标题： 基于许可区块链的去中心化漏洞披露：一种安全透明的集中式CVE管理替代方案 显示英文标题

标题： Decentralized Vulnerability Disclosure via Permissioned Blockchain: A Secure, Transparent Alternative to Centralized CVE Management

摘要： 本文提出了一种去中心化的、基于区块链的系统，用于发布常见漏洞和暴露（CVE），旨在缓解目前主要由MITRE监督的集中式模型的局限性。所提出的架构利用了许可型区块链，在其中只有经过认证的CVE编号机构（CNA）被授权提交条目。这确保了受控的写访问权限，同时保持了公共透明度。通过结合智能合约，该系统支持关键功能，如限制披露和分散治理。我们将所提出的模型与现有实践进行了比较，并突出了其在透明度、信任分散化和可审计性方面的优势。我们还展示了一个使用Hyperledger Fabric的原型实现，以证明这种方法的可行性，并讨论了它对未来漏洞披露的影响。 显示英文摘要

摘要： This paper proposes a decentralized, blockchain-based system for the publication of Common Vulnerabilities and Exposures (CVEs), aiming to mitigate the limitations of the current centralized model primarily overseen by MITRE. The proposed architecture leverages a permissioned blockchain, wherein only authenticated CVE Numbering Authorities (CNAs) are authorized to submit entries. This ensures controlled write access while preserving public transparency. By incorporating smart contracts, the system supports key features such as embargoed disclosures and decentralized governance. We evaluate the proposed model in comparison with existing practices, highlighting its advantages in transparency, trust decentralization, and auditability. A prototype implementation using Hyperledger Fabric is presented to demonstrate the feasibility of the approach, along with a discussion of its implications for the future of vulnerability disclosure.