## 4 The Proposed Scheme
### Anonymous Authentication Phase
#### 4.2.2 Batch Authentication Scenario  
The traditional short group signature scheme uses a batch group signature (BGS) to complete batch authentication. However, due to the insufficient computing power of some devices in 6G heterogeneous networks and the massive terminals, we designed a novel batch authentication protocol to meet the needs of these terminals. In this scenario, users can generate a TID, but it is traceable. A set of UE send their batch authentication message to the LEO, which authenticates all parameters uniformly. If the first batch authentication is successful, the LEO authenticates them and continues the authentication process. If the first authentication fails, a rebatch is required. The specific protocol process is shown in Figure 4, and the detailed steps are as follows:  
1. The UE selects random numbers \(r_{1},k_{i},b_{i}\in Z_{q}^{*}\), then calculates \(B_{i}=b_{i}P\), \(U_{i}=b_{i}\cdot BPK_{LEO}\). The UE sets the access message as \(M_{i}=(TID_{i}||ID_{LEO}||B_{i}||g^{*}||TS_{1})\), where \(TS_{1}\) is a timestamp. Then, UE calculates the hash value \(h_{i}=H_{1}(M_{i})\) of \(M_{i}\), and sets the batch authentication key \(BAK_{i}=k_{i}h_{i}\cdot BK_{i}\) and \(RAK_{i}=(k_{i}\cdot RK_{i})\oplus H_{1}(B_{i}||U_{i}||TS_{1})\). Then, the UE receives the signature of batch authentication \(\sigma_{i}=(BAK_{i},RAK_{i})\). After signing the message, the UE sends \((M_{i},\sigma_{i})\) to the target LEO;
2. When the LEO receives \((M_{i},\sigma_{i})\) from the UE, it first checks the validity of the timestamp \(TS_{1}\). If \(TS_{1}\) is legal, the LEO sets \(h_{i}^{\prime}=H_{1}(M_{i})\), \(U_{i}=\epsilon_{LEO}\cdot B_{i}\) and \(H_{1}(B_{i}||U_{i}||TS_{1})\), then calculates the following equation: \[\epsilon(\sum_{i=1}^{n}BAK_{i},BMK)=\prod_{i=1}^{n}h_{i}(RAK_{i}\oplus H_{1}( B_{i}||U_{i}||TS_{1}))\] (1) If Equation (1) is true, \(n\) UE in the batch authentication group is valid. Otherwise, it means that there are invalid messages in this group. Batch authentication has the advantage of reducing the computational overheads, but once an invalid request occurs in a batch, the authentication will fail. When a malicious attacker continuouslysends invalid information to implement DoS attacks, users may be unable to complete authentication for a long time. Therefore, a rebatch is required to protect the UE's QoS. The algorithm of \"divide-and-conquer\" (BVDC) [25] can be used. The LEO can use dichotomous validation for a batch authenticated UE, to find the UE that failed validation and return error messages. Although the rebatch may bring computation overheads, it is helpful for improving the overall system efficiency and increasing the verification success rate.
3. For UE that passes the authentication, the LEO constructs \(M_{i}^{\prime}=(TID_{i}||ID_{LEO}||g^{*2}||TS_{2})\), where \(TS_{2}\) is a timestamp, \(g^{*2}\) is a session key parameter generated by LEO, and \(r_{2}\in Z_{q}^{*}\) is a number randomly generated. The LEO uses \(ECSign(M_{i}^{\prime})\) to generate the signature \(\sigma_{i}^{\prime}\) and send \(\big{(}M_{i}^{\prime},\sigma_{i}^{\prime}\big{)}\) to the UE.
4. After receiving the message, the UE first verifies the validity of the timestamp. The message is then verified by \(ECVerify(M_{i}^{\prime},\,\sigma_{i}^{\prime})\). If the verification is successful, the UE calculates the session key \(SK=\big{(}g^{*2}\big{)}^{\dagger 1}\), and the LEO calculates the session key \(SK=(g^{\prime 1})^{\dagger 2}\). The key negotiation between the two sides is complete.