Revocable Ciphertext-Policy Attribute-Based Encryption (CP-ABE) Framework for Hybrid Storage: The Kampala International University Case Study

Modern educational institutions generate vast amounts of confidential academic, administrative, and research data. Ensuring fine-grained access control and rapid privilege revocation across distributed on-premises and cloud infrastructures remains a critical cybersecurity challenge. This paper presents a formal, provably secure, and revocable Ciphertext-Policy Attribute-Based Encryption (CP-ABE) data-sharing framework tailored for hybrid storage environments at Kampala International University (KIU). The scheme employs a hybrid cryptographic model where bulk payloads are symmetrically encrypted using AES- GCM-256, and symmetric payload keys are protected via CP-ABE under linear secret sharing scheme (LSSS) access structures. Efficient revocation is achieved through versioned attribute keys and local storage proxy re-encryption without requiring full bulk-file re-encryption. We prove the scheme IND-CPA secure under the Decisional Bilinear Diffie-Hellman (DBDH) assumption in the standard model. A reproducible prototype implemented with the Charm- Crypto library demonstrates that attribute revocation requires < 15 ms overhead, preserving linear scalability for datasets up to 1 GB.