Enforcing access controls on cloud storage by cryptography is an important topic of cloud security. Based on access control policies, selective encryption builds key derivation graphs to distribute symmetric keys among users. Selective encryption can ensure the confidentiality and fine-grained access control of cloud storage data, while simplifying data encryption procedure and reducing the total number of keys. However, the existing selective encryption solutions have to fully or at least partially disclose the access control policies. This policy information unfortunately, is usually related to the authorization relation between users and files, leading to privacy leakage. This work significantly improves the existing policy-hiding schemes (of selective encryption) with much less privacy leakage and much faster key derivation, while supporting fine-grained access control on encrypted cloud storage.