去中心化公钥基础设施综述

史晁铭; 闫峥; 张滋烔; 王海光; 李铁岩

doi:10.11959/j.issn.2096-109x.2025064

您当前的位置：

首页 >

文章列表页 >

去中心化公钥基础设施综述

综述 | 更新时间：2026-01-28

- 去中心化公钥基础设施综述
- Survey of decentralized public key infrastructure
- 网络与信息安全学报 2025年11卷第6期页码：17-35
- 作者机构：
  
  1.西安电子科技大学网络与信息安全学院，陕西西安 710126
  2.西安电子科技大学空天地一体化综合业务网全国重点实验室，陕西西安 710071
  3.华为技术有限公司可信技术实验室谢尔德实验室，新加坡 238895
- 作者简介：
  
  [ "史晁铭（1998- ），男，河南郑州人，西安电子科技大学博士生，主要研究方向为区块链、去中心化基础设施。" ]
  [ "闫峥（1972- ），女，安徽亳州人，博士，西安电子科技大学教授、博士生导师，主要研究方向为信任管理、可信AI、隐私保护、网络安全。" ]
  [ "张滋烔（2000- ），男，河北石家庄人，西安电子科技大学硕士生，主要研究方向为区块链、分布式与并行计算。" ]
  [ "王海光（1973- ），男，内蒙古乌拉特前旗人，博士，华为技术有限公司高级研究员，主要研究方向为5G/6G网络安全技术、可信网络、公钥基础设施证书管理。" ]
  [ "李铁岩（1971- ），男，天津人，博士，华为技术有限公司高级工程师，主要研究方向为网络安全、数字身份与数据空间安全。" ]
- 基金信息：
  
  国家自然科学基金(U23A20300;62072351);陕西省自然科学基础研究计划重点基金(2023-JC-ZD-35)
- DOI：10.11959/j.issn.2096-109x.2025064
  中图分类号： TP393
- 收稿：2025-02-12，
  
  修回：2025-06-22，
  
  纸质出版：2025-12-25
- 稿件说明：
移动端阅览
史晁铭, 闫峥, 张滋烔, 等. 去中心化公钥基础设施综述[J]. 网络与信息安全学报, 2025, 11(6): 17-35.

SHI Chaoming, YAN Zheng, ZHANG Zitong, et al. Survey of decentralized public key infrastructure[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 17-35.
史晁铭, 闫峥, 张滋烔, 等. 去中心化公钥基础设施综述[J]. 网络与信息安全学报, 2025, 11(6): 17-35. DOI： 10.11959/j.issn.2096-109x.2025064.

SHI Chaoming, YAN Zheng, ZHANG Zitong, et al. Survey of decentralized public key infrastructure[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 17-35. DOI： 10.11959/j.issn.2096-109x.2025064.

摘要

公钥基础设施作为网络与信息安全领域的重要组成部分，在数字身份认证、安全数据传输和完整性保护等场景发挥着关键作用。然而，传统公钥基础设施的中心化架构存在显著缺陷：用户完全依赖可信第三方机构，导致个人数据控制权被削弱，并引发单点故障、隐私泄露、中间人攻击等系统性风险，难以满足分布式网络环境的安全需求。为解决上述问题，去中心化公钥基础设施利用区块链技术实现去中心化的信任分布，有效消除单点故障风险；分布式账本技术使用户在进行身份验证时无须暴露过多的身份信息，降低隐私泄露的风险，同时其公开透明与不可篡改性可抵御数据窃取与身份伪造攻击，从而全面提升系统安全性与可靠性。系统梳理去中心化公钥基础设施的核心理论和技术基础，继而基于网络拓扑结构和信任管理模式，构建一个全面且系统的去中心化公钥基础设施分类框架。提出涵盖安全性、隐私性、性能以及其他维度的一系列评估指标，并根据提出的评估指标对现有的去中心化公钥基础设施方法进行回顾和分析。总结现有的去中心化公钥基础设施方法所面临的问题，并对未来趋势与研究方向进行展望。

Abstract

Public key infrastructure is an essential component in the field of network and information security

serving a critical role in scenarios such as digital identity authentication

secure data transmission

and integrity protection. However

the centralized architecture of traditional public key infrastructure has significant flaws

requiring users to fully rely on trusted third-party organizations

which undermines users' control over their personal data and leads to issues such as single point of failure

privacy leakage

and man-in-the-middle attack threats

thus making it difficult to adapt to the security demands of distributed network environments. To address these issues

decentralized public key infrastructure employs blockchain technology to achieve a decentralized distribution of trust

effectively eliminating the risk of single points of failure. Distributed ledger technology enables users to authenticate their identities while minimizing the exposure of personal information

thereby reducing the risk of privacy breaches. Furthermore

its transparency and immutability enhance protection against data theft and identity forgery

significantly improving the security and reliability of the system. The core theories and technological foundations of decentralized public key infrastructure are outlined. A comprehensive and systematic classification framework for decentralized public key infrastructure is constructed based on network topology and trust management models. A series of evaluation criteria encompassing security

privacy

performance

and other dimensions is proposed

and existing methods of decentralized public key infrastructure are reviewed and analyzed according to the proposed criteria. Finally

the challenges faced by current decentralized public key infrastructure methods are summarized

and insights into future trends and research directions are provided.

关键词

Keywords

references

MAURER U . Modelling a public-key infrastructure [C ] // Computer Security—ESORICS 96 . Berlin : Springer , 1996 : 325 - 350 .

NAOR M , NISSIM K . Certificate revocation and certificate update [J ] . IEEE Journal on Selected Areas in Communications , 2000 , 18 ( 4 ): 561 - 570 .

MYERS M , ANKNEY R , MALPANI A , et al . X. 509 Internet public key infrastructure online certificate status protocol-OCSP [R ] . RFC 2560 , 1999 .

SQUAREPANTS S . Bitcoin: a peer-to-peer electronic cash system [J ] . SSRN Electronic Journal , 2008 .

WANG D , WANG P . Two birds with one stone: two-factor authentication with security beyond conventional bound [J ] . IEEE Transactions on Dependable and Secure Computing , 2018 , 15 ( 4 ): 708 - 722 .

JIANG Q , ZHANG N , NI J B , et al . Unified biometric privacy preserving three-factor authentication and key agreement for cloud-assisted autonomous vehicles [J ] . IEEE Transactions on Vehicular Technology , 2020 , 69 ( 9 ): 9390 - 9401 .

王菲菲 , 汪定 . 基于雾计算的智能医疗三方认证与密钥协商协议 [J ] . 软件学报 , 2023 , 34 ( 7 ): 3272 - 3291 .

WANG F F , WANG D . Fog computing-based three-party authentication and key agreement protocol for smart healthcare [J ] . Journal of Software , 2023 , 34 ( 7 ): 3272 - 3291 .

KARAARSLAN E , ADIGUZEL E . Blockchain based DNS and PKI solutions [J ] . IEEE Communications Standards Magazine , 2018 , 2 ( 3 ): 52 - 57 .

MOCKAPETRIS P , DUNLAP K J . Development of the domain name system [C ] // Symposium Proceedings on Communications Architectures and Protocols . New York : ACM , 1988 : 123 - 133 .

LAU F , RUBIN S H , SMITH M H , et al . Distributed denial of service attacks [C ] // Proceedings of the SMC 2000 Conference Proceedings . 2000 IEEE International Conference on Systems, Man and Cybernetics . Cybernetics Evolving to Systems, Humans, Organizations, and Their Complex Interactions. Piscataway : IEEE Press , 2000 : 2275 - 2280 .

STEINHOFF U , WIESMAIER A , ARAÚJO R . The state of the art in DNS spoofing [C ] // Proceedings of the 4th International Conference on Applied Cryptography and Network Security (ACNS 2006) . Berlin : Springer , 2006 : 238 - 252 .

SON S , SHMATIKOV V . The hitchhiker’s guide to DNS cache poisoning [C ] // Security and Privacy in Communication Networks . Berlin : Springer , 2010 : 466 - 483 .

RAVLIJA D . PKIs based on blockchains [D ] . Stuttgart : University of Stuttgart , 2019 .

BRUNNER C , KNIRSCH F , UNTERWEGER A , et al . A comparison of blockchain-based PKI implementations [C ] // Proceedings of the 6th International Conference on Information Systems Security and Privacy (ICISSP 2020) . Setúbal : Scitepress , 2020 : 333 - 340 .

DE KLERK L . Blockchain-based DNS and PKI to solve issues of trust, security and censorship in the context of the IoT [C ] // Proceedings of the 2022 IEEE Region 10 Symposium (TENSYMP) . Singapore : IEEE , 2022 : 1 - 6 .

MALDONADO-RUIZ D , TORRES J , MADHOUN N , et al . Current trends in blockchain implementations on the paradigm of public key infrastructure: a survey [J ] . IEEE Access , 2022 , 10 : 17641 - 17655 .

KHAN S , LUO F , ZHANG Z , et al . Survey on issues and recent advances in vehicular public key infrastructure (VPKI) [J ] . IEEE Communications Surveys & Tutorials , 2022 , 24 ( 3 ): 1574 - 1601 .

KARTHA N . An overview of distributed public key infrastructures (DPKIs) [EB ] . 2022 .

PORTMANN C , RENNER R . Security in quantum cryptography [J ] . Reviews of Modern Physics , 2022 , 94 ( 2 ): 025008 .

KHAN S , LUO F , ZHANG Z J , et al . A survey on X.509 public-key infrastructure, certificate revocation, and their modern implementation on blockchain and ledger technologies [J ] . IEEE Communications Surveys & Tutorials , 2023 , 25 ( 4 ): 2529 - 2568 .

COOPER D , SANTESSON S , FARRELL S , et al . Internet X. 509 public key infrastructure certificate and certificate revocation list (CRL) profile [R ] . RFC 5280 , 2008 .

FREIER A , KARLTON P , KOCHER P . The secure sockets layer (SSL) protocol version 3.0 [R ] . RFC 6101 , 2011 .

DIERKS T , RESCORLA E . The transport layer security (TLS) protocol version 1.2 [R ] . RFC 5246 , 2008 .

HOUSLEY R . Cryptographic message syntax [R ] . RFC 2630 , 1999 .

ZIMMERMANN PR . The official PGP user's guide [M ] . Cambridge, MA : MIT Press , 1995 .

MELARA M S , BLANKSTEIN A , BONNEAU J , et al . CONIKS: Bringing key transparency to end users [C ] // Proceedings of the 24th USENIX Security Symposium . Washington, D C : USENIX Association , 2015 : 383 - 398 .

SZYDLO M . Merkle tree traversal in log space and time [C ] // Proceedings of the Advances in Cryptology – EUROCRYPT 2004: International Conference on the Theory and Applications of Cryptographic Techniques . Berlin : Springer , 2004 : 541 - 554 .

AXON L , GOLDSMITH M . PB-PKI: a privacy-aware blockchain-based PKI [C ] // Proceedings of the 14th International Conference on Security and Cryptography (SECRYPT 2017) . Madrid, Spain : SciTePress , 2017 : 311 - 318 .

REED D , LAW J , HARDMAN D . The technical foundations of sovrin : a white paper from the sovrin foundation [EB ] . 2016 .

LUNDKVIST C , HECK R , TORSTENSSON J , et al . Uport: a platform for self-sovereign identity [EB ] . 2016 .

MÜHLE A , GRÜNER A , GAYVORONSKAYA T , et al . A survey on essential components of a self-sovereign identity [J ] . Computer Science Review , 2018 , 30 : 80 - 86 .

REED D , SPURNY M , LONGLEY D , et al . Decentralized identifiers (DIDs) v1.0 [S ] . W3C Recommendation, 2020 .

ZHENG Z B , XIE S A , DAI H N , et al . An overview of blockchain technology: architecture, consensus, and future trends [C ] // Proceedings of the 2017 IEEE International Congress on Big Data (BigData Congress) . Piscataway : IEEE Press , 2017 : 557 - 564 .

YAN Z , ZHANG P , VASILAKOS A V . A survey on trust management for Internet of things [J ] . Journal of Network and Computer Applications , 2014 , 42 : 120 - 134 .

BONNEAU J , HERLEY C , VAN OORSCHOT P C , et al . The quest to replace passwords: a framework for comparative evaluation of web authentication schemes [C ] // Proceedings of the 2012 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2012 : 553 - 567 .

WANG D , LI W T , WANG P . Measuring two-factor authentication schemes for real-time data access in industrial wireless sensor networks [J ] . IEEE Transactions on Industrial Informatics , 2018 , 14 ( 9 ): 4081 - 4092 .

SYVERSON P . A taxonomy of replay attacks [cryptographic protocols[C ] // Proceedings of the Computer Security Foundations Workshop VII . Piscataway : IEEE Press , 1994 : 187 - 191 .

ADKINS H . An update on attempted man-in-the-middle attacks [EB ] . 2011 .

SAAD M , SPAULDING J , NJILLA L , et al . Exploring the attack surface of blockchain: a comprehensive survey [J ] . IEEE Communications Surveys & Tutorials , 2020 , 22 ( 3 ): 1977 - 2008 .

LAURIE B . Certificate transparency [J ] . Queue , 2014 , 12 ( 8 ): 10 - 19 .

WEN Y H , LIU M X , YANG X W , et al . BUA: a blockchain-based unlinkable authentication scheme for mobile IoT [J ] . Enterprise Information Systems , 2024 , 18 ( 2 ).

REBELLO G A F , CAMILO G F , DE SOUZA L A C , et al . A survey on blockchain scalability: from hardware to layer-two protocols [J ] . IEEE Communications Surveys & Tutorials , 2024 , 26 ( 4 ): 2411 - 2458 .

BARNES R , HOFFMAN-ANDREWS J , MCCARNEY D , et al . Automatic certificate management environment (ACME) [R ] . RFC 8555 ， 2019 .

WANG Z , LIN J Q , CAI Q W , et al . Blockchain-based certificate transparency and revocation transparency [C ] // Proceedings of the Financial Cryptography and Data Security . Berlin : Springer , 2019 : 144 - 162 .

LOIBL A , NAAB J . Namecoin [EB ] . 2014 .

TOORANI M , GEHRMANN C . A decentralized dynamic PKI based on blockchain [C ] // Proceedings of the 36th Annual ACM Symposium on Applied Computing . New York : ACM , 2021 : 1646 - 1655 .

REN Y J , LIU X Y , WU Q , et al . Cryptographic accumulator and its application: a survey [J ] . Security and Communication Networks , 2022 ( 1 ): 5429195 .

AL-BASSAM M . SCPKI: a smart contract-based PKI and identity system [C ] // Proceedings of the ACM Workshop on Blockchain, Cryptocurrencies and Contracts . New York : ACM , 2017 : 35 - 40 .

YAKUBOV A , SHBAIR W , STATE R . BlockPGP: a blockchain-based framework for PGP key servers [C ] // Proceedings of the 2018 Sixth International Symposium on Computing and Networking Workshops (CANDARW) . Piscataway : IEEE Press , 2018 : 316 - 322 .

GARFINKEL S . PGP: pretty good privacy [M ] . O'Reily Media Inc , 1995 .

TOMESCU A , DEVADAS S . Catena: efficient non-equivocation via Bitcoin [C ] // Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2017 : 393 - 409 .

MELARA M S , BLANKSTEIN A , BONNEAU J , et al . CONIKS: Bringing Key Transparency to End Users [C ] // Proceedings of the 24th USENIX Security Symposium . Washington, D C : USENIX Association , 2015 : 383 - 398 .

DONG Y H , KIM W , BOUTABA R . Conifer: centrally-managed PKI with blockchain-rooted trust [C ] // Proceedings of the 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) . Piscataway : IEEE Press , 2018 : 1092 - 1099 .

YAKUBOV A , SHBAIR W M , WALLBOM A , et al . A blockchain-based PKI management framework [C ] // Proceedings of the NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium . Piscataway : IEEE Press , 2018 : 1 - 6 .

KUBILAY M Y , KIRAZ M S , ALI MANTAR H . CertLedger: a new PKI model with certificate transparency based on blockchain [J ] . Computers & Security , 2019 , 85 : 333 - 352 .

JOSEPH ANTONY A , SINGH K . A blockchain-based public key infrastructure for IoT-based healthcare systems [J ] . The Computer Journal , 2024 , 67 ( 4 ): 1531 - 1537 .

AKRAM J , ANAISSI A . Decentralized PKI framework for data integrity in spatial crowdsourcing drone services [C ] // Proceedings of the 2024 IEEE International Conference on Web Services (ICWS) . Piscataway : IEEE Press , 2024 : 643 - 653 .

CHEN J , YAO S X , YUAN Q , et al . CertChain: public and efficient certificate audit based on blockchain for TLS connections [C ] // Proceedings of the IEEE INFOCOM 2018 - IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2018 : 2060 - 2068 .

TARKOMA S , ROTHENBERG C E , LAGERSPETZ E . Theory and practice of bloom filters for distributed systems [J ] . IEEE Communications Surveys & Tutorials , 2012 , 14 ( 1 ): 131 - 155 .

QIN B , HUANG J K , WANG Q , et al . Cecoin: a decentralized PKI mitigating MitM attacks [J ] . Future Generation Computer Systems , 2020 , 107 : 805 - 815 .

FRANKLIN M K , REITER M K . Fair exchange with a semi-trusted third party [C ] // Proceedings of the 4th ACM Conference on Computer and Communications Security . New York : ACM , 1997 : 1 - 5 .

FEI S F , YAN Z , WANG D L , et al . B5G-NFM: blockchain-based 5G network function management with enhanced security and privacy [J ] . IEEE Transactions on Networking , 2025 , 33 ( 3 ): 1128 - 1143 .

BENET J . Ipfs-content addressed, versioned, P2P file system [J ] . arXiv preprint arXiv: 1407.3561 , 2014 .

LI H Z , CHEN Y J , SHI X , et al . FISCO-BCOS: an enterprise-grade permissioned blockchain system with high-performance [C ] // Proceedings of the SC23: International Conference for High Performance Computing, Networking, Storage and Analysis . Piscataway : IEEE Press , 2023 : 1 - 17 .

INTERNATIONAL TELECOMMUNICATION UNION . 8th revised baseline text for X.DPKI: decentralized public key infrastructure [R ] . Geneva : ITU-T , 2023 .

EZUGWU A E , IKOTUN A M , OYELADE O O , et al . A comprehensive survey of clustering algorithms: State-of-the-art machine learning applications, taxonomy, challenges, and future research prospects [J ] . Engineering Applications of Artificial Intelligence , 2022 , 110 : 104743 .

KASNECI E , SESSLER K , KÜCHEMANN S , et al . ChatGPT for good？ On opportunities and challenges of large language models for education [J ] . Learning and Individual Differences , 2023 , 103 : 102274 .

李凤华 , 李晖 , 贾焰 , 等 . 隐私计算研究范畴及发展趋势 [J ] . 通信学报 , 2016 , 37 ( 4 ): 1 - 11 .

LI F H , LI H , JIA Y , et al . Privacy computing: concept, connotation and its research trend [J ] . Journal on Communications , 2016 , 37 ( 4 ): 1 - 11 .

ZHANG F G , KIM K . ID-based blind signature and ring signature from pairings [C ] // Proceedings of the Advances in Cryptology—ASIACRYPT 2002 . Berlin : Springer , 2002 : 533 - 547 .

LIU X M , XIE H M , YAN Z , et al . A survey on blockchain sharding [J ] . ISA Transactions , 2023 , 141 : 30 - 43 .

GUDGEON L , MORENO-SANCHEZ P , ROOS S , et al . SoK: layer-two blockchain protocols [C ] // Proceedings of the Financial Cryptography and Data Security . Cham : Springer , 2020 : 201 - 226 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于SM2数字签名算法的环适配器签名方案

基于SM3的变色龙哈希函数及其应用

基于GR算法的区块链智能合约漏洞检测

信誉驱动的区块链分片共识及激励机制设计

基于信任度评估的分布式算力交易方案