The rapid popularization of cloud storage relies on standardized definitions and systematic architectural research. Mell and Grance [1] released the authoritative cloud computing definition formulated by the National Institute of Standards and Technology (NIST), clarifying the basic service modes and core characteristics of cloud computing. Armbrust et al. [2] comprehensively summarized the overall architecture, technical advantages and potential risks of cloud computing, laying a theoretical foundation for subsequent research on outsourced storage. With the large-scale migration of enterprise and user data to the cloud, security issues caused by the separation of data ownership and storage rights have become increasingly prominent. Hashizume et al. [3] systematically sorted out various security threats in cloud computing scenarios and pointed out that data integrity damage is a critical security risk that urgently needs to be addressed. The foundational work in the field of data integrity auditing was initiated by the Provable Data Possession (PDP) model proposed by Ateniese et al. [4]. Leveraging homomorphic authenticators, this scheme realizes lightweight remote data verification without downloading complete files, pioneering the research paradigm of public auditing. However, the original PDP scheme only supports static data verification and cannot repair corrupted data. To address this limitation, Juels and Kaliski [5] proposed the Proof of Retrievability (PoR) model. Combined with error-correcting coding technology, it supports the recovery of partially corrupted data while completing integrity auditing. On this basis, Shacham and Waters [6] constructed a streamlined and efficient PoR protocol under standard model assumptions, greatly reducing the communication overhead of auditing. In practical cloud service scenarios, users frequently modify, insert and delete cloud data. To meet the demand for dynamic data, Wang et al. [7] designed a public auditing scheme supporting full-dimensional dynamic updates by combining Merkle Hash Trees, enabling iterative data updates and real-time integrity verification. Facing the needs of multi-user collaborative office in cloud sharing scenarios, Yuan and Yu [8] proposed a multi-user-oriented integrity detection protocol to optimize the collaborative editing and joint auditing process of shared data. For distributed multi-cloud storage architectures, Wang et al. [9] adopted a fragmented distributed data storage strategy and built a high-fault-tolerant cross-cloud auditing mechanism to improve the operational reliability of heterogeneous cloud storage systems. Ali et al. [10] summarized the technical framework, mainstream models and existing limitations of outsourced data auditing in the form of reviews, and comprehensively combed the development context of traditional auditing technologies. Privacy preservation and lightweight design are two core optimization directions for traditional auditing schemes. Wang et al. [11] introduced data blinding and random masking technologies to construct a privacy-preserving public auditing scheme, effectively preventing the leakage of users’ sensitive data during auditing. Targeting resource-constrained scenarios such as mobile terminals and edge devices, Yoosuf and Anitha [12] proposed a lightweight dual auditing protocol LDuAP, which streamlines complex cryptographic operations to adapt to the computing power constraints of low-power devices. Zheng et al. [13] reviewed the development status of blockchain, providing theoretical support for decentralized auditing. Yue et al. [14] conducted research on data integrity verification in edge-cloud collaboration scenarios, further enriching the cross-domain storage security auditing system. Huang et al. [15] constructed a collaborative cloud data auditing architecture based on distributed collaboration ideas. From the perspective of auditing behavior constraint, Miao et al. [16] designed an incentive-based auditing protocol to restrain the negative behavior of auditing nodes. Liu et al. [17] optimized on-chain auditing processes by adopting blockchain expansion technology. Zhang et al. [18] focused on multi-replica storage scenarios and proposed a decentralized and efficient multi-replica auditing scheme. Zhu et al. [19] designed a universal dynamic auditing service framework for cloud outsourced data. Yang and Jia [20] further improved dynamic auditing protocols to enhance auditing security and efficiency in complex cloud environments. Zhou et al. [21] constructed a quantum-resistant cloud data PDP scheme by integrating lattice cryptography. Yang et al. [22] designed a lightweight provable data possession scheme specifically for mobile terminals. Li et al. [23] realized privacy-preserving remote data integrity detection by integrating identity-based cryptography. Yuan et al. [24] combined identity-based cryptography with blockchain to achieve cross-environment trusted data verification. Li et al. [25] built a blockchain-assisted batch public auditing mechanism for big data scenarios. Xu et al. [26] realized privacy-friendly data auditing in consortium blockchain scenarios based on zero-knowledge proofs. Chang et al. [27] optimized the efficiency of multi-replica verification in multi-cloud architectures to improve cross-cloud storage auditing performance. Li and Hu [28] designed a smart contract-driven multi-party collaborative auditing mechanism for multiple audit participants. Tahir et al. [29] proposed a lightweight blockchain-based security authentication and data auditing framework for the Internet of Medical Things. Nevertheless, most public auditing schemes rely on a trusted third-party auditor (TPA), and inherent security risks such as single point of failure of auditing nodes and collusion between cloud servers and auditors cannot be fundamentally eliminated.

To solve the trust dilemma of centralized third-party auditing, blockchain technology with decentralization, immutability and traceability has been gradually applied in the field of cloud data auditing. Miao et al. [30] constructed a transparent certificateless cloud storage auditing scheme, which completely replaces centralized third-party auditors with smart contracts to realize full-process auditing automation. Nweje [31] illustrated the application value of blockchain in security auditing, traceability and tamper resistance, and pointed out the development trend of decentralized auditing technology. Based on blockchain auditing, Li et al. [32] integrated encrypted deduplication technology to reduce cloud storage costs while ensuring data integrity. Zhu et al. [33] proposed a lightweight certificateless auditing scheme without third-party auditors, which further reduces system overhead and realizes lightweight decentralized auditing. From the perspective of data compliance supervision, Wang et al. [34] built a GDPR-compliant blockchain auditing framework to meet the standardized management requirements of data security. Shen et al. [35] combined keyword search with remote auditing to realize rapid positioning and dynamic verification of cloud files. Tu et al. [36] optimized traditional multi-replica auditing algorithms to improve the efficiency and stability of redundant data verification in multi-cloud environments. Kumar and Bandanadam [37] introduced an improved ElGamal encryption algorithm to strengthen the encryption protection capability of blockchain auditing systems and enhance the attack resistance in decentralized storage scenarios. In recent years, research has been further advanced to promote the engineering implementation of auditing systems and adapt to complex application environments. Wang et al. [38] proposed the SStore provable data auditing platform, which significantly optimizes the overall system operational efficiency while guaranteeing security, and advances the development of auditing mechanisms toward platformization and practical application. Liu et al. [39] introduced a file access prediction mechanism in the shared data auditing scenario, combining data behavior analysis with integrity verification to improve audit response efficiency. With the continuous evolution of blockchain auditing technology, research priorities have gradually expanded to privacy protection, deduplication mechanisms and functional expansion. Zhang et al. [40] integrated blockchain with privacy-preserving deduplication technology, which reduces redundant storage overhead while realizing data integrity verification. Targeting the multi-replica dynamic data environment, Zhou et al. [41] designed a certificate-based multi-replica auditing scheme supporting data updates, which enhances system reliability and improves dynamic adaptability. Miao et al. [42] further expanded the auditing functions and proposed a blockchain-assisted provable data possession scheme supporting multi-keyword search, realizing the integration of data retrieval and integrity verification. Vijayakumar et al. [43] introduced a fair payment mechanism into the blockchain auditing system, combining data deduplication with economic incentives to improve the sustainable operation capability of the system. For special application scenarios, Xu et al. [44] proposed an auditing mechanism balancing privacy protection and transparent deduplication for UAV cloud storage environments, providing new ideas for data security in resource-constrained scenarios. Some existing certificateless blockchain auditing schemes attempt to reduce or replace the centralized third-party auditor (TPA), and achieve satisfactory performance in operational efficiency, privacy protection and scalability. However, they generally ignore the anti-forgery design of data verification tags. The tag generation process lacks dynamic random factors, enabling malicious cloud servers to precompute offline and forge legitimate tags. Focusing on this core security defect, this paper optimizes the tag generation algorithm on the basis of existing mainstream certificateless blockchain auditing schemes, and proposes an improved auditing scheme with lightweight features and high security.

Let G be an additive cyclic group and GT be a multiplicative cyclic group, both of prime order q, where the Discrete Logarithm Problem (DLP) in G is intractable. A bilinear pairing is a function e:G×G→GT satisfying:

Bilinearity: For any P,Q∈G and a,b∈Zq∗, e(aP,bQ)=e(P,Q)ab.

Throughout this paper, z∈Zq∗ denotes the master secret key held by the Key Generation Center (KGC), and the corresponding system public key is defined as (1)Ppub=zP,where P is the generator of the additive cyclic group G. This definition is used consistently in the tag generation, proof generation, and proof verification algorithms.

The role definitions of each entity are shown in Fig. 1: The core entities of the scheme and their core functional responsibilities are clearly defined as follows, with a clear distinction between the functional boundaries of the Third-Party Auditor (TPA) and blockchain smart contracts: KGC

Key Generation Center: A semi-trusted entity responsible for generating system-level public parameters and partial private keys for Data Owners (DOs) and strictly abides by the certificateless cryptography design principle—no full control over the user’s complete private key—to avoid the key escrow vulnerability of Identity-based Cryptography (IBC).

The design goals of the proposed scheme are as follows:

Audit Correctness: If the valid proof generated by the CS passes TPA verification, the stored data must be intact (i.e., consistent with the data uploaded by the DO).

The scheme proposed by Miao et al. is based on certificateless cryptography and blockchain smart contracts, aiming to achieve decentralized, transparent, and TPA-free data integrity auditing. Its core idea is: using smart contracts to replace traditional TPAs for challenge generation; utilizing certificateless signatures to avoid PKI certificate management and IBC key escrow issues; and recording all audit logs on the chain to ensure traceability and immutability. The system auditing process includes:Setup→PartialKeyGen→KeyGen→TagGen→Challenge (on-chain)→ProofGen→ProofVerify.

The most critical phase of this scheme is tag generation. For a file M={m1,m2,…,mn}, the DO randomly selects r∈Zq∗ and computes T=rP. For each data block mi, computes the tag:(2)σi=miDu+xuH2(IDu‖idi‖pki‖T)+rH3(fname‖idi‖Qu)where Du is the KGC-generated partial private key, xu is the DO’s local private key, Qu=H1(IDu), pku=xuP and T=rP is the random parameter. The DO uploads {mi,σi}i=1n and T to the CS.

Challenge generation is performed by smart contracts based on the secret value sv submitted by the DO, timestamp t, filename, etc., to generate pseudorandom seeds kf1 and kf2, which further determine the challenge block indices and weights.

Proof generation involves the CS aggregating the tags and data of the challenged blocks to generate (δ,μ,W,T). Here, Ppub=zP denotes the system public key generated by the KGC during the Setup phase, where z is the KGC’s master secret key and P is the generator of G. The verification equation is:(3)e(δ,P)=e(μQu−W,Ppub)⋅e(∑i∈IviH2(IDu‖idi‖pku‖T),pku)⋅e(∑i∈IviH3(fname‖idi‖Qu),T).

Adversaries (such as malicious CSs or external adversaries) know public parameters, filenames fname, block idi, and user public keys Qu. Since the input of H3(fname∥idi∥Qu) is completely static, adversaries can precompute this hash value offline, denoted as: hi=H3(fname∥idi∥Qu).

It should be emphasized that a malicious CS cannot legitimately compute a fresh tag in the same way as the DO executes the TagGen algorithm, because the CS does not possess the DO’s complete private key, especially the local secret key xu and the partial private key Du. Therefore, the term “forged tag” in this section does not refer to a normally generated cryptographic signature. Instead, it refers to an algebraically constructed or synthesized tag/proof component whose purpose is to satisfy the public verification equation by exploiting the linear structure of the original scheme.

The attack steps are as follows: The user uploads real data mi and tags σi; the malicious CS tampers with the data to mi′≠mi; the CS attempts to construct a new tag/proof component σi′ to pass verification. Since hi is known, the CS can select any r′∈Zq∗, set T′=r′P, and attempt to synthesize a forged tag/proof component with the following algebraic target form rather than compute a legitimate signature through TagGen:(4)σi′=algmi′Du+xuH2(IDu∥idi∥pki∥T′)+r′hi.

The notation =alg indicates an algebraic relation required for satisfying the verification equation. It does not imply that the malicious CS can directly evaluate the secret-key-dependent terms mi′Du and xuH2(⋅). In other words, σi′ is not a valid tag generated by the DO, but an algebraically synthesized object used in the forgery analysis.

In subsequent audits, the CS submits the corresponding forged proof components together with T′. The H3 term in the verification equation still uses hi, and T′ matches r′, so the equation may hold even if the data has been tampered with. In subsequent audits, the CS submits (σi′,T′). The H3 term in the verification equation still uses hi, and T′ matches r′, so the equation may hold even if the data has been tampered with.

Both the tag generation formula (Eq. (5)) and the verification formula of the original scheme exhibit an obvious linear structural characteristic. Taking advantage of this linearity, a malicious CS can forge a valid tag by precomputing static hash values and constructing new random parameters without acquiring the data owner’s local private key xu, the complete private key Sku=(xu,Du), or the original data block mi. The core algebraic derivation and attack steps are as follows:

Attack Premise and Linear Structure Analysis:

The tag generation formula of the original scheme is given by:(5)σi=miDu+xuH2(IDu||idi||pki||T)+rH3(fname||idi||Qu)

The core verification equation of the original scheme is:e(δ,P)=e(μQu−W,Ppub)⋅e(∑i∈IviH2(IDu||idi||pku||T),pku)⋅e(∑i∈IviH3(fname||idi||Qu),T)where δ=∑i∈Iviσi, pku=xuP, Ppub=zP (z is the master key of the Key Generation Center (KGC)), and Du=zQu.

From an algebraic perspective, the tag σi is a linear combination of several group elements, and the bilinearity of the pairing in the verification equation preserves this linear relationship. The attack analysis does not claim that the malicious CS can execute the legitimate TagGen algorithm. Instead, it shows that, because the H3 term is static and publicly reproducible, the adversary may attempt to algebraically synthesize proof components that satisfy the same pairing equation. In this sense, the vulnerability lies in the public verifiability of a linear equation whose static hash component is not bound to the dynamic randomness T.

In addition, the original verification process does not explicitly check the uniqueness of the random parameter T=rP or its binding with the initially uploaded tag set. This enables a malicious CS to introduce a new random parameter T′ in the forged proof and to align the corresponding H3-related term in the verification equation.

Specific Attack Steps and Algebraic Derivation:

Precompute the static hash value: Using the known public parameters fname, idi, and Qu, the malicious CS precomputes hi=H3(fname||idi||Qu). This value is fixed and can be calculated offline in advance and stored for long-term use.

In summary, Eq. (6) is completely equivalent to Eq. (7), which means the forged tag σi′ can satisfy the verification equation of the original scheme. The malicious CS successfully conceals data tampering through tag forgery.

The user uploads a file M={m1,m2,…,mn}, where mk is a sensitive data block (such as financial records, medical information). The malicious CS intends to replace it with mk′ (such as tampering with the amount or forging diagnostic results). If the original scheme’s tag σk is used, directly replacing mk with mk′ will cause verification failure because σk is bound to the original mk. However, with the tag forgery capability described in Section 5.1, the CS can delete the original σk and attempt to synthesize an algebraically forged tag/proof component σk′ bound to mk′ according to the target relation in Eq. (4), rather than legitimately computing a new tag. It then submits σk′ and T′=r′P during the audit.

If the challenge generated by the smart contract includes block k, the CS responds with the forged proof components. During verification, μ=ω+vkmk′, δ=vkσk′, and the pairing verification term e(δ,P) is forced to match the right-hand side e(μQu−W,Ppub)⋯e(vkhk,T′) under the algebraic structure of the original scheme. This process should be interpreted as algebraic synthesis for satisfying the verification equation, not as the normal computation of a valid signature by the malicious CS. Thus, the adversary can modify critical data without being detected.

The attacker independently generates a forged data block mfake (such as a malicious script, fake transaction record, etc.) and forges a reasonable block identifier idfake; computes the hash value hfake=H3(fname∥idfake∥Qu) for the forged block using public parameters. Since the input of H3 has no dynamic factors, the precomputed result is valid; randomly selects r′∈Zq∗ and computes T′=r′P; then attempts to synthesize a forged tag/proof component whose algebraic target form is σfake≜mfakeDu+xuH2(IDu∥idfake∥pku∥T′)+r′hfake.

Again, σfake is not computed as a legitimate signature by the malicious CS, because the CS does not possess xu or Du. It only denotes the algebraic relation that the forged proof component attempts to emulate in order to satisfy the public verification equation.

When the challenge seed kf1 of the smart contract selects idfake through the pseudorandom permutation πkey, the attacker computes δ=vfakeσfake, μ=ω+vfakeσfake according to the proof generation process; submits the proof (δ,μ,W,T′). Since hfake is precomputed valid and T′ matches r′, the verification equation holds, and the system identifies the forged block as legitimate data. The format of the block identifier idfake is consistent with the original scheme, passing the CS’s metadata format verification; the static nature of the H3 input ensures the validity of hfake, and tag forgery conforms to the mathematical structure of the original scheme; the pseudorandomness of challenge generation makes the probability of the forged block being selected the same as that of legitimate blocks, enabling the attacker to achieve the attack without manipulating the challenge process.

The attacker identifies and deletes the sensitive data block mk and its original tag σk, but does not modify the file metadata (such as the number of blocks, index range) to avoid triggering the CS’s integrity verification; constructs a harmless data block mk′ consistent with the format of the original data block (such as filling with random invalid characters, repeating the content of other legitimate blocks) to ensure the integrity of the file structure; precomputes hk=H3(fname∥idk∥Qu) corresponding to the original index idk of the sensitive block; selects r′∈Zq∗ and computes T′=r′P; then attempts to synthesize an algebraically forged tag/proof component σk′=mk′Du+xuH2(IDu∥idk∥pku∥T′)+r′hk.

This expression describes the algebraic target relation of the forged proof rather than a legitimate tag computation. The malicious CS cannot independently evaluate the secret-key-dependent terms, but it may exploit the static H3 input and the linear pairing equation to make the submitted proof appear valid. The attacker writes mk′ and the corresponding forged proof component to the original storage location of mk, completing replacement-style deletion.

When the audit challenge includes idk, the attacker submits the proof generated by mk′ and σk′, the verification equation holds, and the audit result shows “data intact”, successfully concealing the sensitive data. After the attack, the metadata (number of blocks, size, index) of the file remains unchanged, making it impossible for ordinary users or administrators to detect data replacement through conventional means; the auditing mechanism fails due to tag forgery, unable to identify the deletion behavior.

Executed by the Key Generation Center (KGC) to generate system public parameters and the master key:

Select two cyclic groups G (additive group) and GT (multiplicative group) of prime order q, and a bilinear pairing e:G×G→GT.

Executed by the KGC to generate a partial private key for the Data Owner (DO):

Input the DO’s identity identifier IDu.

Executed by the DO to generate a complete public-private key pair:

The DO randomly selects a local key xu∈Zq∗.

Where xu is the local key and Du is the partial private key generated by the KGC.

Executed by the DO to generate enhanced unforgeable tags for each data block:

Split the data file M into n equal-length blocks m1,m2,…,mn, and assign a unique file identifier IDM and block identifiers id1,id2,…,idn.

Executed by smart contracts deployed on the blockchain to generate decentralized and tamper-proof challenge information. The process is divided into three phases:

Commit Phase: The DO selects a secret value sv∈Zq∗, computes its hash h(sv), and submits an audit task to the smart contract. The task includes metadata (such as IDu,fname,PKu) and h(sv) (ensuring sv cannot be tampered with later).

Executed by the CS to respond to the TPA’s challenge and generate an integrity proof:

Using the challenge seeds kf1 and kf2, the CS selects c challenge blocks and their weights: for ξ=1,2,…,c, iξ=πkey(kf1,ξ),viξ=fkey(kf2,ξ).

Executed by the TPA to verify the proof submitted by the CS and confirm data integrity:

Obtain the proof proof=(δ,μ,W¯,T) and challenge seeds kf1,kf2 from the blockchain.

Theorem 1: If there exists a PPT Type I attacker 𝒜I who cannot access the master key of the Key Generation Center (KGC) but can replace the Data Owner’s (DO’s) public key, and can forge a valid tag with non-negligible advantage ε, then a simulator 𝒮 can be constructed to solve the Computational Diffie-Hellman (CDH) problem with non-negligible advantage ε′≥ε/((qk1+qT)⋅2e), where qk1 and qT are the number of partial key queries and tag queries, respectively.

Proof:

Parameter Initialization: The simulator 𝒮 uses the CDH instance (P,aP,bP) with the goal of computing abP. 𝒮 constructs system public parameters, sets Ppub=aP, randomly selects a target identity IDu∗ and assigns a mark τ=1. Select an additive cyclic group G and a multiplicative cyclic group GT of prime order q, a bilinear pairing e:G×G→GT, define hash functions and pseudorandom functions/permutations that meet the requirements, set the system public key Ppub=aP (the master key z=a is unknown), and disclose all parameters. Meanwhile, 𝒮 randomly selects a target identity IDu∗, assigns a random mark τ∈{0,1} to all identities, where the mark of IDu∗ is τ∗=1, and the marks of other identities are τ=0.

□

Theorem 2: If there exists a PPT Type II attacker 𝒜II who can access the KGC’s master key but cannot modify the DO’s public key, and can forge a tag with non-negligible advantage ε, then there exists a simulator 𝒮 that can solve the CDH problem with advantage ε′≥ε/((qk2+qT)⋅2e), where qk2 is the number of secret key queries.

Proof:

Parameter Initialization: 𝒮 receives the CDH instance (P,aP,bP), constructs system public parameters, sets the master key z=a and the system public key Ppub=aP, randomly selects a target identity IDu∗ and assigns a mark τ∗=1, and the marks of other identities are τ=0. 𝒜II knows the master key and can obtain the partial private key of any identity.

□

Theorem 3: Under the Discrete Logarithm (DL) assumption, the probability that any PPT Type III attacker 𝒜III forges a valid audit proof is negligible.

Proof:

Attack Goal and Constraints: After tampering with data, 𝒜III attempts to generate a forged proof proof=(δ′,μ′,W′,T′) such that the verification equation e(δ′,P)=e(μ′Qu−W′,Ppub)⋅e(∑viH2(⋅),pku)⋅e(∑viH3(⋅),T′) holds. In a real proof, δ=∑viσi, μ=ω+∑vimi, and the core constraint for the verification equation to hold is that ∑vimi corresponds to real data and the blinding factor ω=w.

□

Theorem 4: The scheme preserves the DO’s data privacy during public auditing, and no external entity (including the Third-Party Auditor (TPA), CS, miners, etc.) can recover the original data from the audit records.

Proof:

Privacy Isolation of Audit Records: On-chain audit records include challenge seeds (kf1,kf2), proof components δ,μ,W,T, and audit results. Each component achieves privacy preservation through cryptographic mechanisms and does not directly expose the original data mi.

□

Theorem 5: The scheme can resist collusion attacks by any combination of entities (TPA and CS, CS and miners, KGC and CS, etc.), preventing data tampering or manipulation of audit results.

Proof:

Resistance against TPA-CS Collusion: Challenges are generated by blockchain smart contracts based on the DO’s secret value sv, timestamp t, and metadata. The TPA is only responsible for performing verification and cannot manipulate the challenge seeds (kf1,kf2), so it naturally cannot disclose future challenge block indices or weights to the CS. Meanwhile, tag generation in the improved scheme relies on the dynamic parameter T, and the input of H3 includes T, making the hash value impossible to precompute. Even if the CS colludes with the TPA, it cannot forge a tag that can pass verification, and the collusion attack fails.

□

A comparison of the original scheme and the improved scheme in four aspects is provided, and the security attribute analysis is shown in Table 1:

Communication overhead is a key performance indicator in the practical deployment of cloud storage integrity auditing schemes, which mainly depends on the data volume and number of interactions transmitted between entities (Data Owner DO, Cloud Server CS, Third-Party Auditor TPA, blockchain nodes) during the auditing process.

To further verify the superiority of the proposed enhanced scheme in terms of comprehensive performance and security, we select three representative blockchain-based data integrity auditing schemes in the current academic community for multi-dimensional comparison: Miao et al. (2024) (the original certificateless scheme optimized in this paper), Liu et al. (2025) (blockchain-based auditing scheme with enhanced tag mechanism based on bilinear pairing), and Wu et al. (2022) (lightweight on-chain-off-chain collaborative auditing protocol).