Recently, Zhang et al. proposed a novel public data integrity verification scheme for the cloud storage using indistinguishability obfuscation ( iOiO ), and extend it to support batch verification and data dynamic operations (IEEE Transactions on Information Forensics and Security, vol. 12, no. 3, pp. 676–688, Mar. 2017). However, we find that the scheme has two flaws: (a) the self-checking of the uploaded blocks and tags in Store phase is not reliable, i.e., it is easy to generate invalid block-tag pairs without being detected; (b) the extended scheme for data dynamic operations suffers from a chosen message attack, i.e., if some uploaded blocks match a certain pattern, the cloud storage is able to replace any existing block by a forged one without being detected, which violates the scheme’s security model. Then, we provide solutions to these problems while preserving all the desirable features of the original scheme.

中文翻译：

---

《从不可区分性混淆中对云存储系统数据完整性进行高效公开验证》的评论


最近，张等人。提出了一种利用不可区分性混淆（ iOiO ）的新型云存储公共数据完整性验证方案，并将其扩展为支持批量验证和数据动态操作（IEEE Transactions on Information Forensics and Security，第 12 卷，第 3 期，第 676 页） –688，2017 年 3 月）。然而，我们发现该方案有两个缺陷：（a）Store阶段上传的块和标签的自检不可靠，即很容易生成无效的块-标签对而不被检测到； (b)数据动态操作的扩展方案遭受选择消息攻击，即，如果某些上传的块匹配某种模式，则云存储能够在不被检测到的情况下用伪造的块替换任何现有块，这违反了该方案的安全模型。然后，我们提供这些问题的解决方案，同时保留原始方案的所有所需功能。