This paper deals with broadcast encryption schemes, in which a sender can send information securely to a group of receivers excluding some receivers over a broadcast channel. In this paper we propose modifications of the Complete Subtree (CS), the Subset Difference (SD) and the Layered Subset Difference (LSD) methods based on the Master Key Tree (MKT). Our modifications eliminate log N keys or labels from receivers' storage, in exchange for an increase in the computational overhead, where N is the total number of receivers. We also propose modifications of the SD and LSD methods by applying the Trapdoor One-way Permutation Tree (TOPT) which is originally proposed in order to modify the CS method. Our modifications based on TOPT also eliminate log N labels, and the computational cost is much smaller than MKT based methods.

Broadcast encryption technology enables a sender to send information securely to a group of receivers excluding specified receivers over a broadcast channel. In this paper, we propose a new key-tree structure based on Rabin cryptosystem, and an access control scheme using the structure. We show the security of the access control scheme and construct a new broadcast encryption scheme based on it. The proposed broadcast encryption scheme is a modification of the complete subtree method and it reduces the number of keys a receiver stores to one. There have been proposed some modifications of the complete subtree method which minimize the number of keys for a receiver to one, and the most efficient one among them with respect to the computational overhead at receivers is based on RSA cryptosystem. The computational overhead at receivers in our scheme is around log2e times smaller than the most efficient previously proposed one, where e is a public exponent of RSA, and the proposed scheme is the most efficient among tree based one-key schemes. This property is examined by experimental results. Our scheme achieves this reduction in the computational overhead in exchange for an increase in the size of nonsecret memory by [log n * few (e.g. eight)] bits, where n is the total number of receivers.

This paper presents two methods for securely realizing caller-authenticated and callee-specified calls over telecommunication networks with terminals that accept IC cards having KPS-based cryptographic functions. In the proposed protocols, users can verify that the partner is the proper owner of a certain ID or a certain pen name. Users' privacy is protected even if they do the caller-authenticated and callee-specified calls and do not pay their telephone charge in advance.