## 2 Some Requirements for Anonymous Authentication
### Exceptions  
In addition to the above issues, there are three exceptions that may happen in our scheme. One is that the mobile user denies returning her/his ticket for billing on the due date. Another is that the mobile user lost her/his ticket (or lost her/his mobile device), and the other one is that the mobile user's communication is terminated abnormally. 1. The mobile user denies returning her/his ticket for billing on the due date: After the due date \(\gamma\), if there is any mobile user who has not returned her/his unused ticket yet, \(H\) will send a list \(\mathcal{L}\) to the judge where \(\mathcal{L}\) contains the identities of the mobile users who did not return their unused tickets. According to \(\mathcal{L}\), the judge sends a payment notification to each mobile user on \(\mathcal{L}\) and announces another due date \(\gamma^{\prime}\). If a mobile user, say \(ID_{\text{MS}}\), has not returned her/his unused ticket on the new due date \(\gamma^{\prime}\), the judge will compute the set \(\{\delta_{1},\delta_{2},\delta_{3},\dots\}\) according to \(ID_{\text{MS}}\) via Equation (6) and then sends it to \(H\). Let \(T_{i}\) denote the \(i\)th ticket, _i.e._, the ticket containing \(\delta_{i}\). Assume that the mobile user denied returning \(T_{i+1}\). \(H\) can find \((T_{i},w^{\prime})\) from its database via \(\delta_{i}\). When \(H\) finds \((T_{i},w^{\prime})\), the judge can help \(H\) with extracting the spending value \(w^{*}\) from \(T_{i}\), and then \(H\) computes \(w^{\prime\prime}=w^{*}+w^{\prime}\) and adds \(w^{\prime\prime}\) to the bill of the mobile user \(ID_{\text{MS}}\). 2. The mobile user lost her/his ticket: When a mobile user, say \(ID_{\text{MS}}\), lost her/his unused ticket \(T_{i}\), she/he must ask \(H\) to freeze her/his unused ticket or it may be used by a malicious user. After an authorization process, for example, the mobile user signs a document to show that she/he agrees \(H\) to ask the judge to compute \(\{\delta_{1},\delta_{2},\dots\}\) where the mobile user authorizes \(H\) to reveal her/his privacy, \(H\) sends \((ID_{\text{MS}},\xi)\) to the judge to compute \(\{\delta_{1},\delta_{2},\delta_{3},\dots\}\) by Equation (6). Assume that the mobile user lost \(T_{i}\). \(H\) must deny the services for \(T_{i},T_{i+1},T_{i+2},\dots\) by \(\delta_{i},\delta_{i+1},\delta_{i+2},\dots\), respectively, where \(i\in\mathbb{N}\). Besides, \(H\) finds \((T_{i-1},w^{\prime})\) from its database via \(\delta_{i-1}\) and sends \(T_{i-1}\) to the judge to extract the accumulated spending value \(w^{*}\) from \(T_{i-1}\). After the judge returns \(w^{*}\) to \(H\), \(H\) adds \((w^{*}\,+\,w^{\prime})\) to the bill of the mobile user. In order to handle this exception, the privacy of \(T_{1},T_{2},T_{3},\dots,T_{i-1}\) of the mobile user will be revealed. However, if the mobile user remembered how many tickets she/he has used, she/he can still preserve her/his privacy. For example, a mobile user lost her/his unused ticket, and she/he remembers that she/he has consumed 4 tickets. Then the judge just needs to compute \(\{\delta_{4},\delta_{5},\delta_{6},\dots\}\) for \(H\), and \(\{\delta_{1},\delta_{2},\delta_{3}\}\) are still kept secret for the mobile user. \(H\) will check if \(\delta^{\prime}_{j}\) exists in its database where \(j^{\prime}=\{4,5,6,\dots\}\). If \(\delta_{j^{\prime}}\) exists in its database and \(\delta_{j^{\prime}+1}\) does not, \(H\) will retrieve \((T_{j},w^{\prime})\), which will be used for charging the mobile user, from the database via \(\delta_{j^{\prime}}\). After the mobile user freezes her/his lost ticket, she/he can perform the protocol in Section 3.3 again to request a new ticket. 3. The communication is terminated abnormally: Consider the case that the communication of Step 5 in Section 3.4 is abnormally terminated, _i.e._, the mobile user does not receive a renewed ticket. We assume that each time when the mobile user receives \((t,\rho)\) successfully, she/he will return an \(ACK\) to \(H\).