## 6 Proposed Cross-Domain Authentication Method
### System Initialization Phase  
In the consortium blockchain, blockchain anchor nodes from different domains collaboratively generate a random integer \(x\in(-\infty,\infty)\) using a distributed random number generation algorithm. A representative anchor node from the consortium blockchain generates the secret key \(SK_{ANR}\), the shared key \(S\), and a large prime number \(p\). It then computes the public key:  
\[PK_{ANR}=T_{SK_{ANR}}(x)\ mod\ p\]  
The representative anchor node securely transmits the shared key \(S\) to the blockchain anchor nodes of each domain via a secure channel. It then selects a one-way hash function \(h(\bullet)\) and publishes the system parameters  
\[\{x,p,PK_{ANR},h(\bullet)\}\]  
on the blockchain. Besides the shared key \(S\), the initialization parameters of the system are recorded in the blockchain's genesis block.  
Subsequently, the consortium blockchain network, through a consensus mechanism, assigns a unique identifier \(EID_{i}^{X}\) to each Domain \(X^{\prime}\)s Edge Gateway \(EG_{i}^{X}\). Each Edge Gateway then locally generates its own private key \(SK_{EG_{i}^{X}}\) and computes the corresponding public key:  
\[PK_{EG_{i}^{X}}=T_{SK_{EG_{i}^{X}}}(x)\ mod\ p\]  
The identity and public key pair \(\{EID_{i}^{X},PK_{EG_{i}^{X}}\}\) are submitted to the blockchain through the respective local blockchain anchor node, ensuring that each gateway is verifiably registered and authenticated within its domain.  
The consortium blockchain network leverages the Industrial Internet Identification System to generate or retrieve a unique identifier \(DID_{i}^{X}\) for each Device \(D_{i}^{X}\) of each Domain \(X\). Based on \(DID_{i}^{X}\), the device generates a private key \(SK_{D_{i}^{X}}\) and computes its corresponding public key as  
\[PK_{D_{i}^{X}}=T_{SK_{D_{i}^{X}}}(x)\ mod\ p\]  
The device then sends its identifier \(DID_{i}^{X}\) along with the public key \(PK_{D_{i}^{X}}\) to Edge Gateway \(EG_{i}^{X}\) in its Domain \(X\). Upon receiving the message, \(EG_{i}^{X}\) first verifies the validity  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Notation** & **Description** \\ \hline \(x\) & A Random Integer \\ \(p\) & Large Prime Number \\ \(h(\bullet)\) & Hash Function \\ \(D_{i}^{X}\) & The \(i\)th Device of Domain \(X\) \\ \(DID_{i}^{X}\) & ID of the \(i\)th Device of Domain \(X\) \\ \(PDID_{i}^{X}\) & The Pseudonymous ID of the \(i\)th Device of \\ \(PDID_{i}^{X}\) & Domain \(X\) \\ \(EG_{i}^{X}\) & The \(i\)th Edge Gateway of Domain \(X\) \\ \(EID_{i}^{X}\) & ID of the \(i\)th Edge Gateway of Domain \(X\) \\ \(T_{y}(x)\) & The Chebyshev Polynomials \\ \(T_{i}\) & \(i\)th Timestamp \\ \(||\) & OR Operation \\ \(\oplus\) & XOR Operation \\ \hline \hline \end{tabular}
\end{table}
Table 1: _Cont._of \(DID_{i}^{X}\) using the Industrial Internet Identification System. If valid, it computes the pseudonymous identity \(PDID_{i}^{X}=h(DID_{i}^{X}||SK_{EG_{i}^{X}})\) for the device \(D_{i}^{X}\). The edge gateway then uploads \(\{PDID_{i}^{X},PK_{D_{i}^{X}}\}\) to the blockchain via its associated anchor node \(AN_{i}^{X}\). This allows anchor nodes in other domains to retrieve the registration information of the device using its pseudonymous identifier. The pseudonymous identity is periodically updated to prevent continuous tracking by potential attackers. The update interval can be adjusted flexibly based on the specific context.  
Edge Gateway \(EG_{i}^{X}\) then sends the pseudonymous identity \(PDID_{i}^{X}\) back to Device \(D_{i}^{X}\). Upon receiving the response, the device locally stores the tuple \(\{SK_{D_{i}^{X}},PK_{D_{i}^{X}},PDID_{i}^{X}\}\).  
This initialization phase establishes the trust foundation for subsequent mutual authentication and secure communication between industrial devices, edge gateways, and cross-domain nodes.