# A Blockchain Network Admission Control Mechanism Using Anonymous Identity-Based Cryptography
## 1 Introduction  
Blockchain is a distributed ledger technology that ensures the immutability and credibility of data through cryptography and consensus mechanisms. According to the access control mechanism for participating nodes, blockchain can be divided into permissionless blockchains and permissioned blockchains. Permissioned blockchains can be further categorized into consortium blockchains and private blockchains. Examples include Hyperledger Fabric [1] and R3 Corda [2]. Permissioned blockchains are widely used in supply chain management [3, 4], financial transactions [5, 6], medical data sharing [7, 8], and other scenarios. The core components of the permissioned chain are validating nodes, which are responsible for receiving user transactions and reaching data consistency through a consensus mechanism. However, these nodes are vulnerable to some kinds of attacks. In CA-based permissioned blockchains, an attacker may compromise the certificate authority to issue fraudulent certificates [9, 10]. Other threats include forged transaction submissions, where attackers exploit weaknesses in transaction validation to introduce malicious transactions [11]. Additionally, DDoS attacks flood validating nodes with excessive traffic, preventing them from processing legitimate transactions or participating in the consensus process [12]. An important reason for the above issues lies in the lack of appropriate admission control at the network layer. Many permissioned blockchains rely on digital certificates or consensus mechanisms to validate transactions and node behavior, but fail to restrict theaccess sources of nodes or users at the network level. Validating nodes frequently expose open network interfaces, enabling unauthorized connection attempts and increasing the attack surface. Moreover, the complexity of dynamic network environments, such as dynamic IP addresses and the widespread use of mobile devices, renders simple network layer verification or whitelisting inadequate to meet practical needs. In large-scale permissioned chains, maintaining and expanding the whitelist is particularly complex, as it requires ensuring that each new member node or user is correctly added to the whitelist while guaranteeing that updates do not compromise system performance or weaken security. To address the aforementioned issues, we propose a network layer admission mechanism based on SM9. As part of China's commercial cryptography system, the SM9 algorithm is an identity-based cryptographic system [13]. Specifically, following the concept of separation mechanisms, we generate multi-level anonymous identifiers for a blockchain user and distribute the private key generation for the final-level identifier. This approach maximizes the anonymity of the identifier to meet the privacy protection requirements of blockchain systems. The final-level anonymous identifier serves as an anonymous credential for blockchain admission and is carried in the options field of the network layer's IP protocol. This credential only proves that the initiator is a legitimate user within the blockchain, without revealing their true identity. Validating nodes use this credential to add the initiator to a dynamic whitelist. Subsequently, the validating nodes can filter traffic at the network layer. In summary, our contributions are as follows. We propose a network admission control mechanism based on identity-based cryptography, addressing a critical gap in blockchain network admission control. This approach enhances privacy and security by combining the use of anonymous identifiers and decentralized private key generation, ensuring user authenticity while protecting user privacy. A dynamic whitelist mechanism is introduced to adapt to evolving network conditions, overcoming the limitations of static methods in dynamic environments. The proposed signature generation and verification processes improve efficiency by 37% and 49%, respectively, compared to existing solutions. The remainder of this paper is organized as follows: Section 2 reviews the related work.