Secure computation methods include methods that use homomorphic encryption (HE) and those that use secret sharing (SS). Secure computation based on HE can be realized using one server, and the computation process can be made public if the encryption key is kept secure. However, HE generally requires a substantial computation cost. In contrast, SS has the advantage of low computation cost, allowing for high-speed processing; however, all servers must be managed independently. And the process of k or more servers cannot be disclosed. In particular, secret input will be leaked when the same organization manages multiple servers to implement SS. Therefore, a complex model where each server is independently managed is required. Iwamura et al. proposed a secure computation that is information-theoretic secure in n≥k instead of n≥2k−1 by assuming a trusted third party (TTP). In this paper, by making more effective use of a TTP, we demonstrate that secure computation based on SS is possible with only one computing server. Moreover, we show that the entire computation process can be disclosed if the key is managed safely. We realize a method that solves the disadvantages of conventional approaches with a faster computation than those methods.

We propose an order-specified aggregate authority-transfer signature based on the gap Diffie-Hellman group. In various organizations, to reduce the number of approvals required by someone who has relevant authority, the authority for a task can be transferred to a subordinate or another person who executes the task. Currently, authority is commonly transferred via a document, such as an authority-transfer agreement. However, to speed up the process and maintain the integrity of the evidence, we believe that it is better to transfer such authority via a computer network. In this paper, we propose an authority-transfer signature scheme using an order-specified aggregate signature and a group signature, and we propose a new authority-transfer system. In the signature method, a group signature scheme is used to express authority. Moreover, it transfers the authority owned by the manager to another member of the group. The difference from the group manager of the group signature is that this manager not only manages the group but also delegates authority. With the order-specified aggregate signature, it is possible to handle multiple signatures efficiently while verifying the order. We show that a safe and efficient authority-transfer system can be constructed using this new digital signature.

An aggregate signature scheme is a primitive whereby each signer signs an individual document and combines them to compress data size. We propose an aggregate signature scheme which is an extension in two standpoints of structured signatures and ID-based signatures, i.e., we construct an identity-based structured aggregate signature scheme. The proposed scheme is expected to be used with consumer-generated media services. We prove the security of the proposed scheme with tight reduction under the computational Diffie-Hellman (CDH) assumption in the random oracle model. Tight reduction means that the cost of a reduction algorithm is independent of an adversary's capability, i.e., security is not downgraded by the adversary's capability. To the best of our knowledge, no structured signature scheme with tight reduction has been proposed to date because it contains complicated structures that make the reduction inefficient. Note that the security of our scheme captures the switching attack (CCS 2007, Boldyreva et al.) and the re-ordering attack (ISPEC 2007, Shao), which break several famous schemes.

Various handover technologies for heterogeneous wireless networks have been proposed. Most of these technologies are based on mobile IP technology, which reduces the processing time of handovers, network authentication, and service authentication. However, guaranteeing continuity with real-time services and/or video-on-demand services is difficult, particularly when the processing time is reduced by separating the node and network sides. Cooperative processing is therefore needed between the node and network sides or network and service authentication. Moreover, the handover mechanism must provide anonymity to the users of content distribution services. We propose an anonymous handover mechanism and efficient authentication scheme that divides the content key into two data sets and transmits these data sets to the mobile node by way of two paths. We analyze this handover mechanism in this paper.