## 5 Security Analysis and Proof  
### Security Analysis  
In this part, we conduct a security analysis on the proposed sequential signature mechanism. Assuming that the probability of finding a signature for data message \(data_{k}\) is equivalent to the probability of finding at least one two-way collision, that is, that there are at least two \(l\)-bit strings randomly selected from the set \(m\) for \(sk_{1}\) and \(sk_{2}\), \(f(H(sk_{1}))\triangleq f(H(sk_{2}))\), then the security of the signature depends on the probability of forging the signature. The probability that the challenger randomly selects \(t\) signatures from the set \(m\) would thus be [37]:  
\[\mathrm{Pr}ob=1-\prod_{k=1}^{t-1}\biggl{(}\frac{m-k}{m}\biggr{)}_{(k=1)}^{(t-1 )}\approx 1-e^{\frac{i(t+1)}{2m}} \tag{1}\]  
The protocol in this paper effectively improves its security by embedding periodic time series and timestamps. The security strength analysis is as follows:  
(1) Counterfeit attack: between the sensor and the remote state estimator network communication, if \(A\) impersonates a sensor and sends a message to the remote state estimator, the remote state estimator will find that its public key is different from public key \(pk_{i}\) received previously after receiving the message and verifying its signature, and the attacker A cannot conduct a counterfeit attack. The authors of [37] have analyzed and proved this problem.  
(2) Forgery attack: Attacker \(A\) cannot forge sensor signatures. Assuming the attacker eavesdrops on a valid signature \((si_{1},si_{2},\ldots,si_{k})\), since the sensor sends the same monitoring data at different times, the attacker may forge false messages \(m^{\prime}\); however, each set of signature data sent and received by the sensor and the remote state estimation system synchronously is associated with a specific time period, if attacker \(A\) tries to forge the signature using the previously revealed signature. The reason is that sensor nodes do not reuse previously exposed signatures. And the attacker must know the exact time period of the current data. Therefore, even if the attacker eavesdrops on a valid signature, it is impossible to forge valid monitoring data and data signatures.  
(3) Replay attack: A replay attack means that an attacker intercepts the data packet sent by the sensor and replays it after a period of time. The goal of replay attacks is to allow the receiver to receive the same message two or more times, or to change the order of packets to disrupt the application. First, since each signature message in our scheme is associated with a specific time period, the message signed in the time period \(k\)-\(T\) cannot be replayed in another period of time \(k+T\). Each monitoring data message sent at a sensor node contains a timestamp, whose effective value depends on the propagation time between the sensor and the remote state estimation system. Once the receiving time threshold is exceeded, the remote state estimation system will discard the message. If attacker \(A\) sends the monitoring data message captured in advance to the remote state estimation system, the actuator directly discards the message due to the invalid signature time.  
(4) Delay and selective forwarding attacks: For time-critical monitoring data transmission, delay attacks can be regarded as weaker packet loss attacks. For the sake of generality, we only analyze selective forwarding attacks. A successful packet loss attack means that attacker \(A\) selectively discards a group of packets \(\{data_{i_{1}},\ldots,data_{i_{T}}\}\), which will cause another packet \(data_{j},j\
otin\{i_{1},\ldots,i_{T}\}\) to fail authentication. The scheme can resist selective forwarding attacks, because each data packet is independently signed. Assuming that the data message received by the remote state estimation system is inconsistent with the current time period of the state estimator, the state estimator considers the message illegal and sends an alarm message.