## 2 Related Work  
The network control system is a closed-loop feedback control system formed by sensors, actuators, controllers, and remote state estimation systems through the network. The remote state estimation system estimates the current system state based on the monitoring data returned by the sensors, and then triggers the control algorithm or control condition of the controller. The sensor usually communicates with the remote state estimator at a predetermined time period \(k\). That is, the sensor performs local state estimation based on physical process measurements, and then transmits it to the remote state estimator. This requires the remote state estimation system to verify whether the received message comes from the claimed sender and whether it is modified during transmission, to ensure that the received multicast data is complete and that it originated from a source with a specific identity. Without authentication, attackers can easily modify the message in transit, forge any message, or replay the message to trigger control algorithms or control conditions or even catastrophic operations. However, due to their unique requirements, industrial control systems have strict time requirements and the resources of field devices are usually limited. For example, The Distributed Network Protocol (DNP3) standard has a default control duration time of 250 ms [19]. Therefore, identity verification should be completed quickly and efficiently. Public key-based signatures such as the RSA, the digital signature algorithm (DSA), the elliptic curve digital signature algorithm (ECDSA), and message authentication codes (MAC), which are widely used for data integrity verification and some hybrid improvement schemes, fail to meet the industrial control network requirements with limited resources and time sensitivity due to large computation. Figure 1: Model of SCADA control system. The one-time signature (OTS) based on the hash function, first proposed by [PERSON], has become an effective and feasible alternative to data verification [20]. It is easy to calculate trapdoor functions and one-way functions in one direction, but difficult in the opposite direction. The difference is that it can easily calculate the trapdoor function in the opposite direction if provided with special information about the trapdoor function. Integer factorization is an example of trapdoor functions, and any hash function can be an example of one-way functions. For a long time, compared with other signature schemes that use trapdoor functions (such as RSA, DSA, and ECDSA), they were considered of theoretical importance only due to their flaws; for a long time afterwards, these one-time signature schemes were almost forgotten. However, the proposal and development of quantum computing and post-quantum cryptography have reversed this situation, mainly because the long-forgotten one-time signature scheme using one-way functions is proved secure for quantum computing, but the commonly used signature scheme using trapdoor functions is not. Precisely, [PERSON] [21] proposed a quantum algorithm that successfully solved the problem of discrete logarithm decomposition in polynomial time, thus challenging the security of RSA, DSA, and ECDSA signature algorithms. In the following thirty years, one-time signatures have been rapidly developed and continuously improved. [PERSON] [22] proposed a one-time signature scheme, Biba, based on the bijective function. This function receives the message to be signed as input and returns a list of the private key number index of the shared signature, which can provide short signatures and fast authentication. [PERSON] et al. [23] further improved the Biba scheme; based on the subset elastic function instead of the one-way function, they proposed the HORS signature scheme, improving the efficiency of signature generation. [PERSON] et al.