Using cloud storage services, users can store their data in the cloud to avoid the expenditure of local data storage and maintenance. To ensure the integrity of the data stored in the cloud, many data integrity auditing schemes have been proposed. In most, if not all, of the existing schemes, a user needs to employ his private key to generate the data authenticators for realizing the data integrity auditing. Thus, the user has to possess a hardware token (e.g. USB token, smart card) to store his private key and memorize a password to activate this private key. If this hardware token is lost or this password is forgotten, most of the current data integrity auditing schemes would be unable to work. In order to overcome this problem, we propose a new paradigm called data integrity auditing without private key storage and design such a scheme. In this scheme, we use biometric data (e.g. iris scan, fingerprint) as the user's fuzzy private key to avoid using the hardware token. Meanwhile, the scheme can still effectively complete the data integrity auditing.We utilize a linear sketch with coding and error correction processes to confirm the identity of the user. In addition, we design a new signature scheme which not only supports blockless verifiability, but also is compatible with the linear sketch. The security proof and the performance analysis show that our proposed scheme achieves desirable security and efficiency.

The key exposure is a serious threat for the security of data integrity auditing. Once the user's private key for auditing is exposed, most of the existing data integrity auditing schemes would inevitably become unable to work. To deal with this problem, we construct a novel and efficient identity-based data integrity auditing scheme with key-exposure resilience for cloud storage. This is achieved by designing a novel key update technique, which is fully compatible with BLS signature used in identity-based data integrity auditing. In our design, the Third Party Auditor (TPA) is responsible for generating update information. The user can update his private key based on the private key in one previous time period and the update information from the TPA. Furthermore, the proposed scheme supports real lazy update, which greatly improves the efficiency and the feasibility of key update. Meanwhile, the proposed scheme relies on identity-based cryptography, which makes certificate management easy. The security proof and the performance analysis demonstrate that the proposed scheme achieves desirable security and efficiency.

Public auditing is a significant technique in cloud-based Internet of Things (IoT) systems, which enables the verifier to check the integrity of IoT data stored in the cloud. Nowadays, data become a core property for owners. Once the data of one owner are sold to another one, the ownership of these data has to be transferred. However, the existing public auditing schemes with data transfer require all the authenticators corresponding to the transferred data to be transformed to the new ones for integrity auditing. It incurs significant computation cost because of recomputing the new authenticators for all transferred data, especially when a vast quantity of data is being transferred. In addition, the data privacy and the identity privacy of the data owner cannot be protected for the verifier in such schemes. Thus, how to achieve efficient data transfer and privacy protection are key challenges in public auditing with data transfer for cloud-based IoT data. In this article, we propose a privacy-preserving identity-based public auditing scheme with efficient data transfer for cloud-based IoT data (PPADT). In PPADT, all the authenticators corresponding to the transferred data blocks do not need to be transformed. We only need to transform an aggregated authenticator in the integrity auditing phase. It means that the computation cost of data transfer is independent of the number of transferred data blocks. Furthermore, the data owner’s identity privacy can be ensured with the assistance of the private key generator. The data privacy can also be guaranteed by employing the random masking technique.

The cloud storage auditing with deduplication is able to verify the integrity of data stored in the cloud while the cloud needs to keep only a single copy of duplicated file. To the best of our knowledge, all of the existing cloud storage auditing schemes with deduplication are vulnerable to brute-force dictionary attacks, which incurs the leakage of user privacy. In this paper, we focus on a new aspect of being against brute-force dictionary attacks on cloud storage auditing. We propose a cloud storage auditing scheme with deduplication supporting strong privacy protection, in which the privacy of user's file would not be disclosed to the cloud and other parties when this user's file is predictable or from a small space. In the proposed scheme, we design a novel method to generate the file index for duplicate check, and use a new strategy to generate the key for file encryption. In addition, the user only needs to perform lightweight computation to generate data authenticators, verify cloud data integrity, and retrieve the file from the cloud. The security proof and the performance evaluation demonstrate that the proposed scheme achieves desirable security and efficiency.