## 2 Related Work
### Cross-Domain Authentication Based on PKI and Blockchain  
Although traditional Public Key Infrastructure (PKI) has played a pivotal role in digital identity authentication, its reliance on centralized Certificate Authorities (CAs) exposes it to a series of inherent weaknesses [6]. As the sole trust anchors, CAs represent single points of failure--once compromised, either by attack, mismanagement, or negligence,the entire authentication system becomes vulnerable. Moreover, PKI implementations vary widely across organizations and platforms, making cross-domain identity authentication prone to issues such as certificate incompatibility, inconsistent trust anchor configurations, and mismatched key management protocols. These inconsistencies often result in failed authentications, insecure fallback mechanisms, or increased administrative burden. A common approach to addressing the above issue is to involve a third-party Certificate Authority (CA) to handle authentication in cross-domain communications. However, this solution poses practical challenges, as it may introduce security risks like collusion, lack of fairness, and vulnerability to single points of failure. To address these structural limitations, growing research interest has turned to blockchain as a foundation for decentralized authentication architectures. Due to its immutable and consensus-driven design, blockchain can serve as a shared ledger for recording identity information, thereby reducing dependence on any single CA and mitigating the systemic risks of centralized trust. Guided by this idea, many researchers have proposed blockchain-based cross-domain authentication schemes. For example, [PERSON] et al. [7] designed a consortium-based CA collaboration model using blockchain to eliminate isolated trust silos. Similarly, [PERSON] et al. [8] proposed the BCAE scheme, which replaces traditional CA-signed X.509 certificates with blockchain-based credentials, improving identity consistency and interoperability across domains. [PERSON] et al. [9] proposed CCAP, a complete cross-domain authentication based on consortium blockchain for the Internet of Things. They introduce verification servers to form a consortium blockchain, assisting authentication servers (i.e., CAs) in enabling secure cross-domain authentication between IoT domains with different configurations. [PERSON] et al. [10; 11] utilized blockchain-based mechanisms maintained by edge servers to allow for mutual authentication without central CAs and combine smart contracts and dynamic accumulators to optimize communication and computation during the authentication process. [PERSON] et al. [12] introduced smart contracts in vehicular networks to manage certificate lifecycles autonomously, reducing the administrative workload and improving the responsiveness of revocation and renewal operations. [PERSON] et al. [13] presented a blockchain-based Public Key Infrastructure (PKI) framework named ProofChain. It aims to decentralize the CA pool and ensure compatibility with X.509 standards. [PERSON] et al. [14] presented a blockchain-enhanced hybrid authentication framework for vehicular networks. In their scheme, Certificate Authorities (CAs) handle initial identity issuance, while blockchain supports cross-domain credential verification and pseudonym lifecycle management. The framework enables real-time coordination among CAs via blockchain. However, despite these improvements, blockchain-based PKI systems also introduce new layers of complexity. First, existing consensus mechanisms (such as PoW (Proof of Work) [37], PoS (Proof of Stake) [38], or PBFT (Practical Byzantine Fault Tolerance) [39]) often bring significant computational and latency overhead, especially in high-frequency authentication scenarios. Second, blockchain's inherently transparent nature conflicts structurally with the need for privacy. Thirdly, blockchain's append-only nature leads to increased storage overhead. To solve these problems, [PERSON] et al. [15] observed this bottleneck.