A Novel Efficient Remote Data Possession Checking Protocol in Cloud Storage

Transcription

1 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 1 A Novel Effcent Remote Data Possesson Checkng Protocol n Cloud Storage Hao Yan, Jguo L, Jnguang Han, Member, IEEE and Ychen Zhang Abstract As an mortant alcaton n cloud comutng, cloud storage offers user scalable, flexble and hgh ualty data storage and comutaton servces. A growng number of data owners choose to outsource data fles to the cloud. Because cloud storage servers are not fully trustworthy, data owners need deendable means to check the ossesson for ther fles outsourced to remote cloud servers. To address ths crucal roblem, some remote data ossesson checkng (RDPC) rotocols have been resented. But many exstng schemes have vulnerabltes n effcency or data dynamcs. In ths aer, we rovde a new effcent RDPC rotocol based on homomorhc hash functon. The new scheme s rovably secure aganst forgery attack, relace attack and relay attack based on a tycal securty model. To suort data dynamcs, an oeraton record table (ORT) s ntroduced to track oeratons on fle blocks. We further gve a new otmzed mlementaton for the ORT whch makes the cost of accessng ORT nearly constant. Moreover, we make the comrehensve erformance analyss whch shows that our scheme has advantages n comutaton and communcaton costs. Prototye mlementaton and exerments exhbt that the scheme s feasble for real alcatons. Index Terms Cloud Storage, Data Possesson Checkng, Homomorhc Hash Functon, Dynamc Oeratons. C I. INTRODUCTION loud comutng emerges as a novel comutng aradgm subseuent to grd comutng. By managng a great number of dstrbuted comutng resources n Internet, t ossesses huge vrtualzed comutng ablty and storage sace [1]. Thus, cloud comutng s wdely acceted and used n many real alcatons [2]. As an mortant servce for cloud comutng, cloud servce rovder sules relable, scalable, and low-cost outsourced storage servce to the users. It rovdes the users wth a more flexble way called ay-as-you-go model to get comutaton and storage resources on-demand. Under ths model, the users can rent necessary IT nfrastructures Ths work was suorted n art by the Natonal Natural Scence Foundaton of Chna ( , ), the Prorty Academc Program Develoment of Jangsu Hgher Educaton Insttutons, Jangsu Provncal Natural Scence Foundaton of Chna (BK ), the Fundamental Research Funds for the Central Unverstes (2016B10114), Jangsu Collaboratve Innovaton Center on Atmosherc Envronment and Eument Technology. H. Yan, J.G. L, and Y.C. Zhang are wth the College of Comuter and Informaton, Hoha Unversty, Nanjng, Chna (e-mal: xy_hao@163.com, ljg1688@163.com, zyc_718@163.com). J. G. Han s wth the Jangsu Provncal Key Laboratory of E-Busness, Nanjng Unversty of Fnance and Economcs, Nanjng, Jangsu, Chna , and State Key Laboratory of Informaton Securty, Insttute of Informaton Engneerng, Chnese Academy of Scences, Bejng, Chna (e-mal: jghan22@gmal.com). accordng to ther reurement rather than buy them. Thus, the u-front nvestment of the users wll be reduced greatly. In addton, t s convenent for them to adjust the caacty of the rented resource whle the scale of ther alcatons changes. Cloud servce rovder tres to rovde a romsng servce for data storage, whch saves the users costs of nvestment and resource. Nonetheless, cloud storage also brngs varous securty ssues for the outsourced data. Although some securty roblems have been solved [3-10], the mortant challenges of data tamerng and data lost are stll exstng n cloud storage. On the one hand, the accdent d error or hardware falure of the cloud storage server (CSS) may cause the unexected corruton of outsourced fles. On the other hand, the CSS s not fully trustworthy from the ersectve of the data owner, t may actvely delete or modfy fles for tremendous economc benefts. At the same tme, CSS may hde the msbehavors and data loss accdents from data owner to mantan a good reutaton. Therefore, t s crucal for the data owner to utlze an effcent way to check the ntegrty for outsourced data. Remote data ossesson checkng (RDPC) [11] s an effectve technue to ensure the ntegrty for data fles stored on CSS. RDPC sules a method for data owner to effcently verfy whether cloud servce rovder fathfully stores the orgnal fles wthout retrevng t. In RDPC, the data owner s able to challenge the CSS on the ntegrty for the target fle. The CSS can generate roofs to rove that t kees the comlete and uncorruted data. The fundamental reurement s that the data owner can erform the verfcaton of fle ntegrty wthout accessng the comlete orgnal fle. Moreover, the rotocol must resst the malcous server whch attemts to verfy the data ntegrty wthout accessng the comlete and uncorruted data [12]. Another desred reurement s that dynamc data oeratons should be suorted by the rotocol. In general, the data owner may aend, nsert, delete or modfy the fle blocks as needed. Besdes, the comutng comlexty and communcaton overhead of the rotocol should be taken nto account for real alcatons. A. Related Work The frst RDPC was roosed by Deswarte et al. [11] based on RSA hash functon. The drawback of ths scheme s that t needs to access the entre fle blocks for each challenge. In 2007, the rovable data ossesson (PDP) model was resented by Atenese et al. [13], whch used the robablstc roof technue for remote data ntegrty checkng wthout accessng the whole fle. In addton, they suled two concrete schemes (S-PDP, E-PDP) based on RSA. Although these two rotocols (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

2 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 2 had good erformance, t's a ty they ddn't suort dynamc oeratons. To overcome ths shortcomng, n 2008, they resented a dynamc PDP scheme by usng symmetrc encryton [14]. Nonetheless, ths scheme stll dd not suort block nsert oeraton. At the same tme, lots of research works [15-19] devoted to construct fully dynamc PDP rotocols. For nstance, Sebé et al. [15] rovded a RDPC rotocol for crtcal nformaton nfrastructures based on the roblem to factor large ntegers, whch s easly adated to suort data dynamcs. Erway et al. [16] frst resented a fully dynamc PDP scheme (DPDP) by usng authentcated lst, whch allowed data owner to aend, delete, nsert and udate fle blocks at anytme. Wang et al. [17] used Merkle hash tree (MHT) to roose another dynamc method for remote data checkng, n whch each block was hashed to be a leaf node of MHT. By sortng all leaf nodes from left to rght, the MHT mlctly dentfed the block oston whch s essental for dynamc oeratons. However, usng MHT caused heavy comutaton cost. In 2013, Yang and Ja [18] resented an effcent scheme, n whch an ndex table was utlzed to suort dynamc oeratons. By the ndex table, the data owner recorded the logcal locaton and verson number for each block for the outsourced fle. However, to delete or nsert one data block, the verfer had to fnd the oston of the block and shft the remanng entres to nsert or delete a row n the ndex table, whch stll ncurred hgh comutaton cost. In [19], Chen et al. rovded a dynamc RDPC scheme by usng homomorhc hash functon defned n [20]. Unfortunately, ther scheme was roved nsecure by Yu et al. [21]. To overcome the drawback, Yu et al. [21] resented a new RDPC rotocol based on RDPC scheme n [19] and roved the securty. They also used MHT to acheve data dynamc oeratons, whch caused the same shortcomng of neffcent as n [17]. In 2008, Curtmola et al. [22] frst consdered the remote ntegrty checkng for multle relcas n cloud settng. They assumed a scenaro that the data owner stored certan relcas of an mortant fle on the server, t s necessary to verfy whether all these relcas are ket ntact. To acheve ths goal, they resented a rovable secure multle relcas PDP scheme. Hao and Yu [23] roosed a RDPC rotocol for the multle relcas wth ublc verfablty and rvacy reservaton. Mukundan et al. [24] resented a dynamc multle relcas PDP, whch suorted dynamc oeratons on relcas whle holdng the features of multle relcas ntegrty checkng. In 2015, Barsoum and Hasan [25] roosed a rovable mult-coy dynamc data ossesson scheme, whch used ma-verson table to carry out dynamc oeratons on mult-coy. Zhu et al. [26] rovded a cooeratve rovable data ossesson (CPDP) scheme for ntegrty verfcaton n multcloud settng. Although they clamed the CPDP had the securty roertes of comleteness, knowledge soundness and zero-knowledge, Wang and Zhang [27] roved that the CPDP dd not satsfy the knowledge soundness roerty. To avod the certfcate management, Wang [28] roosed an dentty-based dstrbuted PDP n multcloud storage. Chen [29] aled algebrac sgnature defned n [30] to ntroduce a new remote data checkng rotocol, whch was roved to be nsecure aganst relay attack and deleton attack [31]. Hao et al. [12] resented a remote data ntegrty check rotocol suortng rvacy-reservng, ublc verfablty and data dynamcs. However, Zhou and L [32] onted out that Hao's rotocol wasted storage sace and couldn't resst actve adversary's attack. In 2015, Wang and L [33] resented a certfcate-based remote data ntegrty checkng scheme n ublc cloud, whch elmnates the key escrow roblem. Another branch of remote data checkng s roof of retrevablty (PoR) whch has extra functon of recoverng fle n case of falure comared wth PDP. In 2007, Juels and Kal [34] roosed the concet for PoR and formalzed the defnton and securty reurement. They resented a PoR scheme usng sentnels and error-correctng code to rove fle ntegrty and recover target fle. Shacham and Waters [35] gave two effcent and comact PoR rotocols, whch were bult on BLS sgnatures [36] and seudorandom functons resectvely. Recently, several PoR rotocols [37-39] were roosed to enhance the securty and mrove the effcency. B. Motvaton and Contrbuton It s essental for data owners to verfy the ntegrty for the data stored on CSS before usng t. For examle, a bg nternatonal tradng comany stores all the morts and exorts record fles on CSS. Accordng to these fles, the comany can get the key nformaton such as the logstcs uantty, the trade volume etc. If any record fle s dscarded or tamered, the comany wll suffer from a bg loss whch may cause bad nfluence on ts busness and develoment. To avod ths knd of crcumstances, t s mandatory to check the ntegrty for outsourced data fles. Furthermore, snce these fles may refer to busness secret, any nformaton exosure s unaccetable. If the comany comettor can execute the fle ntegrty checkng, by freuently checkng the fles they may obtan some useful nformaton such as when the fle changes, the growth rate of the fle etc, by whch they can guess the develoment of the comany. Thus, to avod ths stuaton, we consder the rvate verfcaton tye n our scheme, that s, the data owner s the unue verfer. In fact, the current research drecton of RDPC focuses on the ublc verfcaton, n whch anyone can erform the ta of fle ntegrty checkng wth the system ublc key. Although RDPC wth ublc verfcaton seems better than that wth rvate verfcaton, but t s unsutable to the scenaro mentoned above. Motvated by the above alcaton scenaros, we resent a novel effcent RDPC scheme by usng homomorhc hash functon [20], whch has been used to construct RDPC schemes [19,21]. Unfortunately, these schemes are ether nsecure or not effcent enough. To overcome these drawbacks, we refer to the dea of [35] and ntroduce a rvate key for each tag generaton n our RDPC scheme. Smultaneously, a new constructon of ORT s resented for data dynamc whch can mrove the effcency of the rotocol greatly. Comared wth the revous ones, our scheme has better erformance n term of comutaton and communcaton. Our contrbutons are summarzed as follows: We resent a novel effcent RDPC scheme wth data (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

3 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 3 dynamcs. The basc scheme utlzes homomorhc hash functon technue, n whch the hash value of the sum for two blocks s eual to the roduct for two hash values of the corresondng blocks. We ntroduce a lnear table called ORT to record data oeratons for suortng data dynamcs such as block modfcaton, block nserton and block deleton. To mrove the effcency for accessng ORT, we make use of doubly lnked lst and array to resent an otmzed mlementaton of ORT whch reduces the cost to nearly constant level. We rove the resented scheme s secure aganst forgery attack, relay attack and relace attack based on a tycal securty model. At last we mlement our scheme and make thorough comarson wth revous schemes. Exerment results show that the new scheme has better erformance and s ractcal for real alcatons. C. Organzatons The remander of the aer s organzed as follow. Secton II descrbes the relmnares for our scheme. The constructon of our new scheme s resented n Secton III. The securty analyss and erformance analyss are demonstrated n Secton IV and Secton V resectvely. Secton VI concludes ths aer. II. PRELIMINARIES In ths secton, we ntroduce the relmnary knowledge used throughout ths aer. A. Homomorhc Hash Functon Insred by [19] and [21], our scheme adots the homomorhc hash functon defned n [20] as the bass, whch s descrbed as followng: Frst, the algorthm HKeyGen(,, m, s) K s utlzed to obtan the homomorhc key. It takes four securty arameters as nuts, n whch and are two dscrete log securty arameters, m s the sector count of the message and s s a random seed. It oututs the homomorhc key K (,, g), where and are two random bg rmes wth the roertes of, and ( 1), g [ g1, g2,, g m ] s a 1 m row-vector comosng of m random values n Z wth order. The detaled rocess of ths algorthm s shown n Fg.1, n whch the functon f ( x ) s the seudo-random number generator wth seed s and oututs the next number n ts seudo-random seuence, scaled to the range {0,, x 1} [19]. The comutaton of the hash value X of the message S reresented by H ( S) X s defned as followng. S s dvded nto m sectors S ( s1, s2,, s m ), the hash value s calculated as: S and m 1 s H K ( S) g mod. For any two messages S j, where 1 2 m S ( s, s,, s ), S ( s1, s2,, s ), j j j mj we defne S S j ( s1 s1 j, s2 s2 j,, sm smj ) mod. The homomorhc roerty of H ( ) can be verfed by: m m m st stj s t stj j t t t t1 t 1 t1 H( S S ) g mod g mod g mod H ( S ) H ( S ). j Fg. 1. Homomorhc key generaton algorthms B. Oeraton Record Table Refer to [18, 25], to suort dynamc oeratons on fle blocks, we ntroduce a smle flexble data structure named oeraton record table (ORT). The table s reserved on the data owner sde and used to record all the dynamc behavors on fle blocks. ORT has a smle structure wth only three columns, that s Block Poston( BP ), Block Index( BI ) and Block Verson ( BV ). The BP reresents the hyscal ndex for the current block n the fle, normally ts value s ncremented by 1. The BI reresents the logcal ndex for the current block, whch s not necessary eual to BP but relevant wth the tme when the block aears n the fle. The BV ndcates the current verson for the block. If the data fle s ntally created, the BV values for all blocks are 1. When one concrete block s udated, ts BV value s ncremented by 1. It s noted that usng the ORT table wll ncrease the storage overhead of the data owner by O( n ), where n s the count of blocks. However, ths extra storage cost s very lttle. For examle, a 1GB-fle wth 16KB block sze only needs 512KB sace to store an ORT realzed by lnked lst (< 0.05% of the fle sze). C. Outlne of Our RDPC Protocol In ths aer, we nvestgate the cloud storage system ncludng two artcants: CSS and data owner. The CSS has owerful storage ablty and comutaton resources, t accets the data owner's reuests to store the outsourced data fles and sules access servce. The data owner enjoys CSS's servce and uts large amount of fles to CSS wthout backu coes n local. As the CSS s not assumed to be trustable and occasonally msbehave, for examle, modfyng or deletng artal data fles, the data owner can check the ntegrty for the outsourced data effcently. A RDPC scheme ncludes the followng seven algorthms: k KeyGen(1,,, m, s) ( K, ). The data owner executes ths algorthm to ntalze the system and generate keys. It nuts securty arameters k,,, the message sector number m and a random seed s, and oututs the homomorhsm key K and rvate key. Here the seed s serves as a heurstc "roof", whch the hash arameters are (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

4 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 4 Fg. 2. Work rocedure of our RDPC rotocol selected truthfully [19]. TagGen( K,, F) T. Ths algorthm s executed by the data owner to roduce tags of the fle. It nuts the homomorhc key K, rvate key and fle F, and oututs the tag set T whch s a seuental collecton for tag of each block. Challenge( c) chal. The data owner executes the algorthm to generate the challenge nformaton. It takes the challenged blocks count c as nut and oututs the challenge chal. ProofGen( F, T, chal) P. The CSS executes ths algorthm to generate the ntegrty roof P. It nuts the fle F, tag set T and the challenge chal and oututs the roof P. Verfy( K,, chal, P) {1,0}. The data owner executes the algorthm to check the ntegrty of the fle usng the roof P returned from CSS. It takes homomorhsm key K, rvate key, challenge chal and roof P as nuts, and oututs 1 f P s correct, otherwse t oututs 0. PreareUdate( F ',, UT ) URI. The data owner runs ths algorthm to reare dynamc data oeratons on data blocks. It takes new fle block F ', the block oston and the udate tye UT as nuts, and oututs the udate reuest nformaton URI. The arameter UT has three otonal elements: nsert, modfy and delete. ExecUdate( URI ) { Success, Fal}. The CSS runs ths algorthm to execute the udate oeraton. It nuts URI and oututs executon result. If the udate oeraton s fnshed successfully, t returns Success, otherwse returns Fal. The comlete work rocedure of our RDPC rotocol s llustrated n Fg.2, n whch sold lnes and dash lnes reresent the rocesses of data ntegrty checkng and data dynamc oeratons resectvely. D. Securty Reurement The CSS s not fully trusted snce t mght take malcous behavors on outsourced data and hde data corruton occurrences from data owner so as to kee good reutaton. Accordng to [18], the dshonest CSS may launch three tyes of attacks on RDPC, namely forge attack, relay attack and relace attack. Forge attack: the CSS forges a vald tag for the challenged block to cheat the data owner. Relay attack: the CSS chooses a vald roof for ossesson from revous roofs or other nformaton, wthout accessng the actual challenged block and tag. Relace attack: the CSS utlzes the other vald ar for block and tag as the roof of the challenged one, whch may has been tamered or dscarded. A secure RDPC rotocol should be able to resst all the attacks above, whch guarantees that anyone who can construct a vald roof assng the verfcaton should actually ossess the entre fle. Refer to [13, 19, 21], we use a data ossesson checkng game to catures the data ossesson roerty whch covers all the three attacks. The game whch nvolves a challenger served as data owner and an adversary served as untrusted CSS s shown as follows: Setu. executes KeyGen algorthm to get the homomorhc key K and rvate key. Both of them are ket secretly by. Query. can make two tyes of ueres wth : Tag uery. adatvely chooses amount of data blocks and sends them to for ueryng the tags. executes the TagGen algorthm to obtan a vald tag of each block and returns all the tags to. Proof verfcaton uery. generates data ossesson roofs for the blocks whose tags have been uered and submts the roofs to. executes theverfy algorthm to check the valdaton for the roofs and returns the results to. These ueres can be reeated olynomal tmes. Challenge. submts challenge chal to and reures to rely data ossesson roof P of the challenged blocks. Forge. comutes a roof P and returns t to. wns the game f P s a correct roof. Defnton 1. A RDPC scheme s secure f any robablstc olynomal-tme (PPT) adversary can wn the data ossesson game on a set of blocks wth non-neglgble advantage, there exsts a knowledge extractor whch can extract the challenged blocks wth non-neglgble robablty. III. OUR RDPC SCHEME We frst rovde the basc RDPC scheme only for statc data ntegrty checkng. Furthermore, we show the advanced RDPC scheme suortng fully dynamc block oeratons based on ORT. A. Basc RDPC Scheme We use the homomorhc hash functon defned n [20] to construct our basc RDPC scheme. Frstly, we defne the followng functons used n our scheme. h : {0,1} {0,1} s (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

5 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 5 a secure hash functon. : Z Z Z s a seudo-random functon (PRF). : Z {1,, n} {1,, n} s a seudo-random ermutaton (PRP), where n s the count for the blocks n a fle. The detaled RDPC scheme s defned as: k KeyGen(1,,, m, s) ( K, ). Wth the nuts of the securty arameters k,,, the message sector number m and the random seed s, the data owner runs the HKeyGen(,, m, s) algorthm shown n Fg.1 to generate homomorhc key K (,, g) where g [ g1, g2,, g m ], and cks a random value Z. The data owner kees K and rvate. TagGen( K,, F) T. Gven a fle F, the data owner frst slts F nto n blocks F { F1, F2,, F n }, then further slts each block F nto m sectors, that s F { f1, f2,, fm}, where 1 n. Suose the block sze n bts s, we make each sector be an element n Z by settng m ( 1). The tag for the block F can be calculated by m ft t t 1 T ( h( ) g ) mod, where F n m and the F d denotes the dentty of the fle such as fle name. After comutng all the tags, the data owner submts the fle F along wth the tags set T ( T1, T2, L, T n ) to the CSS and deletes them n local. Challenge( c) chal. The data owner cks two random numbers k1, k2 Z and sends the challenge chal ( c, k1, k2) to the CSS. ProofGen( F, T, chal) P. When the CSS receves the challenge chal ( c, k1, k2) from the data owner, t calculates the challenge set C {( v, a )}, where v ( k1, ), a ( k2, ) for 1 c. Then t comutes 1 j m and c a T ( Tv ) mod 1 c d F a f mod for j jv 1. Fnally, the CSS resonses P ( F, T ) to the data owner as roof, where (,, L, ). F F1 F2 F m Verfy( K,, chal, P) {1,0}. Uon recevng the roof P from the CSS, the data owner calculates v ( k1, ), a ( k, ) and h h( F n m v ) for 1 c. Fnally 2 v d the data owner checks whether the euaton (1) holds: c m a Ft v t 1 t 1 ( h g ) mod T? (1) If t holds, oututs 1, otherwse oututs 0. If both the CSS and the data owner honestly execute the basc RDPC scheme, the correctness can be roved as followng: c c m c m a ftv a Ft a 1 ( v ) mod ( ) mod t v t 1 t 1 1 t 1 h g h g c c m c m a a ftv ftv a v t v t 1 1 t 1 1 t 1 ( h g ) mod ( ( h g ) ) mod c m c ftv a a v t v 1 t 1 1 (( h g ) ) mod ( T ) mod T B. Dynamc RDPC Scheme In real alcatons, outsourced data fle s dynamc. Ths nsres us to construct dynamc RDPC schemes wth varous data block oeratons. In ths aer, we use ORT table as the auxlary tool to suort data dynamc oeratons. The smlar dea has been adoted by [18, 25]. To ugrade our statc scheme descrbed n the sub-secton III.A to be a fully dynamc scheme, we have to do another two works. Frstly, we need to make slght modfcaton on the algorthm TagGen of the statc scheme. Secondly, we should mlement the algorthms ExecUdate and PreareUdate, whch are the core functons for data dynamcs. Then, we wll resent these two works resectvely. Modfcaton on TagGen. In the new TagGen algorthm, besdes dong all the works n statc scheme, the data owner has to ntalze the ORT table and store the nformaton for all the blocks to the ORT. As shown n Fg.3, n ntalzaton hase all the BP values are the real ndexes of blocks wth ascendng order, the BI values are the same as BP, and the values of BV are ntalzed to 1. Smultaneously, to enhance the securty of the dynamc RDPC rotocol, s udated to Fd m BI BV, where BI and BV denote the BI value and the BV value of the block F. PreareUdate ( F ',, UT ) URI. Ths algorthm s resonsble for rearng the re-works for dynamc oeratons. The data owner s able to execute three tyes of oeratons on hs outsourced fle, namely 'nsert', 'delete' and 'modfy'. The re-works for the three dynamc oeratons wll be fnshed by the same algorthm PreareUdate wth dfferent arameters. The three dfferent stuatons are descrbed as follows. PreareUdate( F ',, nsert) URI. For the 'nsert' oeraton, the value of the arameter UT s set to be 'nsert'. The arameter F ' denotes the new block to be nserted, and s the oston where the new block wll be nserted. The data owner frst nserts a new row after the ( 1 )-th row n ORT, and sets the values of the new entry to (, Max{ BI} 1, 1), where Max{ BI } means the max value of all BI n ORT. At the same tme, all the entres n the orgnal ORT from the -th to the end move backward n order, wth the all BP values ncreasng 1. And then, the data owner calculates the new tag T for the new block ' F ' by the algorthm TagGen, and sends the reuest URI ( F ', T ',, nsert) to the CSS. PreareUdate( F ',, modfy) URI. For the 'modfy' (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

6 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 6 Fg. 3. ORT oeratons oeraton, the value of the arameter UT s set to be ' modfy'. The F ' denotes the new verson for data block to be udated, s the oston of the block. The data owner relaces the verson number BV by BV 1 n the -th row of ORT and calls the algorthm TagGen to re-calculate the tag new block F ' T ' for the. Then the data owner submts the reuest URI ( F ', T ',, modfy) to the CSS. PreareUdate( null,, delete) URI. For deletng blocks, the value of the arameter UT s set to be 'delete'. The data owner just needs to delete the -th row n ORT and move forward the entres from the ( 1 )-th row to the tal n order. The corresondng BP values of the moved entres decrease 1 whle the BI and BV reman unchanged. After that, the data owner sends the reuest URI ( null, null,, delete) to the CSS. ExecUdate( URI ) { Success, Fal}. When the CSS receves the udate reuest URI from the data owner, t udates the fle blocks and tags accordng to the value of URI. For the case of 'nsert', the CSS nserts the new block F ' to the fle and the new tag T ' to the tag lst, whch are both at the oston; For the case of 'modfy', the CSS relaces the old verson of the block and tag at the oston wth the new nut ar ( F ', T ') ; and for the case of 'delete', CSS only needs to delete the block and tag ar at the oston. When fnshng the work rghtly, the CSS returns Success to the data owner, otherwse returns Fal. C. Otmzed Imlementaton of ORT Fg. 3 reveals the changng rocess of the ORT for dfferent tyes of dynamc oeratons. Obvously, ORT s a lnear data structure. So array and lnked lst are two tradtonal means for mlementng ORT [18, 25]. However, usng array has advantage over the element locaton but brngs great costs on 'nsert' and 'modfy' oeratons, whch have to coy and move all the elements behnd the nsert or modfy ndex. Usng lnked lst to realze ORT wll remove the cost of element cong and movng and just needs to move node onters whch sends nearly neglgble cost. But t ncreases massve overhead on nodes locaton for retrevng, nsertng and modfyng elements esecally when the data sze s bg. Thus, to get better accessng effcency, we resent a novel hybrd data structure for realzng ORT, whch s comosed of array and doubly lnked lst. We ntegrate the array's mert to narrow the range of locaton, and the lnked lst's mert to seed the nsert or delete oeraton. As a result, we can reduce the overhead of udate ORT to nearly constant. As shown n Fg.4, we wll dect the rocess of dfferent oeratons based on our new structure and gve the effcency analyss. Intalze. At frst, we create a doubly lnked lst and ma all entres of ORT to be nodes of the lst wth the same order. Snce the doubly lnked lst s an ordered lnear structure whch mlctly contans the BP values of the nodes, each node only needs to store the BI and BV values. And then we slt the entre doubly lnked lst nto a number of sub-lsts wth constant length and create a onter array to store the head node of each sub-lst. Suose the count of all nodes s N, the length for the sub-lst s L, the sze for the onter array s W, then t has W N L. Locate oston. When locatng the node at oston V, we frst comute the ndex W ' of the sub-lst whch the node belongs to by the euaton W ' ( V 1) L, and then move the node onter backward by ( V W ' L 1) tmes from the head node. Comared wth lnked lst, we can use the hybrd data structure to reduce the average locaton cost on onter movement from N 2 to L 2. Suort oeratons. Uon fxng the oeraton oston, we can nsert or delete node easly whch only need to move onters for four tmes. Reconstruct. After nsertng or deletng nodes, the length of the doubly lnked lst wll change. In order to kee the constant length of the sub-lsts, t reures to reset the head node of the sub-lsts behnd the oeraton oston. Thus, along wth the overhead on locatng, the average costs on nsertng and deletng node s ( W L) 2, whch s very small comared wth lnked lst. Fg.4 demonstrates the detaled rocess for dynamc oeratons on the hybrd data structure, n whch PA denotes the onter array, each node contans the values of BI and BV jonted by ' & ' and the length of the sub-lst s set to 100. IV. SECURITY ANALYSIS The roosed RDPC scheme s roved secure under the securty model n sub-secton II.D. A. Securty Proof Theorem 1. If both the hash functon and the homomorhc (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

7 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 7 Fg.4. Dynamc oeratons on hybrd data structure wth 100 nodes for each sub-lst hash functon are collson free, the roosed RDPC rotocol s secure aganst the securty model defned n II.D. Proof: Gven the challenged fle F whch s dvded nto n blocks as F ( F1, F2,, F n ). Furthermore, F s dvde nto m sectors as F ( f1, f2,, fm ). The challenger smulates the game for data ossesson wth the adversary as follows. Setu. executes KeyGen algorthm to obtan the homomorhc key K and rvate key. Both of them are ket secretly by. Tag uery. At any tme can uery the tag of any block F for 1 n. mantans a lst of tules (, F, T ) named Tab 1. When sends a tag uery for the ar (, F ), checks whether the tule (, F,) has exsted n Tab 1. If (, F,) Tab1, then retreves (, F, T ) and returns T to. Otherwse, comutes T by the TagGen algorthm, adds (, F, T ) to Tab 1 and returns T to. Proof verfcaton uery. At any tme can launch the roof verfcaton uery to. adatvely chooses several blocks wth ther tags uered from and generates a roof for the selected blocks. sends the roof to and reuests to resonse the verfcaton result. calls the Verfy algorthm to check the roof and returns the result to. Challenge. randomly cks two values k k and the 1, 2 Z number of challenged blocks c. It s reured that every ar ( l, F l ) should exst n Tab 1 where l { ( k1, ) 1 c}. Then sends the challenge chal { c, k1, k2} to and reuests to rely a data ossesson roof P of the challenged blocks. Forge. roduces a roof P ' ( F ', T ') of the challenge chal { c, k, k } and sends t to, where 1 2 ' ( ', ',, '). If P ' ( F ', T ') can ass the F F1 F2 F m verfcaton, wns the game. Intutvely, the adversary can not obtan a vald roof wthout ossessng the challenged blocks. Then we wll rove that f doesn't mantan the whole fle, the robablty that wns the game of data ossesson s neglgble. Outut. Suose the adversary wns the game, whch means that the roof P ' ( F ', T ') can ass the euaton (1). That s 2 c m a Ft ' ( hv g ) mod ' t T 1 t 1, where v 1 ( k, ), a ( k, ) for 1 c. At the same tme, we consder the exected roof for the challenge chal { c, k1, k2} from an honest CSS s P ( F, T ), where F ( F1, F2,, F m ). Due to the correctness of the rotocol, we can get c m a Ft v t 1 t 1 accordng to verfcaton ( h g ) mod T euaton (1). Comarng the F ' n P ' and the F n P, there are only two cases: F ' F or F ' F. If F ' F, we can get that at least one F ' s not eual to F for any 1 m. Let we defne m t 1 F F ' F, T T ', then we have T F T ( gt ) mod. It s noted that there exst some F not eual to zero, and the aggregate tag T ' s not eual to T. Moreover, the and g t for 1 t m are random values, whch kee constant through the whole nteracton rocess. Thus, from the adversary vew, and g for 1 t m are F ndeendent of the euaton T ( gt ) mod. We consder the best case for the adversary, that s only one m t 1 F x (1 x m ) s not zero. Then the robablty that the t (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

8 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 8 TABLE 1 COMPARISONS OF DIFFERENT RDPC SCHEMES scheme of [8] scheme of [30] scheme of [11] scheme of [12] scheme of [9] scheme of [16] our scheme data dynamcs No No Yes Yes Partal Yes Yes number of verfcaton Infnte Infnte Infnte Infnte Fnte Infnte Infnte server comutaton comlexty user comutaton comlexty communcaton comlexty O(log n ) O(log n ) O(log n ) O(log n ) O(log n ) O(log n ) O(log n ) O(log n ) O(log n ) adversary wns the game s euvalent to the robablty that can get the rght T to satsfy ( F x T g ) mod, whch s at most 1 because of the DL hard roblem. Thus, the adversary can successfully choose the rght values of F F and T to satsfy the euaton T ( gt ) mod for a concrete entry n an nteracton only wth neglgble robablty, whch s at most 1. Therefore, the adversary can wn the game only wth the neglgble robablty s, where s s the number for RDPC rotocol nteractons between the challenger and the adversary. Based on the roof above, we know that f the adversary can wn the game, t should have F ' F. Then, smlar to [13], we can use the caablty of to construct a knowledge extractor to extract the challenged blocks as follows. The extractor selects c ndeendent coeffcents a1 ac, and challenges the blocks F F wth these coeffcents. Then v1 vc the extractor can get m lnear euatons, n whch the sectors n F F are treated as the varables. By challengng these v1 vc blocks for c tmes wth dfferent coeffcents, the extractor can get c m ndeendent lnear euatons. The extractor can solve these euatons to obtan all the sectors of the challenged blocks. Thus, the blocks are extracted successfully. The roof s comleted. B. Error Detecton Probablty Suose the data owner has uloaded n blocks to the CSS, where blocks have been modfed or deleted. When the data owner challenges the CSS wth the challenge chal ( c, k1, k2 ), CSS wll randomly select c dfferent blocks determned by the PRM functon from the entre fle. Let c 1 denote the number of blocks chosen from ( c1 ) modfed or deleted blocks. It s obvous that the robablty of detectng the data corruton event s eual to the robablty of c1 1. Let P a denote ths robablty value, then we have Pa P{ c1 1} 1 P{ c1 1} n n 1 n c 1 1 P{ c1 0} = 1. It n n 1 n c 1 c c ndcates that: 1 (1 ) Pa 1 (1 ). Ths n n c 1 euaton demonstrates that to mrove the error detecton robablty, the data owner should adatvely ncrease the number of challenged blocks esecally when the roorton of m t 1 x corruted block s small. However, by the evaluaton of Atenese et al. [13] when 1% blocks of the fle are corruted, 300 challenged blocks wll acheve Pa 95% and 460 blocks wll acheve Pa 99%. Thus, our scheme can get a hgh robablty of error detectng. V. PERFORMANCE ANALYSIS The erformance for the roosed scheme s evaluated n ths secton. We frst comare our new scheme wth other RDPC schemes n term effcency. Then we show the exermental results for our new scheme. A. Effcency Evaluaton Our scheme s bult on a secure homomorhc hash functon and suorts fully dynamc oeratons about blocks ncludng nserton, deleton and modfcaton. A new lght weght data structure called ORT s adoted to realze dynamc oeratons. By ntroducng a novel otmzed mlementaton of ORT, we reduce the cost of accessng ORT to nearly constant level. Meanwhle, our scheme has no restrctons on the verfcaton tmes and challenged block numbers, whch can be set freely by the data owners accordng to ther reurements. To demonstrate the features of our scheme, we lst the comrehensve effcency comarson for our scheme wth the state-of-the-art n Table1. Further, we wll analyze the detaled cost of our RDPC scheme. Comutaton cost: Let T mul, T, ex T, rf T, T r hash, T add denote the tme cost for multlcaton, modular exonentaton, seudo-random number generaton, ermutaton oeraton, hash oeraton and addton oeraton resectvely. Setu algorthm runs on the data owner sde, t s resonsble for oututtng homomorhc key and rvate key. The comutaton cost of Setu cannot be confrmed strctly because t s related to the means for generatng bg rmes, and the vector g. Thus we are unable to gve the secfc theoretcal values of the Setu comutaton cost, but we wll show the real tme send n the exerment later, whch can gve us a more clear knowledge than the theoretcal analyss. However, Setu wll run only once n system. No matter how much tme t costs, the nfluence on the comutaton overhead of the data owner s very lttle. Thus, we gnore the Setu cost n the followng analyss about the comutatons cost for the data owner. In the TagGen stage, the man comutaton s the n tags generaton, whose comutaton cost s n( m 1) T + nmtmul ex (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

9 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < + nthash. In the Verfy hase, the comutaton cost s ctrf + ctr + cthash + (c m 1)Tex + (c m 1)Tmul. Therefore, the total comutaton cost for the data owner s uer bound by ( nm n m c 1)Tex + (nm c m 1)Tmul + (c n)thash + ctrf + ctr. 9 Setu tme cost on dfferent sze level of. To mrove the accuracy, we run the smulatons for dfferent cycles from 20 to 100, the result s shown n Fg.5. As observed, the tme cost of Setu s relatvely stable at 0.15s and 1.3s for =512 and 1024 resectvely, whch s very low and accetable. The comutaton cost of CSS manly deends on the algorthm ProofGen used to generate the roof of data ossesson, whch s ctr + ctrf + (2c 1)Tmul + (c 1)Tadd + ctex n total. Storage cost: In our scheme, the storage cost of the data owner only contans homomorhc key, rvate key and the ORT, whch s uer bound by 2 + (m 1) + 12n. As for the storage cost of CSS, t ncludes two arts: fle and tags, so the uer bound of the CSS storage cost s nm + n. Communcaton cost: In a comlete rocess of challenge, the data owner frst sends the challenge chal (c, k1, k2 ) to CSS, then CSS returns the roof ( F, T ) to the data owner. So the communcaton cost for the challenge s log c + (m 2) +. B. Exermental results We mlement a rototye for the roosed RDPC scheme usng C rogram language wth MIRACL lbrary [40], Parng Based Crytograhy (PBC) Lbrary [41], and GNU Multle arthmetc Precson (GMP) Lbrary [42]. Smultaneously, we mlement Yang's scheme [18] and make a number of smulatons to comare the effcency of them. The exerments are conducted on the VMware Workstaton 10 wth the Ubuntukyln deto-386 oeratng system. The VMware workstaton has the confguraton of 4GB Ram, 1CPU and 20G d, and the host comuter of the VMware Workstaton s the Lenovo Lato L440 wth Wn7 oeraton system, Core CPU, 8G Ram. Yang's scheme s realzed by usng the Tye A elltc curve of the PBC wth the 160-bt grou order, whch can acheve the euvalent securty level of 1024-bt RSA. Fg 6. Tag generaton comutaton cost Furthermore, we make exerments to evaluate the comutaton cost of tag generaton. We set =1024, =257 n our scheme and both the two schemes have the same number of sectors n each block. We evaluate and comare the block tag generaton comutaton cost of our scheme and Yang's scheme under dfferent number of sectors. The exerment results are shown n Fg.6. We can see that the comutaton cost of the two schemes s lnear wth the count of the sector. For examle, generatng the tag of one block wth 512 sectors costs about 1.4s n Yang's scheme and only about 0.42s n our scheme. Moreover, the growth rate of the tag generaton comutaton cost n Yang's scheme s hgher than ours wth the count of sectors ncreasng. Thus, our scheme s more effcent and feasble. Fg 7. Comutaton cost of roof generaton Fg. 5. Setu tme cost Frstly, we evaluate the tme cost of our Setu algorthm, whch s mostly deend on the sze of arameter and. Followng the suggested block sze-16kb, we set sector sze to 256bt, =257 and m 512, then we manly consder the Fg 8. Comutaton cost of verfcaton (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

10 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 10 Fg.7 and Fg.8 show the comutaton cost of roof generaton and verfcaton wth the arameters of =1024 and =257. The count of sectors n each block s 512. Because the comutaton cost of roof generaton and verfcaton manly deend on the number of challenged blocks, we conduct these exerments for dfferent challenged block count. Fg.7 and Fg.8 show the exerment results, from whch we can fnd that both the cost for verfcaton and roof generaton ncreases wth the number of the challenged blocks. For roof generaton, our scheme has a bg advantage comarng to Yang's scheme. For verfcaton, the overhead of our scheme s a lttle bgger than Yang's scheme when the challenged block count s less than about 220. However, wth the challenged block count ncreasng, Yang's overhead ncreases fast and exceeds ours greatly after the 220 challenged blocks. Accordng to reference [13], usng 460 blocks wll detect 1% fracton of msbehavor on 1GB fle wth 99% confdence. In Yang's scheme, to challenge 460 blocks, t wll cost about 3.1s for roof generaton and 1.2s for verfcaton. It only costs 0.52s and 0.8s n our scheme resectvely. Therefore, our RDPC scheme s more feasble. Fg 9. Tme cost for dfferent tyes of ORT In order to demonstrate the effcency of our hybrd data structure n terms of block udates, we conduct another 'nsert blocks' exerment on 1GB fle. The sze of block s set to be 16KB, the total count of blocks s We realze the ORT by array, lnked lst and our hybrd data structure resectvely. Based on these three tyes of ORT, we freuently nsert blocks to random ostons of the fle. We run the exerments 1000 tmes for each condton, the average tme cost s shown n Fg 9. It notes that we set the length of sub-lst n our new hybrd structure to 100. As observed, wth the ncreasng number of nserted blocks, the tme cost of the two tradtonal mlementaton for ORT ( array and lnked lst) [18, 25] s almost ncreasng lnearly whle our new method kees nearly constant at a very low level. Thus, our scheme has great advantages comared wth the other two. In addton, as well known, MHT s also used to suort dynamc oeratons for RDPC [17, 19]. However, to nsert or delete blocks, t needs to frst fnd the recse oston of the block n MHT and then reconstruct the MHT tree. Besdes, the hash values of the new block node and all the leaf nodes whose ath changes after block oeratons should be recalculated. It s easy to rove that MHT wll cost greater overhead even than array for these dynamc block oeratons [43]. Thus, our method s the most effcent one. VI. CONCLUSION In ths aer, we study the ssue for ntegrty checkng of data fles outsourced to remote server and roose an effcent secure RDPC rotocol wth data dynamc. Our scheme emloys a homomorhc hash functon to verfy the ntegrty for the fles stored on remote server, and reduces the storage costs and comutaton costs of the data owner. We desgn a new lghtweght hybrd data structure to suort dynamc oeratons on blocks whch ncurs mnmum comutaton costs by decreasng the number of node shftng. Usng our new data structure, the data owner can erform nsert, modfy or delete oeraton on fle blocks wth hgh effcency. The resented scheme s roved secure n exstng securty model. We evaluate the erformance n term of communty cost, comutaton cost and storage cost. The exerments results ndcate that our scheme s ractcal n cloud storage. REFERENCES [1] R. Buyya, C. S. Yeo, S. Venugoal, J. Broberg, and I. Brandc, Cloud comutng and emergng IT latforms: Vson, hye, and realty for delverng comutng as the 5th utlty, Future Gener. Com. Sy., vol. 25, no. 6, , [2] H. Qan, J. L, Y. Zhang and J. Han, Prvacy reservng ersonal health record usng mult-authorty attrbute-based encryton wth revocaton, Int. J. Inf. Secur., vol. 14, no. 6, , [3] J. L, W. Yao, Y. Zhang, H. Qan and J. Han, Flexble and fne-graned attrbute-based data storage n cloud comutng, IEEE Trans. Servce Comut., DOI: /TSC [4] J. L, X. Ln, Y. Zhang and J. Han, KSF-OABE: outsourced attrbute-based encryton wth keyword search functon for cloud storage, IEEE Trans. Servce Comut., DOI: /TSC [5] J. L, Y. Sh and Y. Zhang, Searchable chertext-olcy attrbute-based encryton wth revocaton n cloud storage, Int. J. Commun. Syst., DOI: /dac [6] J.G. Han, W. Suslo, Y. Mu and J. Yan, Prvacy-Preservng Decentralzed Key-Polcy Attrbute-Based Encryton, IEEE Transactons on Parallel and Dstrbuted Systems, vol. 23, no.11, , 2012 [7] Z. J. Fu, X. M. Sun, Q. Lu, L. Zhou, and J. G. Shu, Achevng effcent cloud search servces: mult-keyword ranked search over encryted cloud data suortng arallel comutng, IEICE Transactons on Communcatons, vol. E98-B, no. 1, , [8] Z. J. Fu, K. Ren, J. G. Shu, X. M. Sun, and F. X. Huang, Enablng ersonalzed search over encryted outsourced data wth effcency mrovement, IEEE Transactons on Parallel and Dstrbuted Systems, DOI: /TPDS , [9] Z. H. Xa, X. H. Wang, X. M. Sun, and Q. Wang, A secure and dynamc mult-keyword ranked search scheme over encryted cloud data, IEEE Transactons on Parallel and Dstrbuted Systems, vol. 27, no. 2, , [10] Y. J. Ren, J. Shen, J. Wang, J. Han and S. Y. Lee, Mutual verfable rovable data audtng n ublc cloud storage, Journal of Internet Technology, vol. 16, no. 2, , [11] Y. Deswarte, J. J. Qusuater, and A. Saïdane, Remote ntegrty checkng, n Proc. 6th Workng Conf. Integr. Internal Control Inf. Syst. (IICIS), 2003, [12] Z. Hao, S. Zhong, and N. Yu, A rvacy-reservng remote data ntegrty checkng rotocol wth data dynamcs and ublc verfablty, IEEE Trans. Knowl. Data Eng., vol. 23, no. 9, , Se [13] G. Atenese, R. Burns, R. Curtmola, J. Herrng, L. Kssner, Z. Peterson, and D. Song, Provable Data Possesson at Untrusted Stores, n Proc. 14th ACM Conf. on Comut. and Commun. Securty (CCS), 2007, [14] G. Atenese, R. D. Petro, L. V. Mancn, and G. Tsudk, Scalable and (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.

11 Ths artcle has been acceted for ublcaton n a future ssue of ths journal, but has not been fully edted. Content may change ror to fnal ublcaton. Ctaton nformaton: DOI /TIFS , IEEE Transactons on Informaton Forenscs and Securty > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] Effcent Provable Data Possesson, n Proc. 4th Int l Conf. Securty and Prvacy n Commun. Netw. (SecureComm), 2008, F. Sebé, J. Domngo-Ferrer, A. Martnez-balleste, Y. Deswarte, and J. Qusuater, Effcent Remote Data Possesson Checkng n Crtcal Informaton Infrastructures, IEEE Trans. Knowledge and Data Eng., vol. 20, no. 8, , Aug C. Erway, A. Küçü, C. Paamanthou, and R. Tamassa, Dynamc Provable Data Possesson, n Proc. 16th ACM Conf. on Comut. and Commun. Securty (CCS), 2009, Q. Wang, C. Wang, K. Ren, W. Lou, and J. L, Enablng Publc Audtablty and Data Dynamcs for Storage Securty n Cloud Comutng, IEEE Trans. Parallel Dstrb. Syst., vol. 22, no. 5, , May, K. Yang and X. Ja, An effcent and secure dynamc audtng rotocol for data storage n cloud comutng, IEEE Trans. Parallel Dstrb. Syst., vol. 24, no. 9, , L. Chen, S. Zhou, X. Huang and L. Xu, Data dynamcs for remote data ossesson checkng n cloud storage, Comut. Electr. Eng., vol. 39, no. 7, , M. N. Krohn, M. J. Freedman and D. Mazeres, On-the-fly verfcaton of rateless erasure codes for effcent content dstrbuton, n Proc IEEE Sym. on Securty and Prvacy (S&P), 2004, Y. Yu, J. N, M. H. Au, H. Lu, H. Wang and C. Xu, Imroved securty of a dynamc remote data ossesson checkng rotocol for cloud storage, Exert Syst. Al., vol. 41, no. 7, , R. Curtmola, O. Khan, R. Burns, and G. Atenese, MR-PDP: Multle-relca rovable data ossesson, n Proc. 28th IEEE Conf. on Dstrb. Comut. Syst. (ICDCS), 2008, Z. Hao and N. Yu, A multle-relca remote data ossesson checkng rotocol wth ublc verfablty, n Proc. 2th Int l Sym. Data, Prvacy, E-Comm. (ISDPE), 2010, R. Mukundan, S. Madra and M. Lnderman, Effcent ntegrty verfcaton of relcated data n cloud usng homomorhc encryton, Dstrb. Parallel Dat., vol. 32, no. 4, , A. F. Barsoum and M. A. Hasan, Provable multcoy dynamc data ossesson n cloud comutng systems, IEEE Trans. Inf. Foren. Sec., vol. 10, no. 3, , Y. Zhu, H. Hu, G. J. Ahn and M. Yu, Cooeratve rovable data ossesson for ntegrty verfcaton n multcloud storage, IEEE Trans. Parallel Dstrb. Syst., vol. 23, no. 12, , H. Wang and Y. Zhang, On the knowledge soundness of a cooeratve rovable data ossesson scheme n multcloud storage, IEEE Trans. Parallel Dstrb. Syst., vol. 25, no. 1, , H. Wang, Identty-Based dstrbuted rovable data ossesson n Multcloud storage, IEEE Trans. Servce Comut., vol. 8, no. 2, , L. Chen, Usng algebrac sgnatures to check data ossesson n cloud storage, Future Gener. Com. Sy., vol. 29, no. 7, , W. Ltwn and T. Schwarz, Algebrac sgnatures for scalable dstrbuted data structures, n Proc. 20th Int'l Conf. on Data Eng. (ICDE), 2004, Y. Yu, J. N, J. Ren, W. Wu, L. Chen and Q. Xa, Imrovement of a remote data ossesson checkng rotocol from algebrac sgnatures, n Proc. 9th Int'l Conf. on Informaton Securty Practce and Exerence (ISPEC), 2014, E. Zhou and Z. L, An mroved remote data ossesson checkng rotocol n cloud storage, n Proc. 14th Int'l Conf. on Algs. and Archs. for Parall Proc. (ICA3PP), 2014, H. Wang and J. L, Prvate certfcate-based remote data ntegrty checkng n ublc clouds, n Proc. 21th Int'l Comutng and Combnatorcs. (COCOON), 2015, A. Juels and B.S. Kal Jr., PORs: Proofs of Retrevablty for Large Fles, n Proc. 14th ACM Conf. on Comut. and Commun. Securty (CCS), 2007, H. Shacham and B. Waters, Comact Proofs of Retrevablty, n Proc. 14th Int l Conf. on Theory and Al. of Crytol. and Inf. Securty (ASIACRYPT), 2008, D. Boneh, H. Shacham, and B. Lynn, Short Sgnatures From the Wel Parng, J. Crytol., vol. 17, no. 4, , Set K. D. Bowers, A. Juels, and A. Orea, Hal: A hgh-avalablty and ntegrty layer for cloud storage, n Proc. 16th ACM Conf. on Comut. and Commun. Securty (CCS), 2009, K. D. Bowers, A. Juels, and A. Orea, Proofs of retrevablty: Theory and mlementaton, n Proc. 1th ACM Cloud Comut. Secur. Worksho (CCSW), 2009, [39] [40] [41] [42] [43] 11 Y. Dods, S. Vadhan, and D.Wchs, Proofs of retrevablty va hardness amlfcaton, n Proc. 6th Theory Crytograh. Conf. (TCC), 2009, Multrecson Integer and Ratonal Arthmetc C/C++ lbrary (MIRACL). [Onlne]. Avalable: htt://nfo.certvox.com/mracl. The Parng-based Crytograhy Lbrary (PBC). [Onlne]. Avalable: htts://crto.stanford.edu/bc/download.html. The GNU Multle Precson Arthmetc Lbrary (GMP). [Onlne]. Avalable: htt://gmlb.org/ M. Sookhak, A. Gan, M. K. Khan and R. Buyya. Dynamc remote data audtng for securng bg data storage n cloud comutng, Inform. Scences, DOI: /j.ns Hao Yan receved the B.S. and M.S. degrees n comuter scence & technology from the Nanjng Unversty of Scence and Technology, Chna, n 2003 and 2006, resectvely. He s currently a Ph.D student of Hoha Unversty, Chna. Hs research nterests nclude cloud comutng securty and aled crytograhy. Jguo L receved hs Ph.D. degree n comuter scence from Harbn Insttute of Technology, Harbn, Chna n Durng , he was a vstng scholar at Centre for Comuter and Informaton Securty Research, Unversty of Wollongong, Australa. He was a vstng scholar n Insttute for Cyber Securty n the Unversty of Texas at San Antono durng He s currently a Professor wth the College of Comuter and Informaton, Hoha Unversty, Nanjng, Chna. Hs research nterests nclude crytograhy and nformaton securty, cloud comutng securty etc. He has ublshed over 100 research aers n refereed nternatonal conferences and journals. Hs work has been cted more than 1600 tmes at Google Scholar. He has served as rogram commttee member n over 20 nternatonal conferences and served as the revewers n over 50 nternatonal journals and conferences. Jnguang Han receved hs Ph.D. degree from Unversty of Wollongong, Australa, n He currently s an assocate rofessor n Jangsu Provncal Key Laboratory of E-Busness, Nanjng Unversty of Fnance and Economcs, Chna. Hs man research nterests nclude crytograhy and nformaton securty. He has served as a rogram commttee member n over 10 nternatonal conferences. He has ublshed more than 20 research aers n refereed nternatonal journals and conferences. He s a member of the IEEE. Ychen Zhang receved Ph.D. degree n the college of comuter and nformaton, Hoha Unversty, Nanjng, Chna. She s currently a lecturer n the college of comuter and nformaton, Hoha Unversty, Nanjng, Chna. Her research nterests nclude crytograhy, network securty. She has ublshed over 30 research aers n refereed nternatonal conferences and journals (c) 2016 IEEE. Personal use s ermtted, but reublcaton/redstrbuton reures IEEE ermsson. See htt:// for more nformaton.