Intrusion-Resilient Undetachable Signature for Mobile-Agent-Based Collaborative Commerce Systems

Abstract

Mobile agents are valuable in collaborative commerce systems due to their mobility and autonomy, enabling them to traverse the Internet and purchase goods and services on behalf of their owners. However, in the face of potential attacks from malicious hosts, securely executing a contract on behalf of the original signer poses a significant challenge. In this paper, we propose an Intrusion-Resilient Undetachable Signature (IRUS) approach for mitigating security risks associated with signing key leakage on the signer's host, base device, and even potentially malicious remote hosts. Additionally, it addresses the risk of signing algorithm misuse on remote hosts. Our approach ensures that adversaries cannot forge past or future signatures as long as the base device remains secure, even if the current signing key is compromised. In cases where the base device is compromised, although future signatures may be forged, all past signatures remain secure. Furthermore, we integrate the encrypted signing function with the original signer's requirements to prevent the misuse of the signing algorithm and the exposure of the original signing key on malicious hosts. Security proofs have confirmed that our scheme can effectively defend against various types of attacks, and experimental evaluations have demonstrated the strong performance of the proposed approach with enhanced security, meanwhile reducing the execution times of the signing phase by at most 75% and the verification phase by 95% compared with three existing undetachable signature schemes.