## 5 Security Analysis and Proof
### Security Proof
That is, Attacker \(A\) must first correctly guess \(l\), and then correctly select the same public key \(pk_{i}\) as the sensor; however, each set of signature data sent and received by the sensor and the remote state estimation system synchronously is associated with an independent specific time cycle, which proves that the mechanism in this paper is safe for random guessing. Assuming that Attacker \(A\) can recover public key \(pk_{i}\) and signature \(s^{\prime}_{i}\) of the controller, the attacker correctly guessed \(l\), runs \(A^{Sign(sk_{i},\cdot)}(pk_{i})\), and thinks about the signature inquiry of \(data^{\prime}_{i}\) submitted by the randomly oracle; the oracle machine runs \(Sign(sk^{\prime}_{i},data^{\prime}_{i})\) and generates signature \(s^{\prime}_{i}\) for Attacker \(A\), then there is \(s^{\prime}_{i}=H(sk^{\prime}_{i})\). At this time, Attacker \(A\) has \(data^{\prime}_{i}\), \(s^{\prime}_{i}\) and \(pk^{\prime}_{i}\), and the real purpose of Attacker \(A\) is to recover \(sk^{\prime}_{i}\). The existence of such a function with these properties is equivalent to a one-way function. Based on the hypothesis of one-way encryption and anti-second preimage of the function \(F\), the probability of success of Attacker \(A\)'s obtaining the signature \(m\) through the random oracle is:  
\[\text{\emph{Succ}}^{A}_{RO}=m.\text{max}\Big{\{}In\text{Sec}^{OW}_{S-SIG}(H, t^{\prime\prime}),In\text{\emph{sec}}^{SPR}_{S-SIG}(H,t^{\prime\prime})\Big{\}} \tag{14}\]  
where \(t^{\prime\prime}=t+3m+l\) meets the last of all three algorithms at runtime. The one-way encryption of public key generation depends on the one-way encryption of one-way function \(f()\), while signature generation requires the private key hash function to maintain anti-preimage. The encryption hash function \(f()\) we use meets the anti-preimage. Assuming that Attacker \(A\) addresses an inquiry on the signature of a certain message \(M\) to the random oracle, based on the advantages of the random oracle in data message distribution (DMD) and public key distribution (PKD), Attacker \(A\)'s constraint relationship with the success probability \(\text{\emph{Succ}}^{P}_{EXP}(A)\) using the random oracle and the success probability \(\text{\emph{Succ}}^{P}_{EXP}(A)\) of the original experiment (EXP) is:  
\[\text{\emph{Adv}}_{PKD,DMD}(A)=\text{\emph{Succ}}^{P}_{EXP}(A)-\text{\emph{ Succ}}^{P}_{RO}(A) \tag{15}\]  
Then, we only need to consider the situation of \(\text{\emph{Succ}}^{P}_{EXP}(A)\geq\text{\emph{Succ}}^{P}_{RO}(A)\), namely:  
\[\text{\emph{Succ}}^{P}_{EXP}(A)=\text{\emph{Adv}}_{PKD,DMD}(A)+\text{\emph{ Succ}}^{P}_{RO}(A) \tag{16}\]  
However, when Attacker \(A\) adopts the pseudo-random generator key distribution, there are non-negligible advantages, namely:  
\[\text{\emph{Adv}}_{PKD,DMD}(A)\leq\text{\emph{Inf}}\text{Sec}^{UD}_{S-SIG}(A)+ \text{\emph{Succ}}^{P}_{RO}(A) \tag{17}\]  
where \(t^{\prime}=t+3m\). Then there is:  
\[\text{\emph{Adv}}_{PKD,DMD}(A)\leq\text{\emph{Inf}}\text{Sec}^{UD}_{S-SIG}(H, t^{\prime})+m.\text{max}\Big{\{}In\text{Sec}^{OW}_{S-SIG}(H,t^{\prime\prime}),In \text{\emph{sec}}^{SPR}_{S-SIG}(H,t^{\prime\prime})\Big{\}} \tag{18}\]where \(t^{\prime}=t+3m\) and \(t^{\prime\prime}=t+3m+l\), which is contradictory. This proves that there is no existential forgery under which success probability \(Succ_{S-SIG}^{EU-CMA}(A)\) is greater than \(InSce_{S-SIG}^{EU-CMA}((1^{n},m),t,1)\) of the attacker at runtime \(t\).