## 3 TR-AC: Token-Revocation Access Control  
Our TR-AC scheme computes an authentic token for each user requesting access. Thus, only authentic users will be able to access the cloud-hosted renewable-energy data and energy optimization utility. The encryption algorithm defines the privileges that a user grants [25]. Moreover, the authorized permission is used with the calculated authenticity level to be consistent with the revocation threshold. The proposed TR-AC has four main algorithms. The main model framework shown in Figure 1 is composed of the following entities:  
* **Organizations' sensitive data and utilities:** This is the renewable-energy data and energy optimization utilities. It will be encrypted. Then, it will be hosted on the cloud storage. In addition, efficient access control will be used to manage access to energy optimization utilities. * **Users:** There is a huge number of users who may request access to the cloud-hosted renewable-energy data and energy optimization utility, through a variety of different devices. A User ID (\(UID\)) is given to each user who requests access to renewable-energy organization cloud data and energy optimization utilities. This \(UID\) is given by the renewable-energy organization and never changes for that user. * **Organization Policy. ** It is the decision-making policy for each organization's access control. It is identified by a unique ID (\(OID\)). * **Authentication servers. ** The user identified by \(UID\) enters his user name, password, and any additional information necessary for successful authentication in this stage. The authentication servers have a set of servers under their own management. Each of these servers has a specified task. * **Multi-authority system. ** It is a collection of various authority corresponding with one another. By determining the _users' authentication level_, they are in charge of assessing the user before granting him any access. The user is granted temporary access to the cloud renewable-energy data if the prganization in charge (\(OiC\)) and other system authorities trust their decision to grant or deny access. In this section, a secret key (\(SK_{UID}\)) is given to each user identified by a unique \(UID\). * **Cloud Storage. ** A set of servers with enormous capacities to manage the voluminous demands for data storage and access. The detailed flowchart for a user identified by \(UID\) requesting access to the cloud-hosted resources is illustrated in Figure 2. Firstly, the user requests access and provides his/her credentials. Then, the authentication servers with the help of the organization's  
Figure 1: The proposed TR-AC scheme integrated with the renewable-energy organization authentication system. policy will evaluate the provided credentials to decide whether the user is authenticated or not. If the user is not authenticated, s/he cannot go further in the model. If the user is authenticated, then the user's attributes will be provided to the multi-authority system to calculate the weighted authentication token. After that, the authentic token generation (Algorithm 1) runs to decide whether the user is revoked or not. If the user is revoked, s/he receives a random hexadecimal decryption token and cannot go further in the model. If the user was non-revoked, s/he will receive a valid decryption token. This decryption token will be used in the decryption (Algorithm 2). Finally, the non-revoked user will obtain the original data or requested service.