6; g7Þ.
Such a bilinear map e can be constructed by the modified
Weil [23] or Tate pairings [24] on elliptic curves. Our ID-
DPDP scheme relies on the hardness of CDH (Computa-
tional Diffie-Hellman) problem and the easiness of DDH
(Decisional Diffie-Hellman) problem. They are defined
below.
Definition 5 (CDH Problem on G1). Let g be the generator
of G1. Given g; ga
; gb
2 G1 for randomly chosen a; b 2 Zq,
calculate gab
2 G1.
Definition 6 (DDH Problem on G1). Let g be the generator of
G1. Given ðg; ga
; gb
; ^gÞ 2 G4
1 for randomly chosen a; b 2 ZÃ
q,
decide whether gab
¼
?
^g.
In the paper, the chosen group G1 satisfies that CDH
problem is difficult but DDH problem is easy. The DDH
problem can be solved by making use of the bilinear
pairings. Thus, ðG1; G2Þ are also defined as GDH (Gap
Diffie-Hellman) groups.
3.2 The Concrete ID-DPDP Protocol
This protocol comprises four procedures: Setup, Extract,
TagGen, and Proof. Its architecture can be depicted in
Fig. 2. The figure can be described as follows:
1. In the phase Extract, PKG creates the private key for
the client.
2. The client creates the block-tag pair and uploads it
to combiner. The combiner distributes the block-tag
pairs to the different cloud servers according to the
storage metadata.
3. The verifier sends the challenge to combiner and the
combiner distributes the challenge query to the
corresponding cloud servers according to the stor-
age metadata.
4. The cloud servers respond the challenge and the
combiner aggregates these responses from the cloud
servers.
The combiner sends the aggregated response to the
verifier. Finally, the verifier checks whether the aggregated
response is valid.
The concrete ID-DPDP construction mainly comes from
the signature, provable data possession and distributed
computing. The signature relates the client’s identity with
his private key. Distributed computing is used to store the
client’s data on multicloud servers. At the same time,
distributed computing is also used to combine the multi-
cloud servers’ responses to respond the verifier’s chal-
lenge. Based on the provable data possession protocol [13],
the ID-DPDP protocol is constructed by making use of the
signature and distributed computing.
Without loss of generality, let the number of stored
blocks be n. For different block Fi, the corresponding tuple
ðNi; CSli
; iÞ is also different. Fi denotes the i-th block.
Denote Ni as the name of Fi. Fi is stored in CSli
where li is
the index of the corresponding CS. ðNi; CSli
; iÞ will be used
to generate the tag for the block Fi. The algorithms can be
described in detail below.
TABLE 1
Notations and Descriptions
Fig. 2. Architecture of our ID-DPDP protocol.

. Setup: Let g be a generator of the group G1 with the
order q. Define the following cryptographic hash
functions:
H : f0; 1gÃ
! ZÃ
q
h : f0; 1gÃ
Â ZÃ
q ! G1
h1 : f0; 1gÃ
! ZÃ
q:
Let f be a pseudo-random function and be a
pseudo-random permutation. They can be described
in detail below
f : ZÃ
q Â f1; 2; . . . ; ng ! ZÃ
q
: ZÃ
q Â f1; 2; . . . ; ng ! f1; 2; . . . ; ng:
PKG picks a random number x 2 ZÃ
q and calculates
Y ¼gx
. The parameters fG1; G2; e; q; g; Y; H; h; h1; f; g
are made public. PKG keeps the master secret key x
confidential.
. Extract: Input the identity ID, PKG picks r 2 ZÃ
q and
calculates
R ¼ gr
; ¼ r þ xHðID; RÞ mod q:
PKG sends the private key skID ¼ ðR; Þ to the client
by the secure channel. The client can verify the
correctness of the received private key by checking
whether the following equation holds
g
¼
?
RY HðID;RÞ
: (1)
If the formula (1) holds, the client ID accepts the
private key; otherwise, the client ID rejects it.
. TagGenðskID; F; PÞ: Split the whole file F into n
blocks, i.e., F ¼ ðF1; F2; . . . ; FnÞ. The client prepares
to store the block Fi in the cloud server CSli
. Then,
for 1 i n, each block Fi is split into s sectors, i.e.,
Fi ¼ f ~Fi1; ~Fi2; . . . ; ~Fisg. Thus, the client gets n Â s
sectors f ~Fijgi2½1;nŠ;j2½1;sŠ. Picks s random u1; u2; . . . ;
us 2 G1. Denote u ¼ fu1; u2; . . . ; usg. For Fi, the client
performs the procedures below:
1. The client calculates Fij ¼ h1ð ~FijÞ for every
sector ~Fij; 1 j s.
2. The client calculates
Ti ¼ h Ni; CSli
; ið Þ
Ys
j¼1
u
Fij
j
!
:
3. The client adds the record i ¼ ði; u; Ni; CSli
Þ to
the table Tcl. It stores Tcl locally.
4. The client sends the metadata table Tcl to the
combiner. The combiner adds the records of Tcl
to its own metadata table To.
5. The client outputs Ti and stores ðFi; TiÞ in CSli
.
. ProofðP; C; VÞ: This is a 5-move protocol among
P ¼ fCSigi2½1;^nŠ), C, and V with the input (public
parameters, Tcl). If the client delegates the verification
task to some verifier, it sends the metadata table Tcl
to the verifier. Of course, the verifier may be the
third auditor or the client’s proxy. The interaction
protocol can be given in detail below.
1. Challenge 1 ðC VÞ: the verifier picks the
challenge chal ¼ ðc; k1; k2Þ where 1 c n; k1;
k2 2 ZÃ
q and sends chal to the combiner C;
2. Challenge 2 ðP CÞ: the combiner calculates
vi ¼ k1
ðiÞ; 1 i c and looks up the table To to
get the records that correspond to fv1; v2; . . . ;
vcg ¼ M1
S
M1
S
Á Á Á
S
M^n. Mi denotes the in-
dex set where the corresponding block-tag pair
is stored in CSi. Then, C sends ðMi; k2Þ to
CSi 2 P.
3. Response1 ðP ! CÞ: For CSi 2 P, it performs the
procedures below:
. For vl 2 Mi, CSi splits Fvl
into s sectors Fvl
¼
f ~Fvl1; ~Fvl2; . . . ; ~Fvlsg and calculates Fvlj ¼
h1ð ~FvljÞ for 1 j s. (Note: Fvlj ¼ h1ð ~FvljÞ
can also be pre-computed and stored by CS).
. CSi calculates al ¼ fk2
ðlÞ; vl 2 Mi and
TðiÞ
¼
Y
vl2Mi
Tvl
al
:
. For 1 j s, CSi calculates
^F
ðiÞ
j ¼
X
vl2Mi
alFvlj:
Denote ^F
ðiÞ
¼ ð ^F
ðiÞ
1 ; . . . ; ^F
ðiÞ
s Þ.
. CSi sends i ¼ ð ^F
ðiÞ
; TðiÞ
Þ to C.
4. Response2 ðC ! VÞ: After receiving all the
responses from CSi 2 P, the combiner aggre-
gates figCSi2P into the final response as
T ¼
Y
CSi
TðiÞ
; ^Fl ¼
X
CSi
^F
ðiÞ
l :
Denote ^F ¼ ð ^F1; ^F2; . . . ; ^FsÞ. The combiner sends
¼ ð ^F; TÞ to the verifier V .
5. After receiving the response ¼ ð ^F; TÞ, the
verifier calculates
vi ¼ k1
ðiÞ
hi ¼ h Nvi
; CSlvi
; vi

ai ¼ fk2
ðiÞ:
Then, it verifies whether the following formula
holds.
eðT; gÞ ¼
?
e
Yc
i¼1
hai
i
Ys
j¼1
u
^Fj
j ; RY HðID;RÞ
!
: (2)
If the formula (2) holds, then the verifier outputs
‘‘success’’. Otherwise, the verifier outputs
‘‘failure’’.
3.2.1 Notes
In ProofðP; C; VÞ, the verifier picks the challenge chal ¼
ðc; k1; k2Þ where k1; k2 are randomly chosen from ZÃ
q. Based
on the challenge chal, the combiner determines the chal-
lenged block index set as fv1; v2; . . . ; vcg where vi ¼k1
ðiÞ;
1 i c. Since k1
ðÁÞ is a pseudo-random permutation

determined by the random k1, the challenged c block-tag
pairs come from the random selection of the n stored block-
tag pairs.
3.2.2 Correctness
An ID-DPDP protocol must be workable and correct. That
is, if the PKG, C, V and P are honest and follow the
specified procedures, the response can pass V ’s checking.
The correctness follows from below:
eðT; gÞ ¼ e
Y
CSi
TðiÞ
; g
!
¼ e
Y
CSi
Y
vl2Mi
T
fk2
ðlÞ
vl ; g
!
¼ e
Y
CSi
Y
vl2Mi
hal
l
Ys
j¼1
u
alFvlj
j
!
; g
!
¼ e
Yc
i¼1
hai
i
!
Ys
j¼1
u
^Fj
j ; RY HðID;RÞ
!
:
3.3 Performance Analysis
First, we analyze the performance of our proposed ID-
DPDP protocol from the computation and communication
overhead. We compare our ID-DPDP protocol with the
other up-to-date PDP protocols. On the other hand, our
protocol does not suffer from resource-consuming certifi-
cate management which is require by the other existing
protocols. Second, we analyze our proposed ID-DPDP
protocol’s properties of flexibility and verification. Third,
we give the prototypal implementation of the proposed ID-
DPDP protocol.
3.3.1 Computation
Suppose there are n message blocks which will be stored in ^n
cloud servers. The block’s sector number is s. The challenged
block number is c. We will consider the computation
overhead in the different phases. On the group G1, bilinear
pairings, exponentiation, multiplication, and the hash func-
tion h1 (the input may be large data, such as, 1 G byte)
contribute most computation cost. Compared with them, the
hash function h, the operations on Zq and G2 are faster, the
hash function H can be done once for all. Thus, we do not
consider the hash functions h and H, the operations on Zq
and G2. On the client, the computation cost mainly comes
from the procedures of TagGen and Verification (i.e., the
phase 5 in the protocol ProofðP; C; VÞ). In the phase TagGen,
the client performs nðs þ 1Þ exponentiation, ns multiplica-
tion on G1, ns hash function h1 and n hash function h. At the
same time, for every file, the corresponding record i is
stored by the client and C. These stored metadata is small. In
the phase Proof, in order to respond the challenge
chal ¼ ðc; k1; k2Þ and generate the response , P and the
combiner C perform c exponentiation, c À 1 multiplication
on the group G1 and cs hash function h1. In the verification of
the response , V performs c þ s þ 1 exponentiation, 2
pairings, c þ s multiplication on the group G1 and c hash
function h. The exponentiation and multiplication opera-
tions are more efficient than pairing [26]. Based on the test
presented in [27], [28], [29], a Tate pairing operation
consumes about 10 ms on a platform with PIII 3.0 GHz,
30 ms on a platform with Pentium D 3.0 GHz and 170 ms on
an iMote2 sensor working at 416 MHz. On the other hand, in
2012, Zhu et al. proposed the cooperative provable data
possession for integrity in multicloud storage [6]. Almost at
the same time, Zhu et al. proposed the dynamic audit
services for outsourced storages in clouds [21]. In 2012,
Barsoum et al. proposed a provable multicopy data posses-
sion protocol [30]. These three PDP protocols are designed in
the PKI. Thus, the certification verification is necessary when
these three PDP protocols are performed. Compared with
them, our proposed ID-DPDP scheme is more efficient in the
computation cost. The computation comparison can be
summarized in Table 2. In Table 2, Cexp denotes the time
cost of exponentiation on the group G1; Cmul denotes the
time cost of multiplication on the group G1; Ce denotes the
time cost of bilinear pairing; Ch1
denotes the time cost of
the hash function h1. In other schemes, the sector must be in
Zq. Our scheme only requires the hash function h1’s value
lies in Zq. Thus, the hash function h1 can be used to generate
less block-tag pairs for the same file. Less block-tag pairs
only incur less computation cost. It shows that our protocol
can be implemented in mobile devices which have limited
computation power.
3.3.2 Communication
National Bureau of Standards and ANSI X9 have deter-
mined the shortest key length requirements: RSA and DSA
is 1024 bits, ECC is 160 bits [31]. Based on the requirements,
we give our ID-DPDP protocol’s communication overhead.
In the phase Proof, the communication overhead mainly
comes from the challenge chal and response. The block-tag
pairs are uploaded once and for all. After that, the phase
Proof will be performed periodically. Thus, the communi-
cation overheads mainly come from the ID-DPDP queries
and responses. Suppose there are n message blocks are
stored in the CS. G1 and G2 have the same order q. In ID-
DPDP query, the verifier sends the challenge chal ¼ ðc;
k1; k2Þ to combiner, i.e., the communication overhead is
log2 n þ 2 log2 q. In the response, the combiner responds 1
element in G1 and s elements in ZÃ
q to the verifier. On the other
TABLE 2
Comparison of Computation Cost

hand, Zhu et al. [6], Zhu et al. [21], and Barsoum et al. [30]
proposed three different provable data possession scheme.
Compared with these three schemes, our ID-DPDP scheme is
more efficient in the communication cost. The communication
comparison can be summarized in Table 3. In Table 3, 1G1
denotes one element of G1 and 1G2 denotes one element of G2.
3.3.3 Flexibility
In the ID-DPDP protocol, one block is split into s sectors.
Then, the hash function h1 will be used on these sectors.
These hash values are shorter than the order q of G1. Denote
k ¼ log2 q. Let h1 be h1 : f0; 1g
~k
! f0; 1gk
. This property
makes our ID-DPDP protocol more flexible between
storage overhead and computation overhead. For example,
for the file F, the client divides it into n blocks which will be
split into s sectors. The hash function h1 will be used on
these sectors. Thus, ~ks ¼ jFj=n. In order to save the storage
space, the client will divide F into less blocks because every
block corresponds to one block-tag pair. Thus, s ¼ jFj=n~k
will increase when n decreases. The picked public para-
meters uj; 1 j s will become more. These parameters
will incur more computation cost with less storage cost.
And vice versa. When s decreases, n increases. The
computation cost will decrease along with the storage
cost increases. Thus, our ID-DPDP protocol has the
flexibility to adjust the computation cost and storage cost.
3.3.4 Private Verification, Delegated Verification, and
Public Verification
Our proposed ID-DPDP protocol satisfies the private
verification and public verification. In the verification
procedure, the metadata in the table Tcl and R are
indispensable. Thus, it can only be verified by the client
who has Tcl and R i.e., it has the property of private
verification. On some cases, the client has no ability to
check its remote data integrity, for example, he takes part in
the battle in the war. Thus, it will delegate the third party to
perform the ID-DPDP protocol. The third party may be the
third auditor or the proxy or other entities. The client will
send Tcl and R to the consignee. The consignee can perform
the ID-DPDP protocol. Thus, it has the property of
delegated verification. On the other hand, if the client
makes Tcl and R public, every entity can perform the ID-
DPDP protocol by himself. Thus, it has also the property of
public verification.
3.3.5 Notes
In the verification, the verifier must have Tcl and R. Tcl
stores the metadata which has no any information on the
private key ðR; Þ. On the other hand, even if R is made
public, the private key still keeps secret. The private key
extraction process Extract is actually a modified ElGamal
signature scheme which is existentially unforgeable. For
the identity ID, the corresponding private key ðR; Þ is a
signature on ID. Since it is existentially unforgeable, the
private key still keeps secret even if R is made public.
Thus, the client can generate the tags for different files with
the same private key even if it makes Tcl and R public.
3.3.6 Simulation
In order to study its prototypal implementation, we have
simulated the proposed ID-DPDP protocol by using C
programming language with GMP Library (GMP-5.0.5)
[33], Miracl Library [34] and PBC Library (pbc-0.5.13) [35].
In the simulation, CS works on an ASUS S56C Laptop with
the following settings:
. CPU: Intel Core i7-3517U@1.90 GHz;
. Physical Memory: 4 GB DDR3 1600 MHz;
. OS: Ubuntu 13.04 Linux 3.8.0-19-generic SMP i686.
The client works on an PC Laptop with the following
settings:
. CPU: CPU I PDC E6700 3.2 GHz;
. Physical Memory: DDR3 2G;
. OS: Ubuntu 11.10 over VMware-workstation-
full-8.0.0.
In the simulation, we choose an elliptic curve with 160-bit
group order, which provides a competitive security level
with 1024-bit RSA. The certification verification scheme
comes from the IEEE P1363 (Hybrid Schemes) [36].
In order to describe our ID-DPDP protocol’s computa-
tion performance, we compare our ID-DPDP with Zhu’s
scheme [6]. Fig. 3 depicts the comparison on computation
cost for TagGen based on the sector number s ¼ 20. X-label
denotes the block number n and Y-label denotes the time
cost (second) in order to generate n tags. It is easily
observed that our ID-DPDP protocol becomes more
efficient along with the block number n increases. Fig. 4
depicts the comparison on computation cost for Verify
TABLE 3
Comparison of Communication Cost (Bits)
Fig. 3. Comparison on computation cost for TagGen based on s ¼ 20.

based on the same sector number s ¼ 20. X-label denotes
the challenged block number c and Y-label denotes the time
cost (second) in order to verify the response. Fig. 5 depicts
the comparison on CS computation cost for response based
on the sector number s = 20 and the CS number be ^n ¼ 10,
i.e., jPj ¼ ^n. X-label denotes the challenged block number
c and Y-label denotes the time cost (second) in order to
create the response. They also show that our ID-DPDP
scheme is more efficient than Zhu’s scheme [6]. Then, we
describe our ID-DPDP protocol’s communication perfor-
mance by comparing our ID-DPDP with Zhu’s scheme [6].
Fig. 6 depicts the comparison on communication cost for
challenge based on the challenged block number c ¼ 10.
X-label denotes the whole block number n and Y-label
denotes the communication cost (bit) of challenge. Fig. 7
depicts the comparison on communication cost for re-
sponse. X-label denotes the sector number s and Y-label
denotes the communication cost (bit) of response from the
combiner. From Figs. 6 and 7, our ID-DPDP has shorter
communication length.
In order to show the feasibility of our proposed
scheme in concrete terms, we assume that the client
will store 50 Tbyte data to CS. The order q of G1 and G2 is
160 bit. We take use of the hash function h which comes
from the [37]. Let the hash functions h1 be SHA À 1 which
maps 1 G byte to 160 bit. Let the hash function H be also
SHA À 1. Let the sector number s be 1. Thus, 50 Tbyte data
can be split into 50 Ã 1024 blocks. The elliptic curve G1 is the
Type A whose order is 160 bit and point size is 128 byte
[35]. In the phase TagGen, the whole computation cost is
50Ã1024 Ã ð2Cexp þ Cmul þ Ch þ Ch1
Þ. Based on the 100 sim-
ulation, the average computation cost is 17.5535 hours.
Now, there are 50 Ã 1024 ¼ 101 200 blocks are stored in CS.
Suppose there are 1000 block-tag pairs are corrupted. If 230
block-tag pairs are challenged, the corrupted block-tag
pairs can be detected with the probability at least 90 percent
(Theorem 2). Thus, the challenge is chal ¼ ð230; k1; k2Þ. In
the response, CS will perform c ¼ 230 exponentiation and
c À 1 ¼ 229 multiplication on the group G1 (We omit the
Fig. 4. Comparison on computation cost for verify based on s ¼ 20.
Fig. 5. Comparison on computation cost for CS’s response based on
s ¼ 20, ^n ¼ 10.
Fig. 6. Comparison on communication cost for Chal based on c ¼ 10.
Fig. 7. Comparison on communication cost for response.

hash function h1 since it can be pre-computed). The whole
time cost is 0.5 s. In the verification, the client will perform 2
pairings, c þ 1 ¼ 231 exponentiation, c þ 1 ¼ 231 addition
on the group G1 and 1 hash function H. The whole time cost
is 1.08 s. On the other hand, we consider the communication
cost. For 50 Tbyte data, the whole block-tag pairs are
50 Ã 10244
þ 50 Ã 1024 Ã 128 byte. The redundancy rate is
1:2 Ã 10À7
. In the local area network with the bandwidth
1000 Mb/s, in order to upload these block-tag pairs, the time
cost is 116.509 hours. The challenge size is log2ð101200Þþ
160 þ 160 ¼ 337 bit and the response size is ð1G þ 128Þ Ã 8 ¼
8:6 Ã 109
bit. The whole time cost is 8.2 s. From the
computation technology and communication technology,
our proposed ID-DPDP scheme is feasible.
4 SECURITY ANALYSIS
The security of our ID-DPDP protocol mainly consists of
the correctness and unforgeability. The property of
correctness has been shown in the Section 3.2. On the other
hand, we study the universal unforgeability. It means that
the attacker includes all the cloud servers P and the
combiner C. If our ID-DPDP protocol is universally
unforgeable, it can also prevent the collusion of malicious
cloud servers P and C. Our proof comprises two parts:
single block-tag pair is universally unforgeable; the
response is universally unforgeable.
Definition 7. A forger A ðt; ; QH; Qh; Qh1
; QE; QT Þ-breaks a
single tag scheme if it runs in time at most t; A makes at most
QH queries to the hash function H, at most Qh queries to the
hash function h, at most Qh1
queries to the hash function h1,
at most QE queries to the extraction oracle Extract, at most
QT queries to the tag oracle TagGen; and the probability that
A forges a valid block-tag pair is as least . A single tag
scheme is ðt; ; QH; Qh; Qh1
; QE; QT Þ-existentially unforge-
able under an adaptive chosen-message attack if no forger
ðt; ; QH; Qh; Qh1
; QE; QT Þ-breaks it.
The following Lemma 1 shows that the single tag
scheme is secure.
Lemma 1. Let ðG1; G2Þ be a ðt0
; 0
Þ-GDH group pair of order q.
Then the tag scheme on ðG1; G2Þ is ðt; ; QH; Qh;
Qh1
; QE; QT Þ-secure against existential forgery under an
adaptive chosen-block attack (in the random oracle
model) for all t and satisfying 0
! 1=9 and t0
23ðQH þQhÞðtþOðQH ÞþOðQEÞþOðQhÞþOðQh1
ÞþOðQT ÞÞ
ð1ÀÞQE ð1ÀÞQT
, where 0 G ;
G 1. Based on the difficulty of the CDH problem, our single
tag scheme is secure.
Proof. Let the stored index-block pair set be fð1; F1Þ; ð2; F2Þ;
. . . ; ðn; FnÞg. For 1 i n, each block Fi is split into s
sectors, i.e., Fi ¼ f ~Fi1; ~Fi2; . . . ; ~Fisg. Then, the hash
function h1 is used on these sectors, i.e., Fij ¼ h1ð ~FijÞ.
Then, we get the hash value set fFijg. Let the selected
identity set be I ¼ fID1; ID2; . . . ; ID~ng. We show how to
construct a t0
-algorithm B that solves CDH problem on
G1 with probability at least 0
. This will contradict the
fact that ðG1; G2Þ are GDH group pair.
Algorithm B is given ðg; ga
; gb
Þ 2 G3
1. Its goal is to
output gab
2 G1. Algorithm B simulates the challenger
and interacts with forger A as follows.
Setup. Algorithm B starts by setting the master public
key as Y ¼ ga
while a keeps unknown. It initializes the
three tables Tab1, Tab2, and Tab3. Then, it picks the two
parameters and from the interval (0, 1).
H-Oracle. At any time algorithm A can query the
random oracle H. To respond to these queries, algorithm B
maintains a list of tuples ðIDj; Rj; HjÞ as explained below.
We refer to this list as Tab1. When A queries the oracle H at
the pair ðIDj; RjÞ, algorithm B responds as follows:
1. If ðIDj; Rj; ÃÞ 2 Tab1, then algorithm B retrieves the
tuple ðIDj; Rj; HjÞ and responds with Hj, i.e.,
HðIDj; RjÞ ¼ Hj.
2. Otherwise, B picks a random Hj 2 Zq. Then, it adds
the tuple ðIDj; Rj; HjÞ to Tab1 and responds to A by
setting HðIDj; RjÞ ¼ Hj.
Extract-Oracle. At any time algorithm A can query the
oracle Extract. To respond to these queries, algorithm B
maintains a list of tuples ðci; IDi; Ri; Hi; iÞ as explained
below. We refer to this list as Tab2. When A queries the
oracleExtractattheidentityIDi 2 I,algorithmBpicksabit
ci 2 f0; 1g according to the bivariate distribution function:
Pr½ci ¼ 0Š ¼ , Pr½ci ¼ 1Š ¼ 1 À . Based on ci, B responds
as follows:
1. If ci ¼ 1, B independently picks the random
i; Hi 2 Zq and calculates Ri ¼ gi
Á Y ÀHi
.
. If ðIDi; Ri; Þ 62 Tab1, then algorithm B adds the
tuple ðIDi; Ri; HiÞ to Tab1 and the tuple ðci; IDi;
Ri; Hi; iÞ to Tab2.
. If ðIDi; Ri; ÃÞ 2 Tab1, then algorithm B picks the
other random i; Hi 2 Zq and calculates Ri ¼
gi
ÁY ÀHi
until ðIDi; Ri; ÃÞ62Tab1. Then, algorithm
B adds the tuple ðIDi; Ri; HiÞ to Tab1 and the
tuple ðci; IDi; Ri; Hi; iÞ to Tab2.
. Finally, algorithm B responds with ðRi; iÞ.
2. If ci ¼ 0, algorithm B independently picks a random
Ri 2 G1 and calculates Hi ¼ HðIDi; RiÞ which satis-
fies ðIDi; Ri; ÃÞ 62 Tab1 (otherwise, picks another Ri
and calculates HðIDi; RiÞ). Then, B adds the tuple
ðIDi; Ri; HiÞ to Tab1 and the tuple ðci; IDi; Ri; Hi; iÞ
to Tab2, where i ¼?. B fails.
h-Oracle. At any time algorithm A can query the
random oracle h. To respond to these queries, algorithm
B maintains a list of tuples ðNi; CSli
; i; zi; bi; diÞ as explained
below. We refer to this list as Tab3. When A queries the
oracle h at the tuple ðNi; CSli
; iÞ, B responds as follows:
1. If ðNi; CSli
; i; zi; bi; diÞ 2 Tab3 and 1 i n, then
algorithm B responds with zi
Qs
j¼1 u
ÀFij
j , i.e.,
hðNi; CSli
; iÞ ¼ zi
Qs
j¼1 u
ÀFij
j .
2. Otherwise, algorithm B picks a random bi 2 ZÃ
q and
a random coin di 2 f0; 1g according to the bivariate
distribution Pr½di ¼ 0Š ¼ , Pr½di ¼ 1Š ¼ 1 À .
. If di ¼ 1, algorithm B calculates zi ¼ gbi
. If di ¼ 0,
algorithm B calculates zi ¼ ðgb
Þ
bi
.

. Algorithm B adds the tuple ðNi; CSli
; i; zi; bi; diÞ
to Tab3 and responds with zi
Qs
j¼1 u
ÀFij
j , i.e.,
hðNi; CSli
; iÞ ¼ zi
Qs
j¼1 u
ÀFij
j .
h1-Oracle. Upon receiving the query ^F, B takes a
random value from Zq and responds it to A. It is a real
hash function.
TagGen-Oracle. Let ðNi; CSli
; i; FiÞ be a tag query issued
by A. Algorithm B responds to this query as follows:
1. Algorithm B runs the above algorithm for respond-
ing to h-queries to obtain hðNi; CSli
; iÞ. Let ðNi; CSli
;
i; zi; bi; ciÞ be the corresponding tuple in Tab3. If di ¼
0, then algorithm B reports failure and terminates.
2. If di ¼ 1, define i ¼ ðga
Þbi
. Observe that Ti ¼ ðga
Þbi
¼
ðgbi
Þ
a
¼ ðhðNi; CSli
; iÞ
Qs
j¼1 u
Fij
j Þ
a
and therefore Ti is a
valid tag on Fi under the public key ðga
; u1; Á Á Á ; usÞ.
Algorithm B gives Ti to algorithm A.
Output. Eventually, on behalf of the client ID whose
private key is ðR; Þ, algorithm A produces a block-tag pair
ðFw; TwÞ such that no tag query was issued for ðNw; CSlw
;
w; FwÞ. If ðNw; CSlw
; w; ÃÞ 62 Tab3, B issues a query itself for
hðNw; CSlw
; wÞ to ensure that such a tuple exists. We
assume Tw is a valid tag on Fw under the given public key;
if it is not, B reports failure and terminates. Next, B finds
the tuple ðNw; CSlw
; j; zw; bw; dwÞ in Tab3. If dw ¼ 1, B
reports failure and terminates. Otherwise, dw ¼ 0, ðFw; TwÞ
satisfies the following verification equation
ðTw; gÞ ¼ e h Nw; CSlw
; wð Þ
Ys
j¼1
u
h1ðFwjÞ
j ; RY HðID;RÞ
!
:
This completes the description of algorithm B. It remains
to show that B solves the given instance of the CDH
problem with a high probability.
Breaking CDH: Based on the oracle-replay technique
[32], B can get another block-tag pair ðFw; ^TwÞ on the same
block Fw by using different hash functions ^h and ^H. Then, we
can get eð ^Tw;gÞ¼eð^hðNw;CSlw
;wÞ
Qs
j¼1 u
h1ðFwjÞ
j ;RY HðID;RÞ
Þ.
According to the simulation, B knows the
corresponding bw; ^bw that satisfy
h Nw; CSlw
; wð Þ ¼ ðgb
Þ
bw
Ys
j¼1
u
Àh1ðFwjÞ
j
^h Nw; CSlw
; wð Þ ¼ ðgb
Þ
^bw
Ys
j¼1
u
Àh1ðFwjÞ
j :
Thus, we can get
eðTw; gÞ ¼ e ðgb
Þ
bw
; RY HðID;RÞ

eð ^Tw; gÞ ¼ e ðgb
Þ
^bw
; RY
^HðID;RÞ

e Tw
^Tw
Àbw
^bw ; g

¼ e ðgb
Þ
bw
; Y HðID;RÞÀ ^HðID;RÞ

:
Finally, we get
gab
¼ Tw
^Tw
Àbw
^bw
1
bw HðID;RÞÀ ^HðID;RÞð Þ
:
Probability Analysis. To evaluate the success probabil-
ity for algorithm B, we analyze the four events needed
for B to succeed:
. E1: B does not abort as a result of any of A’s Extract
queries.
. E2: B does not abort as a result of any of A’s tag
queries.
. E3: A generates a valid block-tag forgery ðFw; TwÞ.
. E4: Event E3, cw ¼ 0 for the tuple containing Fw in
Tab2 and dw ¼ 0 for the tuple containing Fw in Tab3.
B succeeds if all of these events happen. The
probability Pr½E1 ^ E2 ^ E3 ^ E4Š decomposes as
Pr½E1 ^ E2 ^ E3 ^ E4Š
¼ Pr½E1Š Pr½E2jE1Š Pr½E3jE1; E2Š Pr½E4jE1; E2; E3Š
¼ ð1 À ÞQE
Á ð1 À ÞQT
Á Á Á :
Thus, in B’s simulation environment, A can forge a
valid block-tag pair with probability
^ ! P1 ¼ ð1 À ÞQE
ð1 À ÞQT
:
Algorithm B’s running time is the same as A’s running
time plus the time which is taken to respond to QH H
queries, Qh h queries, Qh1
h1 queries, QE Extract queries
and QT tag queries. Hence, the total running time is at most
^t t þ OðQHÞ þ OðQEÞ þ OðQhÞ þ OðQh1
Þ þ OðQT Þ. B y
taking use of the oracle replay technique [32], A can get
two different tags on the same block and randomness with
the probability0
! 1=9withinthetimet0
23ðQH þQhÞ^t^À1
,
i.e., t0 23ðQH þQhÞðtþOðQH ÞþOðQEÞþOðQhÞþOðQh1
ÞþOðQT ÞÞ
ð1ÀÞQE ð1ÀÞQT
. After
obtaining the two different tags on the same block and
randomness, algorithm B can break the CDH problem. It
contradicts the assumption that ðG1; G2Þ is a GDH group
pair. This completes the proof. Ì
Lemma 1 states that the untrusted CS has no ability to
forge the single tag. But, can the untrusted CS forge the
aggregated block-tag pair to cheat the verifier? First, when all
the stored block-tag pairs are challenged, we study whether
the untrusted CS can aggregate the fake block-tag pairs to
cheat the verifier. It corresponds to Lemma 2. Second, when
some stored block-tag pairs are not challenged, we study
whether the untrusted CS can substitute the valid unchal-
lenged block-tag pairs for the modified block-tag pairs to
cheat the verifier. It corresponds to Lemma 3.
Lemma 2. If all the stored block-tag pairs are challenged
and some block-tag pairs are modified, the malicious CS
aggregates the fake block-tag pairs which are different from
the challenged block-tag pairs. The combined block-tag pair
ð ^F; TÞ (i.e., response) only can pass the verification with
negligible probability.
Proof. We can use proof by contradiction to prove Lemma 2.
For the challenge chal ¼ ðc; k1; k2Þ, the following para-
meters can be calculated
vi ¼ k1
ðiÞ; hi ¼ h Nvi
; CSlvi
; vi

; ai ¼ fk2
ðiÞ:

Assume the combined block-tag pair ð ^F; TÞ is forged
and it can pass the verification, where ^F ¼ ð ^F1; . . . ; ^FsÞ, i.e.,
eðT; gÞ ¼ e
Yc
i¼1
hai
i
Ys
j¼1
u
^Fj
j ; RY HðID;RÞ
!
¼ e
Yc
i¼1
hai
i
Ys
j¼1
u
Pc
i¼1
ai
^Fvij
j ; RY HðID;RÞ
!
:
Then,
Yc
i¼1
e Tvi
; gð Þai
¼
Yc
i¼1
e hi
Ys
j¼1
u
^Fvij
j ; RY HðID;RÞ
!ai
:
Let d be a generator of G2. There exist xi; yi 2 Zq with
the following properties:
e Tvi
; gð Þ ¼ dxi
; e hi
Ys
j¼1
u
^Fvij
j ; RY HðID;RÞ
!
¼ dyi
:
We can get
d
Pc
i¼1
aixi
¼ d
Pc
i¼1
aiyi
Xc
i¼1
aiðxi À yiÞ ¼ 0: (3)
Since the single tag is existentially unforgeable (Lemma
1), there exist at least two different indices i such that
xi 6¼ yi. Suppose there exist s c index pairs ðxi; yiÞ with
the property xi 6¼ yi. Then, there exist qsÀ1
tuples
ða1; a2; . . . ; acÞ which satisfy the above equation (3). Since
ða1; a2; . . . ; acÞ is a random vector, the equation (3) holds
only with the probability less than qsÀ1
=qc
qcÀ1
=qc
¼ qÀ1
.
It is negligible. Thus, if some fake block-tag pairs are
aggregated, the combined block-tag pair ð ^F; TÞ only can
pass the verification with negligible probability. Ì
When some modified block-tag pairs are challenged and
some valid block-tag pairs are unchallenged, the malicious
CS still can not cheat the verifier.
Lemma 3. If some challenged block-tag pairs are modified, the
malicious CS substitutes the other valid block-tag pairs (which
are not challenged) for the modified block-tag pairs (which are
challenged). The combined block-tag pair ð ^F; TÞ (i.e., response)
only can pass the verification with negligible probability.
Proof. Define the modified block-tag pair index set as M
and the valid block-tag index set as M. Let the verifier’s
challenge be chal ¼ ðc; k1; k2Þ and S ¼ fk1
ð1Þ; . . . ;
k1
ðcÞg. For the CS set P, suppose some challenged
block-tag pairs fðFl; TlÞ; l 2 S1 Sg are modified, i.e.,
S1 ¼ S
T
M 6¼ F. F denotes the empty set. The
corresponding CSs (whose modified block-tag pairs
are challenged) substitute the other valid block-tag pairs
fðF^l; T^lÞ; ^l 2 S2 Mg (which are not challenged) for
fðFl; TlÞ; l 2 S1g where jS1j ¼ jS2j. By making use of the
forged i ¼ ð ^F
ðiÞ
; TðiÞ
Þ, the combined response ¼ ð ^F; TÞ
only can pass verification with negligible probability.
If the challenged block-tag pairs ðFl; TlÞ; l 2 S1 are
modified, P substitutes the other valid block-tag pairs
ðF^l; T^lÞ for them. For 1 i c, the following parameters
are calculated
ai ¼ fk2
ðiÞ; vi ¼ k1
ðiÞ; hi ¼ h Nvi
; CSlvi
; vi

:
Based on the forgery process, we know the forged
response ¼ ð ^F; TÞ satisfies the formulas below
T ¼
Y
vi2S
T M
Tai
vi
Y
vi2S2
Tai
vi
^Fj ¼
X
vi2S
T M
aiFvij þ
X
vi2S2
aiFvij; 1 j s
where ^F ¼ ð ^F1; ^F2; . . . ; ^FsÞ.
If the forged response can pass the verification, then
eðT; gÞ ¼ e
Yc
i¼1
hai
i
Ys
j¼1
u
^Fj
j ; RY HðID;RÞ
!
i.e.,
e
Y
vi2S
T M
Tai
vi
Y
vi2S2
Tai
vi
; g
0
B
@
1
C
A
¼ e
Y
vi2S
T M
hai
i
Ys
j¼1
u
P
vi2S
T M
aiFvij
j
0
B
@
1
C
A
0
B
@
Á
Y
vi2S1
hai
i
Ys
j¼1
u
P
vi2S2
aiFvij
j
!
; RY HðID;RÞ
!
:
(4)
For the index in the set S
T M, we can get
e
Y
vi2S
T M
Tai
vi
; g
0
B
@
1
C
A
¼ e
Y
vi2S
T M
hai
i
Ys
j¼1
u
P
vi2S
T M
aiFvij
j ; RY HðID;RÞ
0
B
@
1
C
A:
(5)
According to the formulas (4), (5), we can get the
formula below
e
Y
vi2S2
Tai
vi
; g
!
¼ e
Y
vi2S1
hai
i
Ys
j¼1
u
P
vi2S2
aiFvij
j ; RY HðID;RÞ
!
:
(6)
On the other hand, we can get the following formula
by making use of the tag scheme
e
Y
vi2S2
Tai
vi
;g
!
¼ e
Y
vi2S2
hai
i
Ys
j¼1
u
P
vi2S2
aiFvij
j ; RY HðID;RÞ
!
: (7)
From the formulas (6), (7), we can get
Y
vi2S1
hai
i ¼
Y
vi2S2
hai
i : (8)
Since h is a cryptographic hash function which is
collision-free, the probability that the equation (8) holds

is 1=q, i.e., it is negligible. The combined block-tag pair
ð ^F; TÞ (i.e., response) only can pass the verification with
negligible probability. Ì
Thus, from the above three lemmas (Lemma 1, Lemma 2,
Lemma 3), we have the following claim.
Theorem 1. The proposed ID-DPDP protocol is existentially
unforgeable in the random oracle model if the CDH
problem on G1 is hard.
Proof. Let the stored index-block pair set be fð1; F1Þ; ð2; F2Þ;
. . . ; ðn; FnÞg and the CS set be P. For 1 i n, each
block Fi is split into s sectors, i.e., Fi ¼ f ~Fi1; ~Fi2; . . . ;
~Fisg. Then, the hash function h1 is used on these
sectors, i.e., Fij ¼ h1ð ~FijÞ. Then, we get the hash value set
fFijg. Let the selected identity set be I ¼ fID1; ID2;
. . . ; ID~ng. Define the challenger as B and the adversary as
A. Algorithm B is given ðg; ga
; gb
Þ 2 G1. Its goal is to
output gab
2 G1.
The Setup; ExtractÀOracle; HÀOracle; hÀOracle, h1À
Oracle; TagGen À Oracle procedures are the same as the
corresponding procedures in the proof of Lemma 1.
Let the challenge be chal ¼ ðc; k1; k2Þ and the forged
response be ¼ ð ^F; TÞ where ^F ¼ ð ^F1; ^F2; Á Á Á ; ^FsÞ. As-
sume that can pass the verification, i.e.,
eðT; gÞ ¼ e
Yc
i¼1
hai
i
Ys
j¼1
u
^Fj
j ; RY HðID;RÞ
!
(9)
where hi ¼ hðNk1
ðiÞ; CSlk1
ðiÞ
; k1
ðiÞÞ, ai ¼ fk2
ðiÞ, 1 i c.
According to Lemma 1 and Lemma 2, if some
challenged block-tag pairs are modified, the verification
formula (9) only holds with negligible probability. Since
the verifier does not store block-tag pairs, A can
substitute the other valid block-tag pairs for the
modified block-tag pairs. According to Lemma 3, the
substituted response only can pass the verification with
negligible probability, i.e., the formula (9) only holds
with negligible probability.
Thus, in the random oracle, except with negligible
probability no adversary can cause the verifier to accept
the challenged response if some challenged block-tag
pairs are modified. Theorem 1 is proved. Ì
Theorem 2. Suppose that n block-tag pairs are stored, d block-
tag pairs are modified and c block-tag pairs are challenged.
T h e n , o u r p r o p o s e d I D - D P D P p r o t o c o l i s
ðd=n; 1 À ððn À dÞ=nÞc
Þ-secure, i.e.,
1 À
n À d
n
c
PX 1 À
n À c þ 1 À d
n À c þ 1
c
where PX denotes the probability of detecting the
modification.
Proof. Let the challenged block-tag pair set be S and the
modified block-tag pair set be M. Let the random
variable X be X ¼ jS
T
Mj. According to the defini-
tion of PX, we can get
PX ¼ PfX ! 1g
¼ 1 À PfX ¼ 0g
¼ 1 À
n À d
n
n À 1 À d
n À 1
Á Á Á Á Á
n À c þ 1 À d
n À c þ 1
:
Thus, we can get
1 À
n À d
n
c
PX 1 À
n À c þ 1 À d
n À c þ 1
c
:
This completes the proof of the theorem. Ì
Fig. 8 shows the probability curve of PX. From the picture,
we know that our protocol has high integrity checking
probability.
5 CONCLUSION
In multicloud storage, this paper formalizes the ID-DPDP
system model and security model. At the same time, we
propose the first ID-DPDP protocol which is provably
secure under the assumption that the CDH problem is
hard. Besides of the elimination of certificate management,
our ID-DPDP protocol has also flexibility and high
efficiency. At the same time, the proposed ID-DPDP
protocol can realize private verification, delegated verifi-
cation and public verification based on the client’s
authorization.
ACKNOWLEDGMENT
The author sincerely thanks the Editor for allocating
qualified and valuable referees. The author sincerely thanks
the anonymous referees for their very valuable comments.
This work was partly supported by the National Natural
Science Foundation of China (No. 61272522) and by by the
Open Foundation of State Key Laboratory of Information
Security of China (No. 2013-3-4).
REFERENCES
[1] G. Ateniese, R. Burns, R. Curtmola, J. Herring, L. Kissner,
Z. Peterson, and D. Song, ‘‘Provable Data Possession at
Untrusted Stores,’’ in Proc. CCS, 2007, pp. 598-609.
[2] G. Ateniese, R. DiPietro, L.V. Mancini, and G. Tsudik, ‘‘Scalable
and Efficient Provable Data Possession,’’ in Proc. SecureComm,
2008, pp. 1-10.
Fig. 8. Probability curve PX of detecting the corruption.

[3] C.C. Erway, A. Kupcu, C. Papamanthou, and R. Tamassia,
‘‘Dynamic Provable Data Possession,’’ in Proc. CCS, 2009,
pp. 213-222.
[4] F. Sebe´, J. Domingo-Ferrer, A. Martı´nez-Balleste´, Y. Deswarte,
and J. Quisquater, ‘‘Efficient Remote Data Integrity Checking
in Critical Information Infrastructures,’’ IEEE Trans. Knowl.
Data Eng., vol. 20, no. 8, pp. 1034-1038, Aug. 2008.
[5] H.Q. Wang. (2013, Oct./Dec.). Proxy Provable Data Possession in
Public Clouds. IEEE Trans. Serv. Comput. [Online]. 6(4), pp. 551-
559. Available: http://doi.ieeecomputersociety.org/10.1109/
TSC.2012.35.
[6] Y. Zhu, H. Hu, G.J. Ahn, and M. Yu, ‘‘Cooperative Provable Data
Possession for Integrity Verification in Multicloud Storage,’’
IEEE Trans. Parallel Distrib. Syst., vol. 23, no. 12, pp. 2231-2244,
Dec. 2012.
[7] Y. Zhu, H. Wang, Z. Hu, G.J. Ahn, H. Hu, and S.S. Yau, ‘‘Efficient
Provable Data Possession for Hybrid Clouds,’’ in Proc. CCS, 2010,
pp. 756-758.
[8] R. Curtmola, O. Khan, R. Burns, and G. Ateniese, ‘‘MR-PDP:
Multiple-Replica Provable Data Possession,’’ in Proc. ICDCS,
2008, pp. 411-420.
[9] A.F. Barsoum and M.A. Hasan, ‘‘Provable possession and
replication of data over cloud servers,’’ Centre Appl. Cryptogr.
Res., Univ. Waterloo, Waterloo, ON, Canada, Rep. 2010/32.
[Online]. Available: http://www.cacr.math.uwaterloo.ca/
techreports/2010/cacr2010-32.pdf.
[10] Z. Hao and N. Yu, ‘‘A Multiple-Replica Remote Data Possession
Checking Protocol with Public Verifiability,’’ in Proc. 2nd Int.
Symp. Data, Privacy, E-Comm., 2010, pp. 84-89.
[11] A.F. Barsoum and M.A. Hasan, ‘‘On verifying dynamic multiple
data copies over cloud servers,’’ Int. Assoc. Cryptol. Res., New
York, NY, USA, IACR eprint Rep. 447, 2011. [Online]. Available:
http://eprint.iacr.org/2011/447.pdf.
[12] A. Juels and B.S. Kaliski, Jr., ‘‘PORs: Proofs of Retrievability for
Large Files,’’ in Proc. CCS, 2007, pp. 584-597.
[13] H. Shacham and B. Waters, ‘‘Compact Proofs of Retrievability,’’
in Proc. ASIACRYPT, vol. 5350, LNCS, 2008, pp. 90-107.
[14] K.D. Bowers, A. Juels, and A. Oprea, ‘‘Proofs of Retrievability:
Theory and Implementation,’’ in Proc. CCSW, 2009, pp. 43-54.
[15] Q. Zheng and S. Xu, ‘‘Fair and Dynamic Proofs of Retrievability,’’
in Proc. CODASPY, 2011, pp. 237-248.
[16] Y. Dodis, S. Vadhan, and D. Wichs, ‘‘Proofs of Retrievability via
Hardness Amplification,’’ in Proc. TCC, vol. 5444, LNCS, 2009,
pp. 109-127.
[17] Y. Zhu, H. Wang, Z. Hu, G.J. Ahn, and H. Hu, ‘‘Zero-Knowledge
Proofs of Retrievability,’’ Sci. Chin. Inf. Sci., vol. 54, no. 8,
pp. 1608-1617, Aug. 2011.
[18] C. Wang, Q. Wang, K. Ren, and W. Lou, ‘‘Privacy-Preserving
Public Auditing for Data Storage Security in Cloud Computing,’’
in Proc. IEEE INFOCOM, Mar. 2010.
[19] Q. Wang, C. Wang, K. Ren, W. Lou, and J. Li, ‘‘Enabling Public
Auditability and Data Dynamics for Storage Security in Cloud
Computing,’’ IEEE Trans. Parallel Distrib. Syst., vol. 22, no. 5,
pp. 847-859, May 2011.
[20] C. Wang, Q. Wang, K. Ren, N. Cao, and W. Lou, ‘‘Toward Secure
and Dependable Storage Services in Cloud Computing,’’ IEEE
Trans. Serv. Comput., vol. 5, no. 2, pp. 220-232, Apr./June 2012.
[21] Y. Zhu, G.J. Ahn, H. Hu, S.S. Yau, H.G. An, and S. Chen. (2013,
Apr./June). Dynamic Audit Services for Outsourced Storages in
Clouds. IEEE Trans. Serv. Comput. [Online]. 6(2), pp. 227-238.
Available: http://doi.ieeecomputersociety.org/10.1109/TSC.
2011.51.
[22] O. Goldreich, Foundations of Cryptography: Basic Tools. Beijing,
China: Publishing House of Electronics Industry, 2003,
pp. 194-195.
[23] D. Boneh and M. Franklin, ‘‘Identity-Based Encryption from the
Weil Pairing,’’ in Proc. CRYPTO, vol. 2139, LNCS, 2001,
pp. 213-229.
[24] A. Miyaji, M. Nakabayashi, and S. Takano, ‘‘New Explicit
Conditions of Elliptic Curve Traces for FR-Reduction,’’ IEICE
Trans. Fundam., vol. E84A, no. 5, pp. 1234-1243, May 2001.
[25] D. Boneh, B. Lynn, and H. Shacham, ‘‘Short Signatures from the
Weil Pairing,’’ in Proc. ASIACRYPT, vol. 2248, LNCS, 2001,
pp. 514-532.
[26] H.W. Lim, ‘‘On the Application of Identity-Based Cryptography
in Grid Security,’’ Ph.D. dissertation, Univ. London, London,
U.K., 2006.
[27] S. Yu, K. Ren, and W. Lou, ‘‘FDAC: Toward Fine-Grained
Distributed Data Access Control in Wireless Sensor Networks,’’
IEEE Trans. Parallel Distrib. Syst., vol. 22, no. 4, pp. 673-686,
Apr. 2011.
[28] S. Yu, K. Ren, and W. Lou, ‘‘Attribute-Based on-Demand
Multicast Group Setup with Membership Anonymity,’’ Calc.
Netw., vol. 54, no. 3, pp. 377-386, Feb. 2010.
[29] P.S.L.M. Barreto, B. Lynn, and M. Scott, ‘‘Efficient Implementa-
tion of Pairing-Based Cryptosystems,’’ J. Cryptol., vol. 17, no. 4,
pp. 321-334, Sept. 2004.
[30] A.F. Barsoum and M.A. Hasan, ‘‘Integrity Verification of
Multiple Data Copies over Untrusted Cloud Servers,’’ in Proc.
12th IEEE/ACM Int. Symp. CCGRID, 2012, pp. 829-834.
[31] C. Research ‘‘SEC 2: Recommended Elliptic Curve Domain
Parameters.’’ [Online]. Available: http://www.secg.org/
collateral/sec2_final.pdf.
[32] D. Pointcheval and J. Stern, ‘‘Security Arguments for Digital
Signatures and Blind Signatures,’’ J. Cryptol., vol. 13, no. 3,
pp. 361-396, July 2000.
[33] The GNU Multiple Precision Arithmetic Library (GMP). [On-
line]. Available: http://gmplib.org/.
[34] Multiprecision Integer and Rational Arithmetic C/C++ Library
(MIRACL). [Online]. Available: http://certivox.com/.
[35] The Pairing-Based Cryptography Library (PBC). [Online]. Avail-
able: http://crypto.stanford.edu/pbc/howto.html.
[36] IEEE P1363: Hybrid Schemes. [Online]. Available: http://
grouper.ieee.org/groups/1363/StudyGroup/Hybrid.html.
[37] B. Lynn, ‘‘On the implementation of pairing-based cryptosys-
tems,’’ Ph.D. dissertation, Stanford Univ., Stanford, CA, USA,
2008. [Online]. Available: http://crypto.stanford.edu/pbc/
thesis.pdf.
Huaqun Wang received the BS degree in
mathematics education from the Shandong
Normal University, Jinan, China, in 1997, the
MS degree in applied mathematics from the East
China Normal University, Shanghai, China, in
2000, and the PhD degree in cryptography from
Nanjing University of Posts and Telecommuni-
cations, Nanjing, China, in 2006. Since then, he
has been with Dalian Ocean University, Dalian,
China, as an Associate Professor. His research
interests include applied cryptography, network
security, and cloud computing security. Dr. Wang has published more
than 40 papers. He has served in the program committee of several
international conferences and the editor board of international journals.
. For more information on this or any other computing topic,
please visit our Digital Library at www.computer.org/publications/dlib.

Identity-Based Distributed Provable Data Possession in Multicloud Storage

More Related Content

What's hot (19)

Viewers also liked (20)

Similar to Identity-Based Distributed Provable Data Possession in Multicloud Storage (20)

Recently uploaded (20)

Identity-Based Distributed Provable Data Possession in Multicloud Storage