Design and Experimental Performance Evaluation of a Verifiable Dynamic Ciphertext-Policy Transformation Framework for Secure Cloud Data Sharing

Secure and dynamic cloud data sharing requires fine-grained access control while limiting the computational and communication overhead associated with changing access policies. Although Ciphertext-Policy Attribute-Based Encryption (CP-ABE) provides expressive policy-based authorization, conventional policy updates may require computationally expensive ciphertext transformations and offer limited assurance that an untrusted cloud has executed the authorized operation correctly. This paper proposes Verifiable Cloud-Assisted Dynamic Ciphertext-Policy Transformation (VCD-CPT), a block-based hybrid encryption framework that enables dynamic policy transformation without re-encrypting the bulk data payload. The framework separates the policy-dependent key encapsulation mechanism (KEM) from the data encapsulation mechanism (DEM), using CP-ABE to protect a compact master secret and AES-256-GCM to encrypt independently derived data blocks. During policy transformation, the same master secret is re-encapsulated under the updated policy, allowing only compact KEM metadata to be modified while preserving the encrypted payload unchanged. An owner-signed Policy Transformation Token (PTT) authorizes the transformation, while a cloud-signed Verifiable Transformation Proof (VTP) used as a signed transformation attestation, provides transformation accountability and public verification. A hash-linked version chain provides freshness and rollback protection, whereas the signed block manifest and authenticated encryption protect against modification, insertion, deletion, and substitution of encrypted blocks. The framework is evaluated with respect to transformation scalability, policy complexity, communication and storage overhead, verification cost, payload invariance, and malicious-cloud attack resistance. Experimental results show that transformation cost remains essentially independent of encrypted file size, while full re-encryption increases with payload size. Within the evaluated 1-500 MB range, VCD-CPT achieves a maximum speedup of 2.883× over full re-encryption at 500 MB and in the extended scalability evaluation, the speedup increases to 4.728× at 1 GB and 8.298× at 2 GB. The results demonstrate that transformation complexity is primarily governed by policy attributes rather than payload volume, while verification and metadata overhead remain low. Thus, VCD-CPT provides an efficient, owner-authorized, and publicly verifiable approach for dynamic cloud data sharing.