## 5 Security Analysis and Proof
### Security Proof
: _If Attacker \(A\) has a negligible probability of winning the game in the maximum \(q\)-inquiry situation, the signature scheme is unforgeable under the \(q\)-adaptive selection message attack._  
For the security parameter \(n\), \(Sign(1^{n})\) is signature, \(KeyGen(1^{n})\) is key generation, \(Sign(sk_{i}\,\cdot)\) is signature generation, and \(Ver(pk_{i},data_{1},S_{i})\) is signature verification, and the generated signature is \(s_{i}\). \(\{(data_{i},S_{i})\}_{1}^{q}\) indicates a question-answer pair \(Sign(sk_{i}\,\cdot)\) generated for the signature. Under the existential unforgeability against chosen-message attacks (EU-CMA), the security standard concept test based on the signature scheme is as follows:  
\[Experiment\,\,Exp_{IGN}^{EU-CMA}(A) \tag{8}\]  
\[Setup:KeyGen(1^{n})\rightarrow(sk_{i},pk_{i}) \tag{9}\]  
\[Execution:(data_{1},S_{i})\
eg A^{Sign(sk_{i})}(pk_{i}) \tag{10}\]  
If \(Ver(pk_{i},data_{1},S_{i})=1\) and only if \(data_{1}\
otin(data_{i})_{1}^{q}\), it returns to \(1\); otherwise it returns to \(0\). We define the success probability of Attacker \(A\) as:  
\[Succ_{S-SIG}^{EU-CMA}(A)=Pr\Big{[}Exp_{SIGN}^{EU-CMA}(A)=1\Big{]} \tag{11}\]  
However, in our scheme, to ensure the sequence of monitoring data messages between the sensor and the remote state estimation system, the sensor and the remote state estimation system respectively sign in their respective time periods \(R_{k+T}\)\(T\) and \(S_{k+T}\), which are not transmitted through the network, so that attackers cannot forge a signature. Even if the attackers eavesdrop on a valid signature, they cannot continuously forge effective monitoring data messages and message signatures, that is, they cannot destroy the sequential relationship of the monitoring data messages. To prove the security under the random oracle model \(H()\), there is \(\{h_{j},data_{i}\}_{i=1}^{t}\) in the running time \(t\), if \(i\
eq j\), then \(data_{i}\
eq data_{j}\). An insecure function \(InSec_{SIGN}^{EU-CMA}(s,t,q)\) is used to represent the maximum probability of success of the attacker against the original system \(s\) during the running time \(t\) with no more than \(q\) inquiries by the random oracle. We then define:  
\[\mathit{Challenger}_{H}^{\mathit{RO}}(A) \tag{3}\]0  
Theorem: Set \(n,v,data\in N,F\{f:\{0,1\}^{n}\rightarrow\{0,1\}^{n}\}\) as a single-row function family that satisfies anti-second preimage (SPR), undetectability (UD) and maintains one-wayencryption (OW). Then \(In\text{Sec}^{EUI-CMA}_{SIGN}(((1^{n},m),t,1)\), and the proposed sequential signature scheme (S-SIG) satisfies the constraint of insecurity under the anti-EU_CMA attack:  
\[\small \begin{split}&\small\begin{split} In\text{Sec}^{EUI-CMA}_{S- SIG}((1^{n},m),t,1)\leq In\text{Sec}^{UID}_{S-SIG}(F,t^{\prime})+m.\text{max}\left\{In \text{Sec}^{OW}_{S-SIG}(F,t^{\prime\prime}),In\text{sec}^{SPR}_{S-SIG}(F,t^{ \prime\prime})\right\}\end{split}\end{split}  \tag{13}\]  
where: \(t^{\prime}=t+3m,t^{\prime\prime}=t+3m+l\) Proof by contradiction: Assuming that Attacker \(A\) may use adaptive selection messages to attack S-SIG within time \(t\), resulting in existence forgery, and that the probability \(\text{\emph{Succ}}^{EUI-CMA}_{S-SIG}(A)\) of success is greater than the claimed \(\text{\emph{Succ}}^{EUI-CMA}_{S-SIG}((1^{n},m),t,1)\), the random oracle first runs \(\text{\emph{KeyGen}}()\) to obtain a secret key pair \((sk_{i},pk_{i})\). Therefore, to generate a public key from the recovered signature \(s^{\prime}_{i}\), Attacker \(A\) must know the one-way function \(f()\) of generating the public key. Even if the Attacker \(A\) knows the one-way function \(f()\), the public key \(pk^{\prime}_{i}\) generated by Attacker \(A\) must be the same as the public key \(pk^{\prime}_{i}\) currently used by the sensor.