## 4 Proposed Method
### Motivation  
In ExCo, at each round \(r\), each sensor \(j\) constructs the MAC \(z_{j}^{r}\) of its sensed value \(d_{j}^{r}\) and sends \(z_{j}^{r}\) to a random subset \(R_{j}^{r}\) of sensors. Within the round \(r\), each sensor \(j\) has certain possibility of receiving MACs from the other sensors. If this happens, it temporarily keeps them in the local memory. At the  
Figure 2: The adversary also roams around the sensing region and compromises the sensors. In this plot, the adversary can compromise one sensor at each round, and three sensors are compromised by the adversary after the first three rounds of a collection interval. end of round \(r\), each sensor \(j\) constructs and stores the MAC, \(H^{r}_{j}=MAC(z^{r}_{j}||z^{r}_{q_{1}}||\cdots||z^{r}_{q_{\phi}})\), where \(||\) denotes the bit-string concatenation, if it receives MACs from the sensors \(q_{1},\ldots,q_{\phi}\). Afterwards, except for \(H^{r}_{j}\), all the MACs generated and received in the round \(r\) are deleted. From the sink point of view, to authenticate the \(d^{r}_{j}\), it involves the verification of MAC, \(H^{r}_{j}\), and the MACs in \(R^{r}_{j}\), where \(R^{r}_{j}\) is the set of sensors that send the authentication tags to \(s_{j}\). Note that the sensors in \(R^{r}_{j}\) are called the co-authenticators of \(s_{j}\) at round \(r\). For example, if \(R^{r}_{j}\) contains \(q_{1},\ldots,q_{\phi}\), then, in addition to the verification of \(H^{r}_{j}\), the MACs, \(H^{r}_{q_{1}},\ldots,H^{r}_{q_{\phi}}\) are required to be verified as well. First, although it is claimed in [4] that ExCo is stronger than CoMAC in terms of sensor compromises, their resilience against sensor compromises is actually the same in practice. Particularly, according to [4], it is claimed that the adversary needs to compromise all the sensors in \(\{s_{j}\}\cup R^{r}_{j}\cup S^{r}_{j}\cup T^{r}_{j}\), where \(S^{r}_{j}\) is the set of sensors that receive the authentication tags from \(s_{j}\) and \(T^{r}_{j}\) is the set of sensors that send the authentication tags to the sensors in \(S^{r}_{j}\), before the round \(r\), to successfully subvert the security ExCo provides. Nevertheless, if \(\bar{r}\) is the target round, the adversary is aware of \(\bar{r}\) at the round \(\bar{r}+1\), and the adversary only compromises the sensors in \(\{s_{j}\}\cup R^{r}_{j}\), then the adversary can still provide to the sink a counterfeit sensed data without being detected. It can proceed as follows. At first, we assume that, for each round \(r\), each compromised sensor keeps the data received in rounds \(r-1\) and \(r\) in its local memory. As soon as the compromised sensor \(s_{j}\) and compromised sensors in \(R^{\bar{r}}_{j}\) are aware of \(\bar{r}\), \(s_{j}\) instantly replaces the original sensor reading \(d^{\bar{r}}_{j}\) with the value \(\hat{d}^{\bar{r}}_{j}\) the adversary wants to report to the sink. In addition, the compromised sensors in \(R^{\bar{r}}_{j}\) pretend that they also receive \(\hat{d}^{\bar{r}}_{j}\). Hence, before the end of round \(\bar{r}+1\), \(s_{j}\) can collaborate with the sensors in \(R^{\bar{r}}_{j}\) to generate their own MACs that are consistent with each other and are consistent with \(\hat{d}^{\bar{r}}_{j}\). With these generated MACs, the \(\hat{d}^{\bar{r}}_{j}\) to be reported to the sink will not be recognized to be counterfeit. Moreover, this is not an attack in an ideal case. Instead, this is a practical attack, because, in practice, the length of each round will not be too short and the adversary can be aware of the target round right after something desired happens. Hence, ExCo is not as strong as [4] claims and has the same security strength as CoMAC. Second, Exco is vulnerable to PDoS attacks. In particular, after the adversary compromises a few sensors, these compromised sensors can be used to intentionally inject a large amount of useless traffic claimed to be the MACs in ExCo to waste the precious energy of sensors so that the network lifetime will be significantly reduced.