Security analysis and improvement of a public auditing scheme for secure data storage in fog-to-cloud computing

Human society has drastically changed as a result of the widespread application of Internet of Things (IoT) technology, particularly in various industrial fields. In spite of the advantages brought by IoT services, the underlying security challenges cannot be underestimated. Cloud-based IoT data collection poses a number of challenges, including how to ensure its integrity. In order to address this issue, Tian et al. have proposed a fog-to-cloud computing-based public auditing scheme in IoT scenarios, which provides the data-privacy preserving mechanism and tag transformation strategy. However, in this paper, we show that Tian et al.’s scheme fails to achieve soundness, an essential security property, by giving two attacks. In the first attack, the malicious cloud server can delete all the data and then deceive the Third Party Auditor (TPA) into believing that the data is well-preserved. In the second attack, the malicious cloud server can modify the outsourced data and then deceive TPA into believing that all the data is kept intact. We further provide a simple but effective solution for Tian et al.’s scheme to resist the above-mentioned attacks. Security analysis and performance evaluation are also given to demonstrate the robustness and high efficiency of the improved scheme.