## 4 Proposed Method
### Proposed Method: AAD
For each \(s_{q_{i}}\), \(i\in[1,\bar{\bar{r}_{j}^{\bar{r}}}]\), the sink acquires \(R_{i}^{\bar{r}}\) and extracts \(\langle s_{j},P,E,Z\rangle\) (lines 3\(\sim\)4 in Figure 7). Here, \(\langle s_{j},P,E,Z\rangle\)'s extracted from different co-authenticators will not be the same in essence. We, however, omit the necessary subscript and superscript of \(P,E\), and \(Z\) without the ambiguity for convenience. From the acquired \(\langle s_{j},P,E,Z\rangle\), with the proper key, the sink can decrypt to obtain the \(\bar{d}_{j}^{\bar{r}}\) (line 6 in Figure 7), which is claimed by \(s_{q_{i}}\) to be the data sensed by \(s_{j}\) at round \(\bar{r}\). Based on the decrypted \(\bar{d}_{j}^{\bar{r}}\), the sink would try to verify if the authentication tag can be regenerated to match the authentication tag extracted from \(R_{i}^{\bar{r}}\). Here, to reproduce the authentication tag, the sink needs to obtain the sensor IDs on the forwarding path of \(\Omega\) in the correct order. Then, since the sink knows the keys of all the sensors on the forwarding path, if we can know that \(s_{j}\to s_{m_{1}}\to s_{m_{2}}\rightarrow\cdots\to s_{m_{\phi}}\) is the correct order of sensors on the forwarding path connecting \(s_{j}\) and \(s_{q_{i}}\), the sink can construct \(h_{k_{j}^{r}}(h_{k_{m_{1}}^{\bar{r}}}(\cdots h_{k_{m_{\phi}}^{\bar{r}}}(h_{k_ {q_{i}}}^{\bar{r}}(\bar{\bar{d}_{j}^{\bar{r}}}))\cdots))\), where \(s_{m_{1}},\ldots,s_{m_{\phi}}\) are the sensors on the route from \(s_{j}\) to \(s_{q_{i}}\), and see if it is equal to the authentication tag extracted from \(\langle s_{j},P,E,Z\rangle\). To know \(s_{m_{1}},\ldots,s_{m_{\phi}}\) (line 5 in Figure 7), the sink simply performs prime number factorization of \(P\), obtaining \(\hat{p}_{x_{1}}^{1},\hat{p}_{x_{2}}^{2},\ldots,\hat{p}_{x_{\phi}}^{\phi}\), where \(\phi\) is the length of the path connecting the sensor \(s_{j}\) and its co-authenticator being examined by the sink. Here, we should note that \(\phi\) varies when different co-authenticators are considered. Nonetheless, for ease of explanation, we also omit the necessary subscript and superscript. Then, the sink knows that \(s_{m_{i}}=s_{x_{i}}\) for all \(1\leq i\leq\phi\). Note that after  
Figure 6: The algorithm of receiving/forwarding phase. the factorization of \(P\), if \(P\) cannot be represented as the form of \(\hat{p}_{x_{1}}^{1},\hat{p}_{x_{2}}^{2},\ldots,\hat{p}_{x_{\phi}}^{\phi}\), then the authentication material provided by the co-authenticator being examined will be ignored. The authentication material \(\langle s_{j},P,E,Z\rangle\) extracted from \(s_{q_{i}}\) is dropped by the sink if the regenerated authentication tag does not match the authentication tag in \(\langle s_{j},P,E,Z\rangle\) (line 7 in Figure 7). The decrypted data \(\bar{d}_{j}^{\bar{r}}\) is stored if \(h_{k_{j}^{\bar{r}}}(h_{k_{m_{1}}^{\bar{r}}}(\cdots h_{k_{m_{\phi}}^{\bar{r}}} (h_{k_{sq_{i}}}^{\bar{r}}(\bar{d}_{j}^{\bar{r}}))\cdots))\) is equal to the authentication tag extracted from \(R_{i}^{\bar{r}}\). After the sink accomplishes the above procedures, if no authentication tag can be successfully verified, then all the data claimed to be the data sensed by \(s_{j}\) at round \(\bar{r}\) are dropped. Assume that the sink accomplishes the above procedures and at least one authentication tag of co-authenticators can be successfully verified. If and only if \(\bar{d}_{j}^{\bar{r}}\) extracted from the authentication materials sent from co-authenticators are all the same, \(\bar{d}_{j}^{\bar{r}}\) are regarded as genuine (lines 9\(\sim\)12 in Figure 7). **Example. ** Assume that \(\lambda=3\) and a specific round \(r\) is considered. For the sensor \(s_{1}\), we have the assumption that \(d_{1}^{r}=5\), \(k_{1}^{r}=7\), \(E_{k_{1}^{r}}(d_{1}^{r})=E_{7}(5)=10\), and \(z_{1}^{r}=h_{7}(5)=8\). In addition, we assume that after the execution of \(SELECT-DISTINCT\) and the checking procedure on \(\mathfrak{B}_{j}\), \(\bar{S}_{1}^{r}=\{s_{6},s_{7}\}\).