Public Auditing for Ensuring Cloud Data Storage Security With Zero Knowledge Privacy

Transcription

1 P Publc Audng for Ensurng Cloud Daa Sorage Secury Wh Zero Knowledge Prvacy, Wang Shao-huP P, Chang Su-qnP P, Chen Dan-weP P, Wang Zh-weP College of Comuer, Nanjng Unversy of Poss and elecommuncaons, Nanjng 0046, Chna; Nework and Daa Secury Key Laboraory of Schuan Provnce Emal: Absrac In cloud sorage servce, clens uload her daa ogeher wh auhencaon nformaon o cloud sorage server o ensure he avalably and negry of clens' sored daa, cloud server(cs) mus rove o a verfer ha he s acually sorng all of he clen's daa unchanged And, enablng ublc audably for cloud sorage s of crcal morance o users wh consraned comung resources, who can resor o a hrd ary audor (PA) o check he negry of ousourced daa However, mos of he exsng roofs of rerevably schemes or roof of daa ossesson schemes do no consder daa rvacy roblem Zero knowledge rvacy requres PA or he adversary can no deduce any nformaon of he fle daa from audng sysem In hs aer, afer gvng a new consrucon of a recenly roosed cryograhc rmve named aggregaable sgnaure based broadcas (ASBB) encryon scheme, we resen an effcen ublc audng scheme wh zero knowledge rvacy he new scheme s as effcen as he scheme resened by Shacham and Waers whou consderng rvacy and s secure n he random oracle model Keywords: Cloud Comung, Cloud Sorage, Publc Audng, Zero-Knowledge Prvacy, Inegry Inroducon Recenly, cloud comung s recevng more and more aenons, from boh ndusral and academc communy Cloud comung searaes usage of I resources from her managemen and manenance, so ha users can focus on her core busness and leave he exensve manenance of I servces o cloud servce rovder However users of ousourced sorage are a he mercy of her sorage rovders for he connued avalably of her daa Even Amazon's S, he bes-known sorage servce, has exerenced sgnfcan downme Here we are consderng scenaros where users may have concerns of he negry and rvacy of her daa sored n he cloud sorage As users no longer hyscally ossess he sorage of her daa, radonal cryograhc rmves for he urose of daa secury roecon canno be drecly adoed In arcular, smly downloadng all he daa for s negry verfcaon s no a raccal soluon due o he exensveness n I/O and ransmsson cos across he nework In order o solve remoe negry checkng roblem n cloud sorage, a lo of works[-6] have been done focusng on varous condons of alcaon and aemng o acheve dfferen goals Among hese works, he mehods can be dvded as Proof of Daa Possesson( PDP ) and Proofs of Rerevably ( PoR ) PDP scheme, frs resened by Aenese e al [,6] are relaed roocols ha only deec a large amoun of corruon n ousourced daa her scheme ulzes he RSA-based homomorhc auhencaors for audng ousourced daa and suggess randomly samlng a few blocks of he fle However, he schemes have o se a ror bound on he number of auds and doesn' suor ublc aud ably Publc audably allows an exernal ary, n addon o he user hmself, o verfy he correcness of remoely sored daa Whle PoR scheme[], frs resened by Juels, s a challenge-resonse roocol ha enables a cloud rovder o demonsrae o a clen ha a fle s rerevable, e, recoverable whou any loss or corruon her scheme use so-checkng and errorcorrecng codes o ensure boh "ossesson" and "rerevably" of remoe daa fles Erway e al[8] was he frs o roose dynamc PDP scheme hey develoed a sk lss based mehod o enable rovable daa ossesson wh dynamc suor however, he effcency of her scheme remans n queson In [9], Wang e al rovded a dynamc archecure for ublc checkng

2 However, mos of hese schemes [,4,] do no consder he rvacy roecon of users daa agans exernal audors Indeed, cloud servce rovder may oenally reveal users daa o audors or adversares durng he audng From he ersecve of roecng daa rvacy, hs severe drawback grealy affecs he secury of hese roocols n Cloud Comung[5] Recenly Wang e al [6] resened wo rvacy-reservng ublc audng schemes for cloud sorage sysems based on Shacham and Waers scheme[4] In her frs scheme, he adversary can no deduce he daa from he audng sysem f he daa have hgh enroy, bu s no secure f he daa sored have low enroy, for he adversary can have a brue-force guess of he message offlne he second neffcen scheme hey resened can rovde zero knowledge rvacy wh much less effcency han [4], whch means he adversary has erfec zero knowledge from he audng sysem In hs aer, we ackle he roblem of zero knowledge rvacy-reservng ublc audng roblem for cloud sorage sysem o acheve he zero knowledge rvacy, we frs resen a new consrucon of a recenly roosed cryograhc rmve called aggregaable sgnaure based broadcas (ASBB for shor) encryon scheme[7] Based on hs new ASBB scheme, we roose a shor, effcen homomorhc ublc verfable scheme wh zero knowledge rvacy he new scheme s almos as effcen as he orgnal Shacham and Waers scheme[4] and s secure n he random oracle model he res of he aer s organzed as follows In Secon, we resen he relmnares and he buldng blocks relaed o hs aer; he defnon and secury requremens of ublc audng scheme for cloud sorage are revsed n secon ; In secon 4, we resen he dealed descron of our consrucons Secon 5 gves he secury and erformance analyss of he new scheme and concluson s gven n secon 6 Noaons and Buldng Blocks In hs secon, we gve a bref descrons of corresondng relmnares and buldng blocks ncludng blnear mas, comuaon hard roblems, ASBB schemes and knowledge roof sysem Blnear Ma and Hard roblems Defnon Blnear Ma Le G and G be mullcave cyclc grous of rme order Le g be a generaor of grou G A blnear ma s a ma e : G G G sasfyng: a b ab For any u, v G and a, b Z, e ( u, v ) = e( u, v) hs blneary mles ha for any u, u G, e ( u u, v) = e( u, v) e( u, v) here exss an effcenly comuable algorhm for comung e he ma should be non-rval, e, e s non-degenerae: e ( g, g) Some hard roblem assumons relaed o hs aer are resened as follows: a b Comuaonal Dffe-Hellman (CDH) Assumon: Gven g, g, g for unknown a, b Z, ab s hard o comue g a b c Decsonal Blnear Dffe-Hellman (DBDH) Assumons: Gven g, g, g, g for unknown abc a, b, c Z, s hard o dsngush he value = e( g, g) wh random number Z G Blnear Parng Assumon: Gven G, s generaor g, and he value of e( X, g) G, s hard o comue X G a b Blnear Dffe-Hellman Assumon: Gven g, g, g for unknown a b Z, for any random ab h g G, s hard o comue e ( h, g) Aggregaable Sgnaure-Based Broadcas Encryon, As o aggregaable Sgnaure-Based Broadcas(ASBB) Encryon scheme[7], he ublc key can be smulaneously used o verfy sgnaures and encry messages, and any vald sgnaure can be used o

3 decry cherexs under hs ublc key In [7], ASBB scheme s resened o desgn one round asymmerc grou key agreemen Mos sgnfcance of ASBB scheme s ha has key-homomorhc roery, whch means ha, gven wo sgnaures on he same message under wo secre keys, one can effcenly roduce a sgnaure of he same message under a new secre key derved from he orgnal wo keys he secury of an ASBB scheme ncororaes he sandard noon of secury for a sgnaure scheme, e, exsenal unforgeably under he chosen message aack (EUF-CMA)[8] and he secury as an encryon scheme In [7], Wu e al resened an effcen ASBB scheme based on blnear arngs, and he descron of he scheme s deced below: Publc arameers: Le (, G, G, e) ParGen ( λ ), and g s he generaor of G Le H :{0,} G be a cryograhc hash funcon he sysem arameers are ( g, H,, G, G, e) r Publc/secre keys: Selec a random r Z, X G \{ } Comue R = g, A = e( X, g) he ublc key s k = ( R, A) and he secre key s sk = ( r, X ) r Sgn: he sgnaure of any srng s {0,} under he ublc key ( R, A) s σ = XH ( s) Verfy: Gven a message-sgnaure ar ( s, σ ), he verfcaon equaon s e (σ, g) e( H( s), R) = A If he equaon holds, ouu o reresen ha σ s a vald sgnaure Oherwse ouu 0 and rejec he sgnaure Encryon: For a lanex m G, randomly selec and comue c = g c = R c = ma he cherex s ( c, c, c) Decryon: Afer recevng a cherex c, c, ) ( c ( s, σ ) can exrac he lanex as follow: m = c /( e( σ, c ) e( H ( s), c)) Knowledge Proof for Equaly of Dscree Logarhm Z,,, anyone wh a vald message-sgnaure ar In cryograhy, knowledge roof s an neracve roof n whch he rover succeeds n convncng a verfer ha he knows somehng he queson relaed o he aer s how o rove knowledge ha wo ublc daa have he same dscree logarhm whou revealng any oher nformaon abou hs value Le G and G be mullcave cyclc grous of rme order Le g be generaors of G and random value A G Gven wo ublc daa h G and R G, he rover should rove ha log g h = log A R = x, bu he can no leak any nformaon of x We ado he knowledge roof scheme resened n [9], whch s gven as follows: he rover chooses randomly s and comues: Z s s ( a, b) = ( g, A ), c = H ( a, b), r = s + cx where H ( ) s a secure hash funcon Prover sends a, b, r o he verfer r c r c he verfer frs comues c = H ( a, b), and acces he roof f g = ah, A = br Sysem Archecure and Secury Model In hs secon, we gve he defnons of cloud sorage ublc audng scheme and he corresondng secury requremens ncludng comleeness, soundness and rvacy We used he basc cloud sysem archecure whch s gven n [6] he cloud daa sorage servce nvolves hree dfferen enes, as llusraed n Fg : he cloud user, who has he oenal daa fles o be sored n he cloud; he cloud server (CS), whch s managed by he cloud servce rovder (CSP) o rovde daa sorage servce; he hrd ary audor (PA), who s rused o assess he cloud sorage servce relably on behalf of he cloud user uon reques

4 Fg : he archecure of cloud daa sorage servce Defnon Publc Audng for Cloud Sorage A ublc audng scheme for cloud sorage s defned hrough hree algorhms: Keygen, Genag and Aud, whch behave as below: Keygen ( λ ) Gven secury arameer λ as nu, hs randomzed algorhm generaes scheme s ublc arameers and cloud users ublc/rvae key ar ( k, sk ) Genag ( sk, F) he randomzed algorhm akes user s secre key sk and daa fle F {0,} as nus, and roduces he auhencaon ags, whch conans nformaon on he fle beng sored and addonal secre nformaon encryed under he secre key sk he fle F and ag wll be sored n he CS Aud he randomzed audng algorhms can be defned as an neracve roocol ( CS ( k, F, ) PA ( k) ) for rovng fle negry Durng roocol execuon, PA(verfer), akng he ublc key k and some rocessed fle descron ha s ouu by Genag as nu, ssues an audng challenge o he cloud server And he CS (rover) wll derve a resonse message usng fle F sored and he fle ag as nus A he end of he roocol run, PA ouus, whch means ha he fle s sored unchanged on he cloud server; Oherwse ouus 0 We assume PA, who s n he busness of audng, s relable and ndeenden Whle CS s resumed o be oenally unrusworhy I may corru he fle-sysem n a fully Byzanne manner he cloud may aler or dro fle-sysem oeraons ransmed by he oral; may corru or erase fles We also assume ha CS has no ncenves o reveal her hosed daa o exernal ares because of some regulaons requremens herefore, he audor or adversary wll exrac he ousourced daa hrough he communcaon beween CS and PA he secury requremens of he ublc audng scheme for cloud sorage ncludng comleeness, soundness and rvacy he deal defnons are gven below: Defnon Comleeness Comleeness requres ha, for all key ars ( k, sk ) ouu by Keygen, for all fles M {0,} and ag ouu by Genag ( sk, M ), he PA wll always ouu when neracng wh he vald CS va audng algorhm: rob ( Aud( CS( k, M, ) PA( sk)) = ) = Defnon Soundness A ublc audng scheme s assumed o be sound f any cheang CS whou sorng he unchanged fle M can no convnce he PA We ulze he defnon of soundness resened n [4] whch s formulzed by he followng game beween an adversary A and a challenger C : Se he challenger generaes key ar ( k, sk ) by runnng algorhm Keygen ( λ ), and rovdes ublc key k o A Se he adversary can now nerac wh he challenger for some oracle queres I can make queres o Genag oracle, and for each query, he challenger chooses some fle M and comues Genag( sk, M ) Boh M and are reurned o he adversary In addon, he adversary can underake audng execuons wh he challenger In hese roocol execuons, he challenger lays he ar of he verfer and he adversary lays he ar of he rover Se he adversary generaes and sends he challenger some daa fle M and he challenger answers he corresondng ag hen he adversary changes he fle o M M and underakes

5 audng execuons wh he challenger: Aud( C( k) A( k, M, )) We say a cloud sorage ublc audng scheme s sound f he followng robably s neglgble: rob ( Aud( C( k) A( k, M, )) = ) Defnon 4 Zero-knowledge Prvacy Zero-knowledge rvacy means he adversary can oban zero knowledge nformaon of he fles daa sored from he audng scheme We formalze he defnon by he followng game beween he adversary A and he challenger C : Se and Se are almos he same as he ones n he defnon of soundness he dfference s n he roocol execuons, he challenger lays he ar of he rover, e CS, and he adversary lays he ar of he verfer, e PA Fnally, as o any new fle daa M whch s unknown o he adversary, he challenger frs roduces he ag ; hen he adversary wll underake audng execuons wh he challenger: Aud ( A ( k ) C ( k, M, )) We say a ublc audng scheme s zero-knowledge rvacy f for any funcon f on he fle M, he followng robably s neglgble: rob( A( k) : f ( M)) rob( A( k) C( k, M, ) : f ( M)) Here rob ( A( k) : f ( M)) means he robably ha he adversary guesses he value of f ( M) successfully whou any audng rocesson; and he laer robably rob( A( k) C( k, M, ) : f ( M)) means adversary guesses f ( M) hrough he audng scheme So he zero knowledge rvacy defnon ndcaes he adversary can no ge any more useful nformaon from he audng scheme o guess f M ) successfully 4 Our Consrucons ( In hs secon, we frs gve a new effcen consrucon of ASBB scheme ha has aggregaable roery; hen we resen a ublc audng scheme sasfyng zero knowledge rvacy based on he new ASBB scheme 4 A New Consrucon of ASBB Scheme he new roosed ASBB scheme s almos as effcen as he one resened n [7], and he deal descron of he scheme s as follow: λ Publc arameers: Le (, G, G, e) ParGen( ), and g s he generaor of G Le H :{0,} G be a cryograhc hash funcon he sysem arameers are ( g, H,, G, G, e) r Publc/Secre keys: Selec a random number r Z, X G \{ } Comue R = g, A = e( X, g) he ublc key k = ( R, A) and he secre key sk = ( r, X ) Sgn: o gve he sgnaure of any srng m Z under he ublc key k, frs choose randomly m r s {0,}, comue σ = X H( s), and he sgnaure s ( s, σ ) Verfy: Gven a message-sgnaure ar ( m, s, σ ), he verfcaon equaon s e, g) e( H ( s), R) = A ouu 0 and rejec he sgnaure Encryon: For any lanex ω G, selec a random number and comue c = g m (σ If he equaon holds, ouu o reresen ha sgnaure s vald; Oherwse Z, c = R, c = ωa he cherex s ( c, c, c) Decryon: Gven he cherex c, c, ), anyone wh a vald message-sgnaure ar ( c m ( m, s, σ ) can exrac he lanex as: ω = c /( e( σ, c ) e( H ( s), c)) We can reduce he secury of he new ASBB scheme o he secury of he scheme n [7] aken he sgnaure scheme as an examle, I s easy o see f he adversary can forge a vald sgnaure ( m, s, σ ) n he new scheme wh he ublc key ( R, A), he can forge a vald sgnaure ( s, σ m ) for he scheme

6 [7] wh he ublc key ( R m, A) Usng he same roof mehod n [7], we can conclude he followng heorem: heorem 4 Le G be a blnear grou of rme order, he followng clams hold: () he roosed ASBB scheme s aggregaable agans non-adave chosen message aacks n he random oracle model assumng he decson BDHE assumon holds n G ; () he roosed ASBB scheme s exsenally unforgeable under adave chosen-message aack and ndsngushable under chosen lanex aack n he random oracle model under he CDH and DBDH assumons 4 Publc Audng Scheme wh Zero-knowledge Prvacy In he followng, we resen he audng schemes wh zero-knowledge rvacy ulzng he new roosed ASBB scheme he mehod s easy o undersand Usng he new ASBB scheme, PA encrys arbrary message and sends he cherex as he challenge o CS, and CS can decry he cherex as he resonse only f he fle sored s n good condon he deal descron of he scheme s as follow: Keygen ( λ ) Le G and G be mullcave cyclc grous of rme order, and e : G G G be a blnear ma Le g be a generaor of G H ( ) s a secure ma-o-on hash funcon: { 0,} G, whch mas srngs unformly o G he sysem arameers are r ( g, H,, G, G, e) Cloud user selec a random number r, X G \{ } Comue R = g and A = e( X, g) he ublc key k = ( R, A) and he secre key sk = ( r, X ) Genag ( sk, F) Gven he daa fle F = { m } and each =,, n m Z, he user comues he m r auhencaor ag as σ = X H ( d ) G for each, where d s chosen by he user unformly a random from Z as he denfer of fle F Aud he neracve roof rocess beween PA and CS s roceeded as follows: Se o generae he challenge message for he audng, he PA frs cks randomly Z, c - elemen subse I = { s, s,, sc} [, n], and for each I, PA chooses a random number v hen he PA chooses a random number m G, and comues v c = g, c = R, c = A, c = m e( H ( d ), c ) I In addon, usng he mehod n [9], PA mus gve a roof of knowledge ha c and c have he equal dscree logarhms corresondng o g and A : POK{( g, A, c, c) : log g c = log A c} he fnal audng challenge s {(, v ) I, c, c, c, POK} Se Uon recevng he challenge, CS frs verfes wheher he roof POK s vald If s no vald, he audng fals; Oherwse CS comues: σ v = I σ, = v m, I I = = v B c e( X, g ) m hen CS decrys he message c and sends he lanex o PA as he resonse: m = c e( σ, c )) / B Z ( Se Afer recevng he message m, PA checks wheher m = m If hey are equal, PA acces he roof; Oherwse CS does no ass he audng roof he correcness of he above verfcaon equaon s elaboraed as follows, we relace H ( d ) wh H for convenence : v v r e(, c ) c = e(, g ) m e( H, g ) m r v v r σ = m e( ( X ( H ) ), g ) e( H, g ) σ mv I = m e X g = m e X g (, ) ( (, ) ) I 5 Performance and Secury mv = m B

7 In hs secon, we gve he erformance and secury analyss of our new zero-knowledge rvacy reservng ublc audng scheme, and we show ha our scheme can rovde soundness and zeroknowledge rvacy requremens 5 Performance Analyss Because he schemes resened by Wang eal[6] are based on Shacham and Waers[4], we comare new roosed scheme wh he orgnal scheme [4] whch does no consder rvacy roblem he comarson consss n sorage cos, communcaon cos and comuaon cos o make he comarson convenen, we suose n boh schemes, CS sores he same fle F and PA chooses he same I = { s, s,, sc} [, n], and v for each I Sorage Cos he number of he auhencaon ag n boh schemes s he same he ublc key of scheme [4] has grou numbers and he secre key has neger n Z ; whle he ublc key of our scheme has grou numbers and he secre key has grou number and neger Communcaon Cos In scheme [4], wha he PA sends s {(, v )} and CS needs o send back grou numbers and neger In our scheme wh zero knowledge rvacy, PA sends exra grou ABLE I COMPARISON OF NEW CONSRUCION WIH SCHEME IN [4] Sorage Commun caon Comua on New Scheme Scheme n [4] PK G G SK G+ I I PA {(, )} + 5G + I v {(, CS G G + I v )} PA BM + 5GE (Off-Lne) BM + GE CS BM + 6 GE GE numbers { c, c, c} and messages generaed by POK (ncludng grou numbers and neger accordng o [9]) exce for {(, v )}, and CS only needs o send back grou number, e he lanex Comuaon Cos Here we only coun he number of mos exensve cos comuaon ncludng blnear ma and grou exonenaon In scheme[4], he comuaon of PA ncludes blnear ma, grou exonenaon comuaon n he Se of audng hase, and CS needs o comue grou exonenaon; whle n our scheme, PA needs o comue blnear ma, 5 grou exonenaon n he Se of he audng hase, and CS should roceed blnear ma and 6 grou exonenaon comuaon he comarsons are lsed n he able, where G and I mean grou number and neger; GE and BM mean grou exonenaon and blnear ma comuaon resecvely From he comarson, we can see new scheme has a lle heaver communcaon overheads, and has more grou exonenaon comuaon han scheme [4] In fac, mos of he grou exonenaon comuaon of our scheme les n he knowledge roof scheme POK However, we can see he comuaon of PA n our scheme haens n Se o generae he challenge, so hese comuaon can be re-comue off-lne whch does no affec he audng scheme hus he me consumed n our scheme only ncludes abou blnear ma and 6 grou exonenaon comuaon Because comung a blnear ma can be sgnfcanly slower han comung an exonenaon, we can conclude ha our scheme s as effcen as Shacham and Waers scheme whou rvacy consderaon

8 5 Secury Analyss We show he new roosed scheme can rovde soundness and zero knowledge rvacy from he followng wo heorems heorem 5 If he sgnaure scheme used for fle ags s exsenally unforgeable and he comuaonal Dffe-Hellman roblem and Blnear Parng assumon are hard, hen f he cloud server does no ossess he secfc daa nac as s, he can no ass he aud hase wh nonneglgble robably Proof Afer recevng PA s challenge message {(, v ) I, c, c, c, POK}, CS has o comue v e( H ( d ), c ) o decry he cherex c as he resonse From he comuaonal Dffe- Hellman assumon, we know s hard o comue c from c and c So CS can no deduce v e( H ( d ), c ) drecly Now we rove f he adversary can chea he PA n he audng scheme, we can break he Blnear Parng assumon By he correcness of he scheme, we know he execed resonse ( σ, B) ha CS generaes mus sasfy: v B = e( X, g ) = e( σ, c ) e( H ( d ), c ) (4) I If he fle ha CS sores has been changed, we know here exs ( σ σ, B ) ha can ass he verfcaon equaon: ' v B = e( X, g ) = e( σ, c) e( H ( d ), c ) (5) I I follows from he verfcaon equaon ha ', or should conradc our assumon above From equaon (4) and (5), we can ge: ' B / B = e( X, g ) = e( σ / σ, c ) = e( σ / σ, g ) ' ') whch means X = σ /σ, e ( / ) ( X = σ σ hs oucome conradc he Blnear Parng assumon heorem 5 If he knowledge roof scheme for equaly of dscree logarhm n [9] s correc, he new ublc audng scheme can rovde zero knowledge rvacy Proof: As o any challenge {(, v ) I, c, c, c, POK}, messages c and c should have he same dscree logarhm corresondng o g and A because of he correcness of POK scheme So he resonse CS sendng back s: m r v r v c e(, c ) / c = c e( ( X H ), c ) c = c e( X, c ) e( ( H ), c ) c I σ / I / I where = v m I s easy o see f c and c have he same dscree logarhm corresondng o g and A, e ( X, c) mus equal o r v c, and he resonse can be smlfed as c e( ( H I ), c ), whch can be deermned by he adversary alone So he neracve audng communcaon does no leak any nformaon of he daa fle sored In fac, we can see any adversary can choose randomly {(, v )}, and cks random elemen Z, and comues: v c = g, c = R c = A c = m e(,, H ( d ), c ) I he manuscr ha he adversary ouus s {(, v ) I, c, c, c, m, POK}, whch has he dencal dsrbuon of he real neracon beween PA and CS ha s o say, he adversary can no ge any nformaon from he audng roof and he can ouu he manuscrs all by hmself 6 Concluson Secury and negry of daa are he major concerns of clen n he cloud sorage nework In hs aer, we ackle he rvacy roblem caused by he ublc audng scheme Afer resenng a new consrucon of ASBB scheme, we roose an effcen zero knowledge rvacy reservng ublc

9 audng scheme for daa sorage secury n cloud comung, e he adversary can no deduce any nformaon of he fle sored hrough he audng neracon beween CS and PA he new ublc audng scheme no only elmnaes he burden of cloud user from he edous and ossbly exensve audng ask, bu also allevaes he users fear of her ousourced daa leakage he new scheme has roughly he same effcency as he Shacham and Waers scheme whou consderng rvacy roblem In hs aer, we only consder he suaon ha cloud users do no change daa fle sored; whle n racce, cloud users may modfy, nser, add or delee her ousourced daa How o consruc zeroknowledge ublc audng scheme for dynamc daa sorage wll be consdered n he fuure Acknowledgmen hs work s suored by he Prory Academc Program Develomen of Jangsu Hgher Educaon Insuons (PAPD), Naonal Naural Scence Funds (Gran No60908) and Nanjng Unversy of Poss and elecommuncaons Funds (Gran NoNY0807) References [] M Enar, N Mahl, Gene Auhencaon and negry n ousourced daabases [J] ACM ransacons On Sorage 006, (): 07-8 [] G Aenese, R Burns, R Curmola, e al Provable daa ossesson a unrused sorescryology eprn Archve, Reor 007/0, 007 Onlne: h://ernacrorg/ Verson of 7 Dec 007; vsed 0 Feb 008 [] A Juels, B Kalsk Pors: roofs of rerevably for large fles[c] Proceedngs of CCS 007 Alexandra, VA, USA, [4] H Shacham, B Waers Comac roofs of rerevably [C] Proceedngs of ASIACRYP 008 Melbourne, Ausrala, [5] F Sebe, J Domngo-Ferrer, A Marnez-Ballese, e al Effcen Remoe Daa Possesson Checkng n Crcal Informaon Infrasrucures IEEE rans Knowledge and Daa Eng, [6] G Aenese, RD Pero, LV Mancn, e al Scalable and effcen rovable daa ossesson [C] Proceedngs of he 4h nernaonal conference on secury and rvacy n Communcaon neworks Isanbul, urkey: ACM, 008: [7] C Wang, Q Wang, K Ren, e al Ensurng daa sorage secury n cloud comung[c] Proceedngs of IW QoS 009, Charleson, Souh Carolna, USA, 009 [8] C Erway, A Kucu, C Paamanhou, e al Dynamc rovable daa ossesson [EB/OL] Cryology eprn Archve, Reor 008/4, 008 [9] Q Wang, C Wang, J L, e al Enablng ublc verfably and daa dynamcs for sorage secury n cloud comung[c] In Proc of ESORICS 09, San Malo, France, Se 009 Lecure Noes n Comuer Scence, 009, Volume 5789/009: [0] K D Bowers, A Juels, A Orea Proofs of rerevably: heory and mlemenaon[c] In: Proc of he 009 ACM Worksho on Cloud Comung Secury, CCSW 009, Co-Locaed wh he 6h ACM Comuer and Communcaons Secury Conf, CCS 009 New York: Assocaon for Comung Machnery, [] S Kamara, K Lauer Cryograhc Cloud Sorage[C] Lecure Noes n Comuer Scence Fnancal Cryograhy and Daa Secury Berln: Srnger, 00: 6-49 [] Z Hao, N Yu A mulle-relca remoe daa ossesson checkng roocol wh ublc verfably[a] Proc Second In' Daa, Prvacy and E-Commerce Sym (ISDPE '0), 00 [] Q Wang, C Wang, K Ren, W Lou, and J L Enablng ublc audably and daa dynamcs for sorage secury n cloud comung[j] IEEE ransacons on Parallel and Dsrbued Sysems, vol, no 5, , 0 [4] Q Zheng and S Xu Far and dynamc roofs of rerevably[c] In Proc s ACMM Conference on Daa and Alcaon Secury and Prvacy (CODASPY), 0 [5] M A Shah, M Baker, J C Mogul, and R Swamnahan Audng o kee onlne sorage servces hones[c] In Proc of HoOS 07, 007, -6

10 [6] C Wang, SS-M Chow, Q Wang, K Ren and WJ Lou Prvacy-Preservng Publc Audng for Secure Cloud Sorage h://ernacrorg/009/579df [7] Wu, Q, Mu, Y, Suslo, W, Qn, B, Domngo-Ferrer, J: Asymmerc Grou Key Agreemen[C] In: Joux, A (ed) EUROCRYP 009 LNCS, vol 5479, 5-70 Srnger, Hedelberg (009) [8] S Goldwasser, S Mcal, R Rves A Dgal Sgnaure Scheme Secure agans Adave Chosenmessage Aacks [J] SIAM J Comung 7(), 8-08 (988) [9] D Chaum, P Pederson Walle daabases wh observers [C] EF Brchell(Ed): Advances n Cryology- CRYPO 9, LNCS 740, 89-05, 99