## 2 Related Work
### Security Issues in UWSNs  
Although UWSNs are studied only recently, many security issues have been investigated. The data survival issue, which aims to prevent the sensed data from being arbitrarily erased by the adversary, is first studied in [1,8]. Due to the fact that the adversary may compromise some sensors in order to enhance its capability of subverting the network functionality, the self-healing techniques are proposed in [9,10] to recover the compromised sensors. We refer the readers to [11] for a comprehensive overview of security issues in UWSNs.  
As for the authentication problem in UWSNs, few research efforts are conducted. Since the data sensed within the collection interval should be stored in the sensor for a possibly considerable period of time, in order to provide forward-security (described in Section 3.2), some authentication schemes [3,12] were proposed. Moreover, in [4], two authentication schemes, CoMAC and ExCo, both of which rely on the collaboration among multiple sensors, are presented for collecting authentic sensed data. To our knowledge, CoMAC and ExCo are the only schemes having both forward and backward security (described in Section 3.2). Particularly, in CoMAC, each sensor \(j\), after obtaining its sensed data \(d_{j}^{r}\) at round \(r\), constructs the corresponding authentication tag \(z_{j}^{r}\). Then, it immediately sends \(\langle d_{j}^{r},z_{j}^{r}\rangle\) to a set of randomly selected sensors. To verify the authenticity of \(d_{j}^{r}\), the sink collects all the corresponding authentication tags and checks whether the collected authentication tags can be generated by using the claimed \(d_{j}^{r}\). ExCo is different from CoMAC in that the former stores the hash of all the received authentication tags for each sensor while the latter directly keeps the received authentication tags for each sensor.  
Indeed, when CoMAC or ExCo is used, forward-security and backward-security can be achieved, enabling the sink to acquire the authentic data from sensors. Unfortunately, the naive collaboration among sensors used in CoMAC and ExCo incurs many more security problems. For example, the adversary may arbitrarily inject a large number of bogus messages into the network, pretending that it is proceeding with the collaborative authentication procedure albeit the false data will not be accepted by the sink eventually. Such kind of Path-Based DoS (PDoS) attack [5] would deplete the energy of sensors forwarding bogus messages, significantly reducing the network lifetime. Additionally, the compromised sensor can either provide bogus authentication tags to the sink or contaminate the transmitted authentication tags during the collaboration of sensors, forcing the genuine sensed data to be rejected by the sink due to the inconsistency with the authentication tags. The above misbehavior is similar to False-Endorsement DoS (FEDoS) attack [6], and is in common with most of the collaborative security schemes. We also note that, although the resilience of ExCo against sensor compromises is claimed in [4] to be stronger than that of CoMAC that works as a baseline scheme, when the adversary is assumed to be capable of controlling all the compromise sensors and be aware of the target round right after the end of the target round, their resilience will the same. We will describe the above problem in more details in Section 4.1