## 6 Performance Analysis
### Communication Overhead Analysis  
According to the simulation results, the size of elements \(L_{\text{G}}\) and \(L_{Z}\) in \(\mathbb{G}\) and \(Z_{q}^{*}\) are both 16 bytes. Assuming that the identity length \(L_{ID}\) and time message length \(L_{T}\) are both 12 bytes. The hash function length \(L_{H}\) is 32 bytes.  
Figure 9: Case comparison for rebatch authentication.  
In the unlinkable authentication scenario, the UE needs to send an LEO signature of \(3L_{G}+6L_{Z}=144\) bytes and plaintext of \(2L_{ID}+L_{G}+L_{T}=52\) bytes. When the LEO completes authentication, 84 bytes of information will be returned. The signature information for the schemes of both [PERSON] et al. [37] and [PERSON] et al. [12] was \(3L_{G}+6L_{Z}=144\) bytes, while the schemes of [PERSON] [24] required \(6L_{G}+6L_{Z}=192\) bytes. Since other SGS-based schemes have different architectures from the proposed scheme, we tried to unify their certification scenarios and situations for a better analysis. It was assumed that at least the ID and time stamp are required in these schemes. The trust value of the scheme of [PERSON] et al. [37] was 4 bytes according to their article. A comparison of communication overhead from the UE to the access point is shown in Figure 10. As can be seen from the figure, the communication overhead of the proposed scheme was slightly smaller than the schemes of [PERSON] [24] and [PERSON] et al. [12], while it was equal to [PERSON] et al. [37].  
In batch authentication, the UE needs to send a \(4L_{G}+2L_{ID}+L_{T}=64\) bytes message to the LEO, and the LEO returns a message of 84 bytes. A comparison was made with the communication overheads of the authentication protocol of [PERSON] et al. [11] and [PERSON] et al. [12]. The results are shown in Table 5. According to the analysis results, the overall message length of the proposed scheme is shorter than that of the other related works.  
Assuming that the plaintext length is \(16n\) bytes (i.e., \(n\) is divisible by 16), then the ciphertext length is \(16n\) bytes in AES encryption. If the plaintext length is \(16n+m\) bytes and \(m<16\), the ciphertext length is \(16(n+1)\) bytes. In the roaming authentication phase, \(K_{1}\) is key with a length \(L_{r}=16\) bytes, and the size of \(Ticket_{i}\) is \(L_{ticket}=16*(2L_{ID}+L_{r}+L_{T})/16=64\) bytes. Due to the use of symmetric encryption for key negotiation, we needed to calculate its communication cost separately. The size of \(c_{1}\) sent by UE to LEO is \(L_{c_{1}}=16(L_{r}+L_{ticket})/16=80\) bytes, and the total message length is \(L_{ID}+L_{G}+L_{c_{1}}+L_{H}+L_{T}=152\) bytes. The size of \(c_{2}\) is \(L_{c_{2}}=16*(L_{ID}+L_{r})/16=32\) bytes, the message size sent by the LEO to the UE is \(L_{ID}+L_{G}+L_{c_{2}}+L_{H}+L_{T}=104\) bytes.  
Figure 10: Communication overhead comparison in the unlinkable authentication scenario. [PERSON] et al. [37], [PERSON] [24], [PERSON] et al. [12].  
\begin{table}
\begin{tabular}{l l l} \hline \hline \multirow{2}{*}{**Scheme**} & \multicolumn{2}{c}{**Message Length (Bytes)**} \\ \cline{2-3}  & \multicolumn{2}{c}{**UE to LEO**} & \multicolumn{2}{c}{**LEO to UE**} \\ \hline [PERSON] et al. [11] & \(2L_{ID}+2L_{T}+2L_{G}+L_{Z}+2L_{ID}+L_{G}=144\) & \(L_{T}+2L_{ID}+3L_{G}+L_{Z}=100\) \\ \hline [PERSON] et al. [12] & \(2L_{ID}+4L_{G}+6L_{Z}+L_{T}=166\) & \(2L_{ID}+L_{T}+L_{G}+2L_{Z}=84\) \\ \hline Proposed & \(4L_{G}+2L_{ID}+L_{T}=64\) & \(2L_{ID}+L_{T}+L_{G}+2L_{Z}=84\) \\ \hline \hline \end{tabular}
\end{table}
Table 5: Communication overhead comparison in the batch authentication scenario.  
Despite the higher communication overheads of roaming authentication, it drastically reduces the computational latency, which is acceptable.