###### Abstract  
Satellite-ground integrated networks (SGIN) are in line with 6 th generation wireless network technology (6G) requirements. However, security and privacy issues are challenging with heterogeneous networks. Specifically, although 5G authentication and key agreement (AKA) protects terminal anonymity, privacy preserving authentication protocols are still important in satellite networks. Meanwhile, 6G will have a large number of nodes with low energy consumption. The balance between security and performance needs to be investigated. Furthermore, 6G networks will likely belong to different operators. How to optimize the repeated authentication during roaming between different networks is also a key issue. To address these challenges, on-demand anonymous access and novel roaming authentication protocols are presented in this paper. Ordinary nodes implement unlinkable authentication by adopting a bilinear pairing-based short group signature algorithm. When low-energy nodes achieve fast authentication by utilizing the proposed lightweight batch authentication protocol, which can protect malicious nodes from DoS attacks. An efficient cross-domain roaming authentication protocol, which allows terminals to quickly connect to different operator networks, is designed to reduce the authentication delay. The security of our scheme is verified through formal and informal security analysis. Finally, the performance analysis results show that our scheme is feasible. s 20232  
Owing to the short coverage time per satellite, users may need to switch operators or switch to a faster terrestrial network. In order to support global coverage, it is important to encourage operators of SGINs to collaborate with each other and provide cross-domain services. In a word, a SGIN is a complex heterogeneous network that combines multiple operators with global coverage. As shown in Figure 1, the SGIN architecture consists of three segments, i.e., a Satellite Node Segment, Ground Network Segment, and Access User Segment. The Satellite Node Segment consists of geosynchronous earth orbit (GEO) satellites, medium earth orbit (MEO) satellites, and low earth orbit (LEO) satellites. Compared to MEOs and GEOs, LEOs are closer to the ground and therefore have less communication overheads. Thus, only LEO authentication is considered in our architecture. These satellites can be transparent satellites or regenerative satellites. Transparent satellites are only responsible for transmitting messages. While regenerative satellites, which are equipped with gNB-DU, can be applied as a part of a 6G base station to process messages. The Ground Network Segment includes heterogeneous networks, such as large-scale servers, base stations, and satellite ground stations (GSs). Among them, the satellite network operators maintain the satellite ground network, including GSs and network control centers (NCCs). The terrestrial mobile operators maintain terrestrial networks, including the next-generation NodeBs (gNBs) and 6G core networks (6 GCs). The Access User Segment consists of the user equipment (UE) in heterogeneous networks, such as mobile UE, IoT UE, and marine UE, which can be located on the ground, in suburban areas (areas with poor signal), at sea, in mountains, and so on. Obviously, these devices have different computing capabilities and diverse security requirements. They should choose suitable network domains and operators according to their own needs. Since the information in a SGIN is transmitted through a public wireless channel, the user's information is vulnerable to malicious attacks. Access authentication is the first step for UE to connect to the core network, so as to guarantee mutual authentication, forward and backward security, and be resistant to typical attacks. Unlike existing terrestrial networks, there is a large propagation delay (more than 10 ms) between satellite and terrestrial networks.