Secure Outsourced Medical Data against Unexpected Leakage with Flexible Access Control in a Cloud Storage System The application of cloud storage system has been deployed widely in recent years. A lot of electronic medical records (EMRs) are collected and uploaded to the cloud for scalable sharing among the authority users. It is necessary to guarantee the confidentiality of EMRs and the privacy of EMR owners. To achieve this target, we summarize a series of attack behaviors in the cloud storage system and present the security model against many types of unexpected privacy leakage. Privacy of unassailed EMRs is guaranteed in this model, and the influence of privacy leakage is controlled in a certain scope. We also propose a rolebased access control scheme to achieve flexible access control on these private EMRs. One can access medical records only if hisher role satisfies the defined access policy, which implies a finegrained access control. Theoretical and experimental analyses show the efficiency of our scheme in terms of computation and communication.

An Anonymous Attributebased Access Control System Supporting Access Structure Update It is quite common nowadays for clients to outsource their personal data to a cloud service provider. However, it causes some new challenges in the area of data confidentiality and access control. Attributebased encryption is a promising solution for providing confidentiality and finegrained access control in a cloudbased cryptographic system. Moreover, in some cases, to preserve the privacy of clients and data, applying hidden access structures is required. Also, a data owner should be able to update his defined access structure at any time when he is online or not. As in several realworld application scenarios like ehealth systems, the anonymity of recipients, and the possibility of updating access structures are two necessary requirements. In this paper, for the first time, we propose an attributebased access control scheme with hidden access structures enabling the cloud to update access structures on expiry dates defined by a data owner.