With the rapid development of Internet of Things (IoT) services, data security and privacy protection have become key challenges in service delivery. Traditional access control schemes struggle with efficient permission management and incur high overhead during access revocation, affecting service quality. To address this, we propose a service-oriented puncturable ciphertext-policy attribute-based encryption framework that enables immediate privilege revocation without re-encrypting ciphertexts. Our design features a polynomial-embedded puncture mechanism supporting efficient batch revocation and an optimized Bloom filter that accelerates revocation checks. A blockchain layer records all access and revocation events via smart contracts, ensuring transparent, tamper-proof auditing. Experimental results demonstrate that our framework significantly reduces decryption latency and outperforms existing schemes, enabling fine-grained, low-overhead access control for secure, responsive IoT services in resource-constrained environments.