## 2 Some Requirements for Anonymous Authentication
### The Protocol for Using an Anonymous Ticket in the _ith_ Round before the _Due_ Date  
This protocol makes them possible for the anonymous mobile user \(MS\) to perform mutual authentication with \(V\) and use her/his ticket for mobile network services. It contains the following steps and also is illustrated in Figure 4.  
1. \(MS\to V:(\alpha,\theta_{1},T,\theta_{2})\). First, \(MS\) sets \((m^{*},\delta^{*},\sigma^{*},s^{*})=(m_{i},\delta_{i},\sigma_{i},s_{i})\) and then prepares \(T=(F_{1}(m^{*}),\delta^{*},\sigma^{*},\gamma,s^{*})\) and randomly generates \(5\)\(l_{r}\)-bit strings \((m^{**},k,r_{1},r_{2},r_{3})\) and an integer \(r\in\mathbb{Z}_{n_{H}}^{*}\). Furthermore, \(MS\) computes \(\alpha=r^{\epsilon_{H}}F_{1}^{2}(m^{**})\bmod n_{H}\), \(\theta_{1}=E_{pk_{j}}(k)\), and \(\theta_{2}=E_{pk_{V}}(r_{1},r_{2},r_{3})\). Finally, \(MS\) submits \((\alpha,\theta_{1},T,\theta_{2})\) to \(V\). 2. \(V\to MS:(r_{1},r_{4})\). After receiving \((\alpha,\theta_{1},T,\theta_{2})\), \(V\) first verifies \(T\) by examining if  
\[(s^{*})^{\epsilon_{H}}\equiv F_{1}(F_{1}(m^{*}))F_{2}(\delta^{*},\sigma^{*}, \gamma)\pmod{n_{H}} \tag{5}\]  
and \(\gamma\) is not expired. If true, \(V\) decrypts \(\theta_{2}\) to get \((r_{1},r_{2},r_{3})\) and randomly generates an \(l_{r}\)-bit string \(r_{4}\). Then \(V\) sends \((r_{1},r_{4})\) to \(MS\). 3. \(V\to H:E_{k_{p,h}}(T)\). After \(V\) sends \((r_{1},r_{4})\) to \(MS\), it also immediately submits \(E_{k_{p,h}}(T)\) to \(H\) in order to perform the double-using checking on \(T\). If \(T\) is doubly used, the connection will be terminated. Figure 4: The protocol for using an anonymous ticket in the \(i\)-th round before the due date. \(MS\to V:(r_{5})\). After receiving \((r_{1},r_{4})\), \(MS\) checks if \(r_{1}\) is the same as the one which was chosen by herself/himself. Then \(MS\) computes \(r_{5}=F_{3}(r_{2}||r_{4})\oplus m^{*}\) and sends \(r_{5}\) to \(V\). 5. Allowing Communication: After receiving \(r_{5}\), \(V\) computes \(m=r_{5}\oplus F_{3}(r_{2}||r_{4})\) and checks if \(F_{1}(m)=F_{1}(m^{*})\) where \(F_{1}(m^{*})\) is retrieved from \(T\). If true, \(V\) ensures that \(MS\) is the real owner of \(T\). Therefore, \(V\) allows \(MS\) to communicate with it. During the communication, they can encrypt/decrypt their messages via the session key \(r_{3}\). After \(MS\) terminates her/his communication, she/he will get a returned ticket which will be used for the next round of authentication. As shown in Figure 5, she/he has to perform the following procedures with the system to obtain the returned ticket. 1. \(MS\to V:(\text{Termination})\). \(MS\) notifies \(V\) that she/he wants to terminate her/his communication. 2. \(V\to H:(E_{k_{r,h}}(\alpha,\theta_{1},T,m^{*},w^{\prime}))\). After receiving the termination request from \(MS\), \(V\) computes the spending value \(w^{\prime}\) of \(MS\) according to the communication time or services utilized by \(MS\). Then \(V\) sends \(E_{k_{r,h}}(\alpha,\theta_{1},T,m^{*},w^{\prime})\) to \(H\). 3. \(H\rightarrow\text{The judge device: }(T,w^{\prime},\theta_{1})\). \(H\) decrypts the message received from \(V\) and stores \((T,m^{*},w^{\prime})\) into its database. Then \(H\) inputs \((T,w^{\prime},\theta_{1})\) into the judge device. 4. The judge device \(\to H:(\beta,\rho)\). When receiving \((T,\)\(w^{\prime},\)\(\theta_{1})\), the judge device will verify \(T\) by (5) first and verify whether the due date \(\gamma\) embedded in \(T\) has expired or not. If one of the above verifications fails, the judge device will return an aborting signal. Otherwise, the judge device computes \(k=D_{sk_{j}}(\theta_{1})\), \((ID_{MS},r_{z}^{\prime})=D_{sk_{j}}(\delta^{*})\), and \((w^{*},r_{j}^{*})=D_{sk_{j}}(\sigma^{*})\) where \(\delta^{*}\) and \(\sigma^{*}\) are retrieved from \(T\). Furthermore, it randomly selects a string \(r_{j}\in\{0,1\}^{l_{r}}\) and an integer \(b\in\mathbb{Z}_{n_{H}}^{*}\) and  
Figure 5: The protocol for terminating the communication and getting a returned ticket for the next round of communication.