Fog computing is not a replacement but an extension of cloud computing for the prevalence of the Internet of Things (IoT) applications. In particular, fog computing inserts a middle layer named fog into the infrastructure of cloud computing to obtain the low latency, mobility and location-awareness. Due to the fog layer, the sensitive data stored in fog computing is facing more sophisticated attacks, such as chosen ciphertext attacks, than that in cloud computing. Currently, the attribute-based encryption (ABE) with outsourced decryption is the best solution for data protection in cloud computing for IoT applications. However, none of the existing schemes are CCA secure. To fill this gap, we firstly propose the CCA security model for ABE with outsourced decryption, and then present a concrete CCA-secure ABE scheme with outsourced decryption. The security analysis and experimental results show that our proposal is secure and practical for fog computing. The CCA security model for ABE with outsourced decryption is proposed.A concrete CCA-secure ABE scheme with outsourced decryption is proposed.The security analysis and experimental results show that our proposal is secure and practical for fog computing.