Security vulnerabilities and enhancement of a dynamic auditing scheme for regenerating code-based storage in cloud-fog-assisted IIoT

• Uncover two viable security attacks, namely block forgery and identifier impersonation, to a cloud data auditing scheme recently published in the journal internet of things. • Derive that the public-key signature method that relies on the sum of segment blocks is not a judicious option for remote data auditing. • Present an enhanced scheme that expected to counteract the proposed attacks by solely improving the signature generation method, and emphasize the auditing challenges specific to cloud-fog-assisted IIoT. In a recent publication, Liu et al. put forth a privacy-preserving dynamic auditing scheme for distributed encoded storage systems in cloud-fog-assisted Industrial Internet of Things (IIoT) [Internet of Things, DOI: 10.1016/j.iot.2024.101084]. Each encoded data segment utilizes the ZSS signature for the creation of its corresponding authentication tag. The fog server will be challenged and subjected to rigorous verification through the utilisation of a bilinear pairing map. In this paper, we demonstrate that the security vulnerabilities of Liu et al.’s scheme by mounting a block forgery attack and an identifier forgery attack, respectively. In particular, an adversarial fog server is capable of successfully deceiving the proxy auditor through the implementation of arbitrary unauthorised data tampering or identifier impersonation. We also provide an alternative scheme to address the security weaknesses, and highlight the challenges of cloud data auditing tailored for cloud fog-enabled IIoT.