###### Abstract
In the traditional satellite network authentication scheme, the satellite generally transmits the forwarding messages [10], which causes a transmission delay in communication at least four times that of satellite and terrestrial networks [11]. Therefore, addressing efficient and secure authentication in SGINs is the first issue. To make things even more challenging, heterogeneous devices need to be authenticated in this network. Based on our above architecture, the different types of user equipment and  
Figure 1: SGIN overall architecture. their diverse security requirements pose great challenges to the research of SGIN access authentication. At present, terrestrial networks usually use the authentication and key agreement (AKA) protocol to implement UE access authentication. The 5G AKA proposes to protect the privacy of users by encrypting their permanent identity and transmitting encrypted SUCI. However, there is no privacy authentication for heterogeneous terminals that access via satellite networks. For diverse users in SGIN, a targeted authentication model is required. For example, for IoT nodes with a large scale and relatively weak computing power, anonymous batch authentication with lower complexity is needed to achieve a faster speed. However, the existing batch authentication schemes do not effectively protect user privacy [11] or incur excessive costs [12]. While individual end-users are more computationally capable and care a lot about their privacy and security, they can choose protocols with higher security and better protect their privacy. That is to say, it is difficult to unify these users with different needs. Meanwhile, due to the existence of multiple operators, SGIN secure roaming authentication also deserves attention. The current situation of many large satellite service providers (such as SpaceX and OneWeb) [13; 14] as well as small providers cannot achieve continuous global coverage of signals, which causes many inconveniences for UE to enjoy diverse and stable services. As mentioned above, different network services in 6G may be provided by various operators, and the core network (CN) of satellite and terrestrial networks may be disparate. If a new satellite or terrestrial base station providing service to a subscriber originates from a different operator, the new operator needs to perform roaming authentication with the subscriber. However, the existing 3 GPP roaming authentication approach [15] is not applicable for SGINs, because satellite transmission will bring significant time delays. How to provide fast multi-operator cross-network roaming authentication for subscribers is also a key challenge. Motivated by these challenges, we present an on-demand authentication protocol model for SGINs. In the model, we propose protocols for mutual authentication of UE and satellites, to reduce transmission overheads. Our protocols propose different access authentication scenarios for different users' performance and security requirements, so that UE can have on-demand access. Among these, UE privacy is protected to different degrees. In addition, a roaming authentication protocol is proposed for cross-domain roaming by different operators, in line with the mutual authentication between the UE and satellite. Compared with other related works, we give consideration to authentication and roaming, and provide on-demand access authentication for terminals with different abilities and needs. The contributions of this paper are as follows:  
* On-demand privacy-preserving authentication protocols for SGIN: We propose an on-demand access authentication protocol for satellite networks in SGINs based on the protocol architecture. For UE with high security and privacy requirements, an anonymous unlinkable authentication protocol is proposed which ensures UE's unlinkability. For large numbers of UE with demand for short delay times, a batch authentication protocol is proposed. The protocol supports rebatch authentication after authentication failure and can effectively alleviate DoS attacks.