An Updateable TokenBased Schema for Authentication and Access Management in Clouds Cloud computing is getting universally in production and hence, comprising more valuable information resources. Therefore, providing a secure infrastructure to exchange information is more vital and inevitable. Attackers are looking for a way to penetrate these systems and exploit various techniques, such as account hijack and denial of service attacks, to obtain the information or develop a disorder in the system. The creation of treat models helps to identify the vulnerabilities, prevent potential attacks, and consider appropriate mechanisms to mitigate them. One of these mechanisms is the access control list and the rolebased access control list is one of its variants that defines some user groups and allocates resources to specific groups. Tokenbased authentication is another mechanism which helps to maintain security. When a user requests to access a resource, initially it must be authenticated by a username and represents a token. In this effort, by using the concept of rolebased access control and JSON web token framework, a customized framework is proposed and implemented with a higher level of security in comparison to a standard JSON web token framework. Moreover, this proposal has the ability to update the status of access to resources in case of changing access policies by the policy engine.

An Anonymous Attributebased Access Control System Supporting Access Structure Update It is quite common nowadays for clients to outsource their personal data to a cloud service provider. However, it causes some new challenges in the area of data confidentiality and access control. Attributebased encryption is a promising solution for providing confidentiality and finegrained access control in a cloudbased cryptographic system. Moreover, in some cases, to preserve the privacy of clients and data, applying hidden access structures is required. Also, a data owner should be able to update his defined access structure at any time when he is online or not. As in several realworld application scenarios like ehealth systems, the anonymity of recipients, and the possibility of updating access structures are two necessary requirements. In this paper, for the first time, we propose an attributebased access control scheme with hidden access structures enabling the cloud to update access structures on expiry dates defined by a data owner.