## 5 Security Analysis and Proof
### Security Proof  
In this part, we prove the security of the proposed scheme. (1) Formal security analysis model based on game theory. We propose a formal security analysis model composed of two factors:  
1) We assume that in any probability polynomial time, attackers can communicate with a legitimate user of an industrial control system, retrieve any message on the insecure network, or extract the message selected from the hypothetical probability challenger algorithm as the output. 2) To damage the system and forge messages, the attacker has the ability to successfully forge the true signature of the actual sender. That is, the attacker must capture and generate the sender's private key and forge the signature. In our security analysis model, the attacker can interact with the hypothetical probability challenger algorithm, and the challenger can respond to all the inquiries by the attacker. The game ends when the attacker announces his/her decision. If the attacker can correctly deduce the security parameters and crack the system, the attacker wins. If the probability that any attacker will break the system is small, the system is proven to be safe. The challenger generates a pair of keys \((sk_{i},pk_{i})\), and then the attacker executes the algorithm, which means selecting a security parameter \(n\) and a certain public key \(pk_{i}\) as input. The attacker addresses inquiries to the challenger, and the challenger executes the signature generation algorithm to calculate signature \(S_{i}\) for the selected sensing data \(data_{i}\). If the signature \(S_{i}\) generated by the attacker \(A\) is a valid signature of the data message \(data_{i}\), the attacker succeeds in forging the signature. (2) Proof of digital signature scheme. **Definition 1**. : _(Digital Signature Scheme): For the message space \(M\), there is a digital signature scheme\(\Sigma=(\mathit{KeyGen},\mathit{Sign},\mathit{Ver})\)._  
\(\mathit{KeyGen}()\rightarrow(\mathit{sk},\mathit{pk})\): Probabilistic key generation algorithm: input the security parameter \(\mathit{I}^{n}\), generate a public and private key pair \((\mathit{sk}_{i},\mathit{pk}_{i})\) and output;  
\(\mathit{Sign}(\mathit{sk}_{i},\mathit{data}_{i})\rightarrow\mathit{s}_{i}\): Probabilistic signature algorithm: input the data message \(\mathit{data}_{i}\in M\) and the signature key \(\mathit{sk}_{i}\), and output the signature \(\mathit{s}_{i}\);  
\(\mathit{Ver}(\mathit{pk}_{i},\mathit{data}_{i},\mathit{s}_{i})\rightarrow\{0,1\}\): Deterministic verification algorithm: input the data message \(\mathit{data}_{i}\), public key \(\mathit{pk}_{i}\) and signature \(\mathit{s}_{i}\), and output 0 (invalid signature) or 1 (valid signature). **Definition 2**. : _(Correctness): For all messages \(\mathit{data}_{i}\in M\), all \(\mathit{KeyGen}()\rightarrow(\mathit{sk}_{i},\mathit{pk}_{i})\), all \(\mathit{Sign}(\mathit{sk}_{i},\mathit{data}_{i})\rightarrow\mathit{s}_{i}\), if exists \(\mathit{Ver}(\mathit{pk}_{i},\mathit{data}_{i},\mathit{s}_{i})=1\), then the digital signature scheme is correct._  
Then, attacker \(A\) may try to achieve the following attack goals: (1) Key recovery: attempt to calculate \(\mathit{sk}_{i}\) through a known public key \(\mathit{pk}_{i}\) and impersonate the signer; (2) Extensive forgery: calculate a valid signature \(\mathit{s}_{i}\) for a received message \(\mathit{data}_{i}\); (3) Existential forgery: Calculate a valid signature \(\mathit{s}_{i}\) for a selected data message \(\mathit{data}_{i}\). At the same time, we assume that the attacker has the following capabilities: (1) Known key: can receive the public key \(\mathit{pk}_{i}\) sent by the remote state estimation system; (2) Known message: retrieve data message and signature pairs from a preassigned data message list. (3) Adaptive selection of messages: attackers can adaptively obtain signatures for the selected data messages.