Oblivious access control policies for cloud based data sharing systems