Cryptanalysis of an identity-based public auditing protocol for cloud storage

Public verification of data integrity is crucial for promoting the serviceability of cloud storage systems. Recently, Tan and Jia （2014） proposed an identity-based public verification （NaEPASC） protocol for cloud data to simplify key management and alleviate the burden of check tasks. They claimed that NaEPASC enables a third- party auditor （TPA） to verify the integrity of outsourced data with high efficiency and security in a cloud computing environment. However, in this paper, we pinpoint that NaEPASC is vulnerable to the signature forgery attack in the setup phase; i.e., a malicious cloud server can forge a valid signature for an arbitrary data block by using two correct signatures. Moreover, we demonstrate that NaEPASC is subject to data privacy threats in the challenge phase; i.e., an external attacker acting as a TPA can reveal the content of outsourced data. The analysis shows that NaEPASC is not secure in the data verification process. Therefore, our work is helpful for cryptographers and engineers to design and implement more secure and efficient identitv-based nublic alldit^n~ .~cheme~ far clnne] ~tnr^q~

Public Auditing for Encrypted Data with Client-Side Deduplication in Cloud Storage

Storage auditing and client-side deduplication techniques have been proposed to assure data integrity and improve storage efficiency, respectively. Recently, a few schemes start to consider these two different aspects together. However, these schemes either only support plaintext data file or have been proved insecure. In this paper, we propose a public auditing scheme for cloud storage systems, in which deduplication of encrypted data and data integrity checking can be achieved within the same framework. The cloud server can correctly check the ownership for new owners and the auditor can correctly check the integrity of deduplicated data. Our scheme supports deduplication of encrypted data by using the method of proxy re-encryption and also achieves deduplication of data tags by aggregating the tags from different owners. The analysis and experiment results show that our scheme is provably secure and efficient.

Public auditing for real‑time medical sensor data in cloud‑assisted HealthIIoT system

With the advancement of industrial internet of things(IIoT),wireless medical sensor networks(WMSNs)have been widely introduced in modern healthcare systems to collect real-time medical data from patients,which is known as HealthIIoT.Considering the limited computing and storage capabilities of lightweight HealthIIoT devices,it is necessary to upload these data to remote cloud servers for storage and maintenance.However,there are still some serious security issues within outsourcing medical sensor data to the cloud.One of the most signifcant challenges is how to ensure the integrity of these data,which is a prerequisite for providing precise medical diagnosis and treatment.To meet this challenge,we propose a novel and efcient public auditing scheme,which is suitable for cloud-assisted HealthIIoT system.Specifcally,to address the contradiction between the high real-time requirement of medical sensor data and the limited computing power of HealthIIoT devices,a new online/ofine tag generation algorithm is designed to improve preprocessing efciency;to protect medical data privacy,a secure hash function is employed to blind the data proof.We formally prove the security of the presented scheme,and evaluate the performance through detailed experimental comparisons with the state-of-the-art ones.The results show that the presented scheme can greatly improve the efciency of tag generation,while achieving better auditing performance than previous schemes.

Sec-Auditor:A Blockchain-Based Data Auditing Solution for Ensuring Integrity and Semantic Correctness

Currently,there is a growing trend among users to store their data in the cloud.However,the cloud is vulnerable to persistent data corruption risks arising from equipment failures and hacker attacks.Additionally,when users perform file operations,the semantic integrity of the data can be compromised.Ensuring both data integrity and semantic correctness has become a critical issue that requires attention.We introduce a pioneering solution called Sec-Auditor,the first of its kind with the ability to verify data integrity and semantic correctness simultaneously,while maintaining a constant communication cost independent of the audited data volume.Sec-Auditor also supports public auditing,enabling anyone with access to public information to conduct data audits.This feature makes Sec-Auditor highly adaptable to open data environments,such as the cloud.In Sec-Auditor,users are assigned specific rules that are utilized to verify the accuracy of data semantic.Furthermore,users are given the flexibility to update their own rules as needed.We conduct in-depth analyses of the correctness and security of Sec-Auditor.We also compare several important security attributes with existing schemes,demonstrating the superior properties of Sec-Auditor.Evaluation results demonstrate that even for time-consuming file upload operations,our solution is more efficient than the comparison one.

Analysis on Present Status and Development Tendency of Performance Audit in China

Performance audit has become a mainstream-trend in the development of modern government audit currently.However,the launch of performance audit in China is unbalanced,which the performance audit with Chinese characteristics develops quite fast,while the full sense of performance audit develops quite slowly.Except factors such as different recognition of performance audit,the main reason of this development imbalance is that development of performance audit is limited by the current audit system.Nevertheless,it is not hard to find some positive aspects existing in the development of performance audit in China,concluding developments and changes of the environment of performance audit in China over the recent years.

Extending Auditing Models to Correspond with Clients’ Needs in Cloud Environments

The user control over the life cycle of data is of an extreme importance in clouds in order to determine whether the service provider adheres to the client’s pre-specified needs in the contract between them or not, significant clients concerns raise on some aspects like social, location and the laws to which the data are subject to. The problem is even magnified more with the lack of transparency by Cloud Service Providers (CSPs). Auditing and compliance enforcement introduce different set of challenges in cloud computing that are not yet resolved. In this paper, a conducted questionnaire showed that the data owners have real concerns about not just the secrecy and integrity of their data in cloud environment, but also for spatial, temporal, and legal issues related to their data especially for sensitive or personal data. The questionnaire results show the importance for the data owners to address mainly three major issues: Their ability to continue the work, the secrecy and integrity of their data, and the spatial, legal, temporal constraints related to their data. Although a good volume of work was dedicated for auditing in the literature, only little work was dedicated to the fulfillment of the contractual obligations of the CSPs. The paper contributes to knowledge by proposing an extension to the auditing models to include the fulfillment of contractual obligations aspects beside the important aspects of secrecy and integrity of client’s data.

公立医院科研经费管理与内部审计探讨

公立医院科研经费管理存在诸多问题,包括科研制度不完善、项目执行进度慢、缺乏约束性和规范性、结题不结账等。这些问题不仅影响了科研工作的进展和质量,还可能引发财务风险。为了解决这些问题,需要建立科研项目资金管理体系,从申报、立项、中验、结题到结账全生命周期进行有效管理。内部审计作为公立医院的“免疫系统”,对医院科研经费进行有效监督管理,保障医院科研管理经费使用效能。通过完善科研制度、规范项目执行进度、加强经费管理、内部控制和风险管理等措施,推动公立医院科研工作的高质量发展。此外,也是重要的手段,通过建立以风险控制为导向的科研项目全过程管理体系,可以有效降低医院经济经营活动中发生风险的几率。

基于区块链技术的公共资源配置审计流程设计

公共资源配置规范化透明化成为一项关乎中国特色社会主义市场经济阳光化发展的重大课题,使得公共资源配置审计也逐渐成为重点审计工作之一。然而,我国当前的公共资源配置审计流程存在诸多困境,如公共资源配置审计流程效率低、审计证据质量低、审计监督局部化等。这些问题亟需改善。深入研究当前公共资源配置审计流程缺陷的改善路径,发现区块链技术的智能合约机制、密码学基础、梅克尔树结构等,能够解决公共资源配置审计流程存在的诸多问题。因此,研究设计基于区块链技术的公共资源配置审计流程,探索公共资源配置审计智能化的实现方法,将为我国推进公共资源配置审计智能化转变提供核心理论支撑。

内审视角下公立医院财务优化路径分析

对于公立医院而言,财务审计作为一种内部控制管理手段,能够有效保障医院财产安全,为构建良好医疗环境奠定基础。本文从内审与医院财务管理关联入手,探讨当前内审视角下公立医院财务现状与问题,提出公立医院转变财务管理理念、优化制度机制和管理方式等对策。内审视角下,医院财务管理应着重转变成本核算理念、更新风险防范理念、完善绩效考核制度和开展精细化管理等,进一步提高医院财务管理质量,为医院高质量发展保驾护航。

公共政策审计促进公平竞争的研究——基于企业竞争程度的视角

本文以2016—2020年沪深A股上市公司为样本,从企业竞争程度的视角,研究公共政策审计对公平竞争的影响。结果表明,公共政策审计提高了发现问题地区企业的竞争程度。机制检验结果表明,公共政策审计有助于降低政府不当干预,营造竞争公平的市场环境从而提高企业竞争程度。进一步研究发现,公共政策审计对企业竞争程度的促进作用在竞争能力较弱企业中更显著;公共政策审计对区域限制类问题的揭示能够提高该地区企业的竞争程度;审计介入次数越多、问题描述越详细、问题影响范围越大,越有利于提高发现问题地区企业的竞争程度。

关键审计事项风险信息披露与分析师预测

文章以2017—2021年上市公司审计报告为研究对象,通过统计关键审计事项的风险词频探讨风险信息披露对分析师预测的影响。研究发现:关键审计事项风险信息披露降低了分析师的预测偏误和预测分歧度;进一步研究表明,促进公共信息和私有信息的获取以及较高的文本可读性是提高分析师预测质量的主要路径,且有助于修正分析师乐观预测偏差;在内部控制质量、审计质量、机构投资者持股比例、舆论关注度较高的子样本中,关键审计事项风险信息披露对分析师预测质量的改善作用更加明显。研究结论可为完善关键审计事项风险信息披露和传递机制提供实践经验和理论依据。

基于内部控制视角的公立医院内部审计管理

公立医院的内部控制和内部审计管理具有高度一致性,可以形成互补合力。基于内部控制管理要求,公立医院应进一步重视内部审计部门的独立性、调整医院职权架构、拓宽内部审计对象范围、完善内部审计整改制度、开展内部审计质量评估,推动审计职能转型,保障医院安全运行和高质量发展。

公立医院高值医用耗材专项审计探讨

为加强公立医院高值医用耗材规范化管理,在全面了解公立医院高值医用耗材管理情况的基础上开展专项审计是有效途径。本文结合管理现状,探讨如何通过专项审计客观评价公立医院高值医用耗材采购、储存、使用、追溯、监测、评价、监督等全过程的组织实施与管理情况,揭示和反映公立医院高值医用耗材管理的风险点和薄弱环节,并提出管理建议。

公众诉求如何影响审计整改质量?

选取2012—2020年省级面板数据,研究公众诉求对审计整改质量的影响。结果显示:公众诉求可以有效提升审计整改质量,表明“自下而上”的诱致性制度变迁可以促进审计整改质量的提升;改善政府及主管部门部署和督促整改的态度、增强被审计单位落实整改的决心是公众诉求提升审计整改质量的重要机制;在不同的人大需求和区域位置下,公众诉求对审计整改质量的提升效应存在显著差异。鉴于此,社会公众应合理合法地表达对审计整改情况的意见,人大代表需积极关注和倾听社会公众关于审计整改的诉求,审计机关要积极引导社会舆论推动审计整改。

公立医院智能化内部审计探析

当前,公立医院内部审计工作存在机械性劳动过多、成效难以量化、独立性不够、数据孤岛普遍以及信息化应用不足等问题。智能化审计具有扩大审计范围、降低错误率和风险、实现实时监控等优势。公立医院应基于大数据平台,着力推进审计智能化,不断提升审计效率。

公立医院内部审计与纪检联动实施路径研究

高效健全的内部监督体系是公立医院高质量发展的免疫保障,作为公立医院内部权力制约和监督体系的重要组成部分,内部审计和纪检监察虽然分工不同,但在工作目标、对象及内容等方面均存在交叉与融合。本文以内部审计和纪检监察联动的背景为切入点,通过案例的方式提出医院内部审计与纪检监察联动的具体路径,旨在探索公立医院内部监督力量协同运作之道。

注册会计师审计、内部控制与股价信息含量

从内外部治理机制探索影响股价信息含量的关键因素有助于改善股市信息效率。文章通过理论分析和实证检验,分别考察了注册会计师审计质量和内部控制质量对股价信息含量的影响以及两者在其中的相互作用。研究结果表明:高质量的注册会计师审计和内部控制均能显著提高股价信息含量,且两者在提高股价信息含量中存在显著的替代关系。采用替换关键变量、倾向得分匹配回归、Heckman两阶段模型和工具变量法等进行稳健性检验,上述结论不变。基于此,企业应当合理利用内外部监督资源不断改善股市信息效率,注册会计师要充分关注企业内部控制质量,降低信息不对称程度,维护资本市场秩序。

公立医院工程管理研究型审计的实践与探讨

为进一步推进公立医院的高质量发展,充分发挥公立医院内部审计在工程管理内部控制方面的监督职能,保障医院资金安全、高效、规范化已经成为医院管理中的重要手段。研究型审计立足审计工作,以深入调查研究为基础,坚持以问题为导向、注重科学的方法,在审前调查、审计实施、审计结论及报告、审计结果运用等方面强化研究。文章首先阐述了研究型审计的内涵,其次以大型BD公立医院为例,系统介绍研究型审计在公立医院工程管理内部控制审计中的应用,总结研究型审计在工程管理内部控制审计中的成效,为公立医院内部审计工作提质增效提供具体工作借鉴。

高校内部审计对科技创新的影响研究

内部审计为高校科技创新提供了支撑性的环境和机制,然而较少有实证研究考察内部审计对科技创新产出的影响。本文利用2009-2019年的高等院校数据样本检验内部审计对科技创新的影响,发现内部审计的独立性、业务覆盖面以及审计人员数量提升了高校科技创新。内部审计对科技创新的积极影响在科研人员多、科研经费多以及科研项目多的高校中更加突出,高校所在地研发投入强度强化了因果关系。对机制的考察发现,高校通过内部审计优化了科研管理机制,提升了激励与约束的效率,并为高校与外部机构进行科技管理体制上的对接提供了条件,推进了知识的共享与交流。本文的研究结论在考虑内生性问题及进行一系列的稳健性检验后依然是成立的。

注册会计师对审计质量的影响分析——以上市企业数据与调查问卷为例

以上市企业数据与调查问卷为例,通过实证分析注册会计师对审计质量的影响。自变量为事务所评价,未进入榜单的注册会计师事务所得分为0;因变量为审计质量,采用修正Jones模型构建上市企业操纵性应计利润规模。控制变量包括企业规模、营收、资产负债率和资产报酬率等指标。通过描述性统计和相关性分析,发现上市企业财务绩效与审计质量指标关联性显著,但事务所评分对其影响不显著。然后,采用LightGBM回归模型进行进一步分析,得出营收等指标对内部审计质量影响较大,而事务所评价对其影响最弱。最后,通过问卷调研验证了职业精神和专业能力对内部审计质量的影响,结果显示专业能力对内部审计质量具有显著正向影响,而职业精神的影响不显著。