## 5 Security Analysis and Proof
### Security Proof
The most ideal security situation is unforgeable under the existential unforgeability against chosen-message attacks (EU-CMA), which proves:  
\[\mathit{Succ}_{\Sigma}^{\mathit{EU-CMA}}(A)=\mathit{Pr}\Big{[}\mathit{Exp}_{ \Sigma}^{\mathit{EU-CMA}}(A)=1\Big{]} \tag{2}\]  
To successfully forge the signature of the message \(\mathit{data}_{i}\), the attacker needs to submit an inquiry to the challenger's random oracle. In our scheme, \(H\) represents the hash function set \(H()\) used by the challenger, and the attacker can obtain the hash value of the message from the challenger:  
\[\mathit{Challenger}_{H}^{\mathit{RO}}(A) \tag{3}\]  
\[H():\{0,1\}\rightarrow\mathbb{Z}_{n}^{*} \tag{4}\]  
\[\text{Initialization}:\mathit{Hash}_{\mathit{list}}\leftarrow\varphi \tag{5}\]  
Inquiry: If there is \((\mathit{h}_{i},\mathit{data}_{i})\in\mathit{Hash}_{\mathit{list}}\) for message \(\mathit{data}_{i}\), then return to \(\mathit{data}_{i}\); otherwise \(\mathit{data}_{i}\leftarrow\mathbb{Z}_{n}^{*},\text{add }(\mathit{h}_{i},\mathit{data}_{i})\) to \(\mathit{Hash}_{\mathit{list}}\) and return to \(\mathit{data}_{i}\). (3) Proof of the scheme based on game theory. Game 0: This is the original existential unforgeability against the chosen-message attacks (EU-CMA) game of the sequential signature scheme (S-SIG) proposed in this article. Therefore:  
\[\mathit{Succ}_{S-SIG}^{\mathit{EU-CMA}}(A)=\mathit{Pr}(\mathit{S}_{i}) \tag{6}\]  
Game 1: Attacker \(A\) first tries to retrieve or guess a random private key \(\mathit{sk}_{i}\). Assuming that the attacker can correctly retrieve or guess the real private key sent by the remote state estimation system, the attacker successfully forges the signature sent by the remote state estimation system and destroys the system. However, since \(\mathit{sk}_{i}\) is randomly selected from \(\mathbb{Z}_{n}^{*}\), and \(\mathbb{Z}_{n}^{*}\) is generated by the secure pseudo-random generator PRG, they have the same distribution, i.e., \(\mathit{Pr}(\mathit{sk}_{1})=\mathit{Pr}(\mathit{sk}_{2})\). Therefore, the attacker \(A\) has no advantages of correctly guessing the private key, and the private key is not sent online, so that it is impossible for Attacker \(A\) to obtain the private key from the network. Game 2: Attacker \(A\) tries to guess \((\mathit{h}_{i},\mathit{data}_{i})\) from \(\mathit{Hash}_{\mathit{list}}\). That is, the attacker tries to guess the sensor message \(\mathit{data}_{i}\) correctly and addresses an inquiry to the challenger to obtain signature \(\mathit{S}_{i}=H(\mathit{sk}_{i})\) for the selected data message \(\mathit{data}_{i}\). If Attacker \(A\) can correctly guess the data message or the private key, Game 0 has the same effect as Game 1(or Game 2). Assuming that an attacker obtains a random private key through inquiry (\(Q_{r}\)) and obtains information using \(H(\,)\) through inquiry (\(Q_{h}\)), then the probability of success in guessing is:  
\[Pr(Guess_{correct})=1/(Q_{r}+Q_{h}+1) \tag{7}\]  
Game 3: The attacker tries to analyze the private key \(sk_{i}\) of \(l\) bit and the hash code generated by the hash function \(H()\). In the scheme in this paper, if the length of the private key \(sk_{i}\) used is at least 2048 bits, each private key has \(2^{2048}\) different combinations, and then Attacker \(A\) needs to try at least \(2^{2048}\) attempts to guess the private key correctly; that is, Attacker \(A\) needs to try at least \(2^{160}\), \(2^{256}\), and \(2^{384}\) times to guess the private key correctly for SHA1, SHA256, and SHA384. It is impossible for Attacker \(A\) to guess and generate the exact private key \(sk_{i}\) within limited time. Game 4: Now we to prove the primary theorem of this article, that is, that as long as the hash function used provides standard security properties, we have proved that the scheme is safe. **Definition 3**.