## 2 Related Work
### Cross-Domain Authentication Based on CL-PKC and Blockchain  
Certificateless Public Key Cryptography (CL-PKC) presents a compelling alternative to traditional PKI and identity-based encryption (IBE) by eliminating certificate management while preventing key escrow. In CL-PKC, a semi-trusted Key Generation Center (KGC) generates a partial private key based on the user's identity. This key is then combined with a user-chosen secret value to form a complete private key. Since the KGC lacks knowledge of this secret value, it cannot reconstruct the full private key, thereby mitigating the inherent trust risks associated with IBE. Additionally, CL-PKC-based authentication systems do not rely on digital certificates, reducing administrative complexity and improving scalability in large-scale distributed systems. However, CL-PKC has its limitations. The partial trust assumption on the KGC still poses a security concern--particularly in adversarial or multi-domain environments. To overcome these shortcomings, researchers have explored a variety of blockchain-integrated CL-PKC frameworks that distribute trust and improve operational efficiency. For example, [PERSON] et al. [28] introduced ECB-CLS, an authentication scheme for the automatic dependent surveillance broadcast (ADS-B) systems, combining blockchain and certificateless signatures to eliminate certificate management. It integrates blockchain for decentralized key management, mitigating single points of failure. [PERSON] et al. [29] developed an enhanced certificateless authentication and key agreement (CL-AKA) protocol based on blockchain technology in an Internet of Drones (IoD) environment. The protocol achieves resistance to key compromise impersonation attacks. [PERSON] et al. [30] presented a revocable certificateless cross-domain authentication scheme leveraging a primary-secondary blockchain model. The scheme enhances cross-domain authentication efficiency and security by eliminating complex certificate management and mitigating centralized authority issues using the primary-secondary blockchain model. [PERSON] et al. [31] proposed a cross-domain authentication method (CABC) that integrates blockchain with certificateless signatures for Industrial Internet of Things (IIoT) devices. CABC enables trusted authentication across different management domains (e.g., factories) and supports decentralized identity verification, thereby eliminating the reliance on trusted third parties and centralized servers. [PERSON] et al. [32] proposed a blockchain-based certificateless conditional anonymous authentication scheme (BCCA) for the Industrial Internet of Things (IIoT). The BCCA enables traceability and user revocation with a chameleon hash algorithm for illegal information rectification on the evidence blockchain, aiming to mitigate security threats such as forgery, man-in-the-middle, and replay attacks. [PERSON] et al. [33] developed a certificate-free, blockchain-enabled cross-domain authentication scheme tailored for the Industrial Internet. Their method relies on an Ethereum consortium blockchain to serve as a trusted foundation across various regions. Within each region, industrial entities collaborate with a local Key Generation Center to produce users' private keys, thereby addressing the key escrow issue. [PERSON] et al. [34] introduced a blockchain-assisted certificate-less anonymous cross-domain authentication scheme for the Internet of Vehicles (IoVs). By leveraging blockchain, the approach minimizes redundant authentication overhead. The proposed scheme guarantees message integrity, supports traceability, and defends against multiple types of attacks. Although existing research has made considerable progress in addressing the challenges introduced by integrating blockchain into CL-PKC systems, a fundamental issue remains. Similar to IBA, CL-PKC inherently uses the user's identity as part of the public key [28; 29; 30; 31; 32; 33; 34], which poses significant privacy risks. To mitigate these risks, additional privacy-preserving mechanisms are required.