Maybe [Private files download permission][1] handle what you want.

Some quote form this module page : 

> Version 1.x provided "two useful features which Drupal itself is
> missing: a simple permission to allow downloading of private files by
> role, plus the ability to combine both public and private downloads".
> 
> Version 2.x removes the "global" permission and implements a
> per-directory by-user and by-role filter instead, to let the
> administrator better tweak the whole website and increment the overall
> security.


Also you can use [Field Permissions][2] module

some quote form this module page : 

> The Field Permissions module allows site administrators to set
> field-level permissions to edit, view and create fields on any entity.  

> Features
> 
>     Enable field permissions on any entity, not just nodes.
>     Role-based field permissions allowing different viewing patterned based on what access the user has.
>     Author-level permissions allow viewing and editing of fields based on who the entity owner is.
>     Permissions for each field are not enabled by default. Instead, administrators can enable these permissions explicitly for the fields
> where this feature is needed.


  [1]: https://www.drupal.org/project/private_files_download_permission
  [2]: https://www.drupal.org/project/field_permissions