Zero-knowledge proof generation method for optimizing resource utilization

Abstract

The invention discloses a zero-knowledge proof generation method for optimizing resource utilization, which comprises automatic division of a zero-knowledge proof circuit and parallel execution of a configurable pipeline of a sub-circuit, and aims to solve the problems of high memory consumption and low resource utilization rate of a zero-knowledge proof system. The method comprises the following steps: firstly, automatically dividing a complex zero-knowledge proof circuit into a plurality of sub-circuits, ensuring that the calculation process of the sub-circuits can be completed in series through public shared variables, and reducing memory occupation in a proof generation process; and secondly, by decoupling a witness generation stage and a proof calculation stage and introducing a pipeline processing mode, witness generation and proof calculation between sub-circuits are enabled to be independent and coordinated and executed in parallel, the resource utilization rate is optimized, and the degree of parallelism can be adjusted to adapt to different scene requirements. According to the method, the memory use of the zero-knowledge proof system is effectively reduced, and the resource utilization rate and the proof generation efficiency are remarkably improved under the controllable memory condition, so that the overall performance and the expandability of the system are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of zero-knowledge proof, and in particular relates to a method for generating zero-knowledge proof that optimizes resource utilization and is efficient. Background Art

[0002] Zero-knowledge proof (ZKP) protocols are a class of cryptographic protocols that allow a prover to prove the truth of a statement to a verifier without revealing any underlying information. This powerful property makes ZKP the foundation of privacy protection technology. Among the many ZKP systems, Zero-knowledge Succinct Non-interactive Argument of Knowledge (ZK-SNARK) has become one of the most widely used solutions due to its efficiency and simplicity. The advantage of ZK-SNARK is that it allows the interaction in the proof and verification process to be minimized, and even in the face of complex calculations, the generated proof is very small. These characteristics make ZK-SNARK particularly suitable for verifiable computing application scenarios.

[0003] Although ZK-SNARK's proofs are concise and verification is efficient, the process of generating proofs is still a major challenge that hinders its large-scale application. For a certain zero-knowledge proof generation process, it can usually be divided into two key steps: witness generation and proof calculation. The former is responsible for generating intermediate variables (witness values) that satisfy the constraint system from the circuit input. This step usually requires processing a large number of highly dependent calculations, and the generation of each intermediate result depends on the previous calculation results, resulting in poor parallelization capabilities for witness generation. Proof calculation depends on the result of witness generation and must wait until the witness generation is completed. It usually requires a large number of arithmetic operations to be performed on a large-scale finite field, resulting in the time required to generate proofs far exceeding the time required for verification, and the computational complexity brings significant overhead. Many existing works have optimized the proof calculation process in the proof generation process through algorithm improvement or hardware acceleration, which has significantly improved its time overhead and resource utilization; but as another key process, witness generation has gradually become a bottleneck for system performance improvement and resource utilization, seriously affecting the overall efficiency and scalability of the entire system.

[0004] In addition to the parallelism problem of witness generation, the zero-knowledge proof generation system also faces huge memory pressure during the proof generation process. Whether it is witness generation or proof calculation, a large amount of memory is required to store intermediate calculation results and circuit constraint systems, and as the complexity of the circuit increases, the memory demand will increase significantly. Especially when processing complex circuits or generating large-scale proofs, memory consumption may cause the system to be unable to handle multiple tasks at the same time, thereby limiting the parallel capability of the system, and even excessive memory usage may cause the system to be unable to successfully complete proof generation when resources are tight. Therefore, how to optimize memory usage and reduce memory usage during proof generation has become a key challenge for whether the ZK-SNARK system can handle complex circuits and large-scale proof generation. Summary of the invention

[0005] The purpose of the present invention is to design a zero-knowledge proof generation method that optimizes resource utilization, and solves the bottleneck problems of existing zero-knowledge proof systems in terms of memory usage and proof generation efficiency through automatic division of zero-knowledge proof circuits and configurable pipeline execution of sub-circuits. The present invention fully considers the characteristics of existing zero-knowledge proof generation technologies, such as the high coupling of witness generation and proof calculation, the high resource utilization of witness generation, and the large overall memory usage. Through the present invention, the system memory overhead can be effectively reduced and the resource utilization can be improved, especially in the continuous generation scenario of large-scale circuit proofs, which can significantly improve the overall performance and scalability of the system. The present invention is widely applicable to various verifiable calculations and other application scenarios that require efficient proof generation.

[0006] The specific technical solution for achieving the purpose of the present invention is:

[0007] A method for generating zero-knowledge proofs for optimizing resource utilization, including a method for automatically partitioning a zero-knowledge proof circuit and a method for configurable pipeline parallel execution of subcircuits; wherein:

[0008] The method for automatically dividing the zero-knowledge proof circuit is to divide the zero-knowledge proof circuit into a number of serializable sub-circuits, and to open the dependent calculation results between the sub-circuits as shared variables to complete the independent calculation of each sub-circuit, thereby reducing the memory usage in the proof generation process, thereby reducing the scalability limitation problem of the zero-knowledge proof system caused by memory problems;

[0009] The configurable pipeline parallel execution method of the sub-circuit is to decouple the witness generation stage and the proof calculation stage in the zero-knowledge proof generation process, and introduce a pipeline processing mode with configurable parallel granularity, so that the witness generation and proof calculation stages between the sub-circuits are independent of each other and coordinated and executed in parallel, so as to improve the resource utilization in the whole process, and at the same time, the pipeline parallel granularity can be flexibly adjusted to adapt to various different scenarios more flexibly.

[0010] The zero-knowledge proof circuit automatic partitioning method specifically includes:

[0011] Step A1: Convert the constraint system corresponding to the zero-knowledge proof circuit into a constraint dependency graph CDG, calculate the out-degree and depth of each node, and obtain all constraints without post-constraints for subsequent traversal;

[0012] Step A2: Use the out-degree and depth of the node as the priority calculation method to perform a post-order traversal of the CDG, assigning partitions to the nodes during the traversal process;

[0013] Step A3: After the traversal is completed, the obtained partitions are restored to the zero-knowledge proof subcircuit constraint system, and the shared variables between the subcircuits and the dependencies between the subcircuits are obtained;

[0014] The configurable pipeline parallel execution method of the sub-circuit specifically comprises:

[0015] Step B1: Initialize the witness generation and proof calculation queues, and set the maximum number of parallel witness generation and proof calculation respectively;

[0016] Step B2: According to the sub-circuit dependencies, add all sub-circuits without pre-dependencies of the proof tasks to be calculated to the witness generation queue;

[0017] Step B3: When the witness generation queue is not empty, according to the parallel granularity limit, take out the corresponding number of sub-circuits for parallel witness generation. After the calculation is completed, add the sub-circuit to the proof calculation queue. This step is parallel to step B2;

[0018] Step B4: When the proof calculation queue is not empty, according to the parallel granularity limit, take out the corresponding number of subcircuits for proof calculation and generate the zero-knowledge proof corresponding to the subcircuits. This process is parallel to steps B2 and B3.

[0019] Step B5: Repeat steps B2 to B4 until all sub-circuit proofs for all tasks to be proved are generated.

[0020] Further, the step A1 comprises the following steps:

[0021] Step A11: Initialize the constraint dependency graph CDG, a directed acyclic graph, in which each vertex represents a constraint or input, and each edge represents that an input or the output of a constraint is used as the input of another constraint, that is, there is a dependency relationship between the constraints or inputs represented by the two vertices;

[0022] Step A12: traverse all inputs in the constraint system corresponding to the circuit, including public inputs and private inputs, add them as vertices to the CDG, and mark the vertices as corresponding public or private input vertices;

[0023] Step A13: traverse all constraints in the constraint system corresponding to the circuit and add them as vertices to the CDG; if the constraint depends on a previous constraint or input, add the corresponding edge in the CDG and update the corresponding previous constraint out-degree; update the current constraint depth according to the depth of all previous constraints of the constraint;

[0024] Step A14: Traverse all non-input nodes in the CDG and obtain all constraints without post-constraints, that is, no constraints depend on the calculation of these constraints.

[0025] Further, the step A2 comprises the following steps:

[0026] Step A21: Initialize the current partition number to 1, and the number of nodes contained in the current partition to 0; calculate the maximum number of nodes that each partition can contain;

[0027] Step A22: Sequentially traverse all nodes that have no subsequent nodes;

[0028] Step A23: For all the preceding nodes of each node, the priority is calculated according to the out-degree and depth of these nodes, and the nodes with smaller depth are traversed first, and then the nodes with smaller out-degree are traversed secondly;

[0029] Step A24: If a node has no preceding node, if the node is an input node, assign the node to the current partition as input; otherwise, assign the node to the current partition and increase the number of nodes contained in the current partition by one; if the number of current partitions reaches the upper limit, increase the number of current partitions and reset the number of nodes contained in the current node to 0;

[0030] Step A25: Complete the traversal of all nodes and obtain all node partitions, that is, constrained partitions.

[0031] Further, the step A3 comprises the following steps:

[0032] Step A31: Initialize all subcircuit constraint systems; initialize the subcircuit dependency graph, a directed acyclic graph, in which each vertex represents a subcircuit, and each edge represents that the calculation process of a subcircuit requires another subcircuit to complete the calculation and then open the shared variables before the calculation can begin, that is, there is a dependency relationship between the two subcircuits;

[0033] Step A32: traverse all constraint partitions, each constraint partition corresponds to a subcircuit constraint system, and the input node of each partition is added as input to the subcircuit constraint system;

[0034] Step A33: traverse all constraints in the constraint partition and add the constraints to the subcircuit constraint system; if the post-constraint of a constraint does not belong to the partition, use the constraint as a shared variable between the two partitions and add the subcircuit dependency relationship in the subcircuit dependency graph;

[0035] Step A34: The traversal is completed, and all sub-circuit constraint systems and sub-circuit dependency graphs are obtained.

[0036] The beneficial effects of the present invention include:

[0037] The present invention aims to improve the performance and resource utilization of the zero-knowledge proof generation system, and focuses on designing a high-efficiency, high-resource utilization zero-knowledge proof generation method that is flexibly adapted to various scenarios. Its purpose is to enable the zero-knowledge proof system to fully utilize resources, more efficiently process proof generation requests, and improve system performance. Specifically, the present invention aims at the problem of high memory usage in the zero-knowledge proof system. The present invention designs an automatic circuit partitioning algorithm, which divides the complex ZKP circuit into multiple sub-circuits, and exposes the dependencies between the sub-circuits as shared variables to complete the independent calculation of each sub-circuit, thereby reducing the memory usage in the proof generation process, thereby further improving the flexibility of pipeline execution and avoiding the reduction of system parallelization capabilities due to memory usage issues. In view of the high coupling of witness generation and proof calculation and the low resource utilization of witness generation, a configurable pipeline parallel execution method of sub-circuits is designed to decouple witness generation from proof calculation, so that these two key processes can be executed in parallel, thereby improving system resource utilization. By adjusting the parallel granularity, the present invention can flexibly adapt according to the system resource conditions, thereby improving the overall performance of the system; by combining automatic circuit partitioning and pipeline execution mechanism, the present invention significantly improves the resource utilization and proof generation efficiency of the zero-knowledge proof generation system under the premise of controllable memory. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is an architecture diagram of the zero-knowledge proof generation method proposed by the present invention;

[0039] Figure 2 It is a schematic diagram of the automatic partitioning method of zero-knowledge proof circuit proposed by the present invention;

[0040] Figure 3 It is a schematic diagram of the configurable pipeline parallel execution method of the sub-circuit proposed by the present invention. DETAILED DESCRIPTION

[0041] The present invention is further described in detail with reference to the following specific examples and drawings. The process, conditions, experimental methods, etc. for implementing the present invention, except for the contents specifically mentioned below, are all common knowledge and common common sense in the art and are not particularly limited by the present invention.

[0042] Figure 1 The overall architecture diagram of the zero-knowledge proof generation method proposed in the present invention is shown. The present invention aims to improve the system resource utilization and proof generation efficiency, and proposes a zero-knowledge proof generation method that optimizes resource utilization and is efficient.

[0043] The zero-knowledge proof circuit automatic partitioning method proposed in the present invention can divide a complex circuit into multiple sub-circuits that can be calculated serially. These sub-circuits are connected through shared public variables to ensure that the overall calculation process can be completed correctly. Through this method, the zero-knowledge proof problem of generating the original circuit is transformed into the task of generating zero-knowledge proofs for multiple sub-circuits equivalent to the original circuit. This division not only significantly reduces the memory usage of the original circuit, but also optimizes the entire proof generation process. Although this method requires the verifier to verify multiple zero-knowledge proofs, due to the simplicity of ZK-SNARK, the overhead of verifying multiple additional proofs is almost negligible. More importantly, the automatic circuit partitioning only needs to be performed once, and subsequent proof generation requests will only change the input, while the circuit structure remains unchanged.

[0044] In the present invention, each different proof generation request is defined as a "task". Due to the dependencies between sub-circuits, witness generation must be performed in sequence. However, once the witness generation is completed, the proof calculation of the sub-circuit can be completely parallelized. Based on this feature, the present invention introduces a configurable pipeline parallel execution method for sub-circuits, which decouples the two closely related stages of witness generation and proof calculation, so that witness generation and proof calculation can be performed simultaneously between multiple tasks and between different sub-circuits within each task. In order to cope with the inconsistency of the time overhead of witness generation and proof calculation under different circuit structures or different resource configurations, the present invention designs a configurable pipeline mechanism that allows the parallel granularity of witness generation and proof calculation to be dynamically adjusted according to actual conditions. This flexibility enables the system to better adapt to different operating scenarios, ensuring that the system can exhibit higher performance and scalability when processing complex circuits and multi-tasking environments.

[0045] Figure 2 The schematic diagram of the automatic partitioning method of zero-knowledge proof circuit proposed by the present invention is shown. In order to effectively manage large-scale zero-knowledge proof circuits, the present invention converts the constraint system of the circuit into a constraint dependency graph (CDG). The CDG captures the dependencies between the constraints in the constraint system and converts the circuit partitioning problem into a graph partitioning problem. While constructing the CDG, the present invention calculates some features (out-degree and depth) of the vertices in the CDG, that is, each constraint or input, for subsequent partitioning. The construction process of the CDG is shown in Algorithm 1:

[0046]

[0047]

[0048] The specific steps include:

[0049] Step 1: First, the system initializes an empty graph G = (V, E), where V represents the node set and E represents the edge set. At the same time, the system initializes an empty array root for subsequent depth-first search (DFS) operations (Algorithm 1, lines 2-3);

[0050] Step 2: Traverse all public and private inputs. For each input x, add the corresponding input node in G and mark the node as a public or private input node according to the nature of the input (Algorithm 1, lines 4-7);

[0051] Step 3: Traverse each constraint c in the constraint set C in turn. For each constraint c, add the corresponding constraint node in G. If an input x is an input of constraint c, add an edge connecting x and c in graph G (Algorithm 1, lines 8-13);

[0052] Step 4: Traverse all constraint pairs. If the output of c_1 is the input of c_2, add an edge connecting c_1 and c_2 to graph G and update the out-degree and depth of the corresponding node (Algorithm 1, lines 14-20);

[0053] Step 5: Traverse all nodes in the graph G. If a node has no incoming edge in the graph, add it to the root node array root (Algorithm 1, lines 21-25);

[0054] Step 6: Return CDG and root for subsequent CDG partitioning (Algorithm 1, line 26).

[0055] After obtaining the CDG, the present invention uses a greedy algorithm to partition the circuit. The first core goal of the partition is to ensure that the subcircuits after the partition have the ability to be serially executed. In order to achieve this requirement, the present invention topologically sorts the CDG to ensure that in any partition, the output of the previous subcircuit does not depend on the input of the subsequent subcircuit, thereby ensuring the independence and serializability of each subcircuit. The second core goal of the partition is "balance", which is to achieve a balance between the size of the subcircuit and the number of shared variables. First, the size of the subcircuit directly affects the memory usage during the proof generation process. Larger subcircuits will occupy more memory resources, especially when dealing with large-scale circuits, which may cause system resource exhaustion. Secondly, the number of shared variables is also one of the important factors to measure the quality of the partition. Although the partitioning circuit can reduce the memory usage of the entire circuit, too many shared variables will increase the memory consumption in the witness generation phase, offsetting the memory optimization effect brought by the partition. In addition, each shared variable will also increase the complexity of the verification process. Therefore, controlling the number of shared variables is crucial to ensuring memory efficiency and reducing verification overhead. Since the topological sorting of the graph is not unique, the problem is transformed into finding a reasonable topological sorting that is as "balanced" as possible while satisfying "serializability". To address this problem, the present invention uses a greedy algorithm to traverse the CDG. Specifically, in the process of depth-first traversal, nodes with fewer dependencies are preferentially assigned to the same subcircuit to reduce shared variables between subcircuits. This process not only balances the computational complexity of each subcircuit, but also ensures that the dependencies between subcircuits are minimized as much as possible. The zero-knowledge proof circuit automatic partitioning method proposed by the present invention is shown in Algorithm 2:

[0056]

[0057]

[0058] The key steps include:

[0059] Step 1: First, the system initializes the partition set P = (V_1, V_2, ..., V_k), where V_i represents the i-th partition. Initialize the current partition number p = 1 and the size of each partition At the same time, the system initializes the input node mapping table ips, which is used to record the partition to which the input node belongs (Algorithm 2, lines 2-4).

[0060] Step 2: The system traverses the root node array root, calls the depth-first search (DFS) algorithm for each root node, and traverses each node and its child nodes in turn (Algorithm 2, lines 5-7).

[0061] Step 3: In the DFS process, first determine whether the current node v has been visited. If it has been visited and is not an input node, return directly. Otherwise, if the node v is an input node, add the current partition number p to the input node set ips to which the input node belongs, and return (Algorithm 2, lines 12-18).

[0062] Step 4: If node v is not an input node, the system marks the node as visited. Next, the system traverses the child nodes with smaller depth first, then the child nodes with smaller out-degree, and recursively calls DFS to traverse each child node according to the depth and out-degree order of the child nodes (Algorithm 2, lines 19-22).

[0063] Step 5: After traversing the child nodes, add the current node v to the current partition. If the size of the current partition reaches the preset partition size s, increase the partition number p by 1 and continue to allocate nodes to the next partition (Algorithm 2, lines 23-26).

[0064] Step 6: After DFS traverses all root nodes and their associated child nodes, the system constructs the subcircuit constraint system F and the subcircuit dependency graph D according to the partition set P and the input node set ips (Algorithm 2, line 8).

[0065] Step 7: Return the subcircuit set and subcircuit dependency graph. (Algorithm 2, line 9)

[0066] in,

[0067] In step 6, the algorithm for constructing the subcircuit is shown in Algorithm 3:

[0068]

[0069] The key steps include:

[0070] Step 1: First, initialize all subcircuit constraint systems and subcircuit dependency graph D. (Algorithm 3, lines 2-3);

[0071] Step 2: Traverse each partition and instantiate the corresponding subcircuit in each partition. (Algorithm 3, line 5);

[0072] Step 3: For each partition, traverse each input in the input partition set. If the partition contains the input, add the input as a public or private input of the subcircuit. (Algorithm 3, lines 6-10);

[0073] Step 4: For each partition, traverse each node (constraint) in the partition. For each node's child nodes, if the child nodes belong to different partitions, use the output of the current node as a shared variable between the two subcircuits and add dependencies in the subcircuit dependency graph. (Algorithm 3, lines 11-18);

[0074] Step 5: Return the subcircuit set and subcircuit dependency graph. (Algorithm 3, line 20).

[0075] Figure 3 A schematic diagram of the configurable pipeline execution mechanism proposed in the present invention is shown. The present invention achieves more efficient resource utilization and overall performance improvement by decoupling the two key stages of witness generation and proof calculation. In the traditional ZKP system implementation, witness generation and proof calculation are usually too highly coupled, resulting in resource waste and performance bottlenecks. The pipeline mechanism of the present invention allows witness generation and proof calculation to be performed simultaneously between multiple tasks and between different sub-circuits within each task. This parallel processing method improves the resource utilization of the system and can significantly improve system performance when the system needs to process a large number of proof requests. In addition, the present invention provides an interface for adjusting the degree of parallelism, which can flexibly configure the parallel granularity of the pipeline according to the task load and resource conditions. This can adapt to a variety of application scenarios and effectively improve resource utilization and system performance. The configurable pipeline execution mechanism proposed in the present invention is shown in Algorithm 4:

[0076]

[0077] The key steps include:

[0078] Step 1: Initialize an empty witness generation queue Q_solve and an empty proof computation queue Q_prove (Algorithm 4, line 2).

[0079] Step 2: When all tasks are not completed, run steps 3-5 in parallel;

[0080] Step 3: Parallel scheduling; check if any new subcircuits are ready to execute, i.e., all their dependencies have been resolved. If so, add these subcircuits to Q_solve for witness generation (Algorithm 4, lines 4-6);

[0081] Step 4: Parallel witness generation phase; select up to P_solve subcircuits from Q_solve. Perform witness generation for each subcircuit. Once completed, move it to the Q_prove queue to prepare for proof calculation (Algorithm 4, lines 7-10);

[0082] Step 5: Parallel proof calculation phase: select at most P_prove subcircuits from Q_prove and perform proof calculation on each subcircuit (Algorithm 4, lines 11-13);

[0083] Step 6: Until the witness generation and proof calculation of all tasks are completed, the proof results of all sub-circuits are obtained.

[0084] In summary, the present invention proposes a method for generating zero-knowledge proofs that optimizes resource utilization and is efficient. Through the automatic division of zero-knowledge proof circuits and the configurable pipeline parallel execution mechanism of sub-circuits, the problem of high memory consumption in existing zero-knowledge proof systems is solved, and the utilization rate and overall performance of system resources are effectively improved. The method is particularly suitable for continuous generation scenarios of large-scale circuit proofs.

[0085] The protection content of the present invention is not limited to the above embodiments. Without departing from the spirit and scope of the inventive concept, changes and advantages that can be thought of by those skilled in the art are included in the present invention and are protected by the attached claims.

Claims

1. A method for generating zero-knowledge proofs for optimizing resource utilization, characterized in that: Including automatic partitioning of zero-knowledge proof circuits and configurable pipeline parallel execution of subcircuits; The method for automatically dividing the zero-knowledge proof circuit is to divide the zero-knowledge proof circuit into a plurality of serializable sub-circuits, and to complete the independent calculation of each sub-circuit by making the dependent calculation results between the sub-circuits public as shared variables; The configurable pipeline parallel execution method of the sub-circuit is to decouple the witness generation stage and the proof calculation stage in the zero-knowledge proof generation process, and introduce a pipeline processing mode with configurable parallel granularity, so that the witness generation and proof calculation stages between the sub-circuits are independent of each other and coordinated and executed in parallel; The zero-knowledge proof circuit automatic partitioning method specifically includes: Step A1: Convert the constraint system corresponding to the zero-knowledge proof circuit into a constraint dependency graph CDG, calculate the out-degree and depth of each node, and obtain all constraints without post-constraints for subsequent traversal; Step A2: Use the out-degree and depth of the node as the priority calculation method to perform a post-order traversal of the CDG, assigning partitions to the nodes during the traversal process; Step A3: After the traversal is completed, the obtained partitions are restored to the zero-knowledge proof subcircuit constraint system, and the shared variables between the subcircuits and the dependencies between the subcircuits are obtained; The configurable pipeline parallel execution method of the sub-circuit specifically comprises: Step B1: Initialize the witness generation and proof calculation queues, and set the maximum number of parallel witness generation and proof calculation respectively; Step B2: According to the sub-circuit dependencies, add all sub-circuits without pre-dependencies of the proof tasks to be calculated to the witness generation queue; Step B3: When the witness generation queue is not empty, according to the parallel granularity limit, take out the corresponding number of sub-circuits for parallel witness generation; after the calculation is completed, add the sub-circuit to the proof calculation queue. This step is parallel to step B2; Step B4: When the proof calculation queue is not empty, according to the parallel granularity limit, take out the corresponding number of subcircuits for proof calculation and generate the zero-knowledge proof corresponding to the subcircuits. This process is parallel to steps B2 and B3. Step B5: Repeat steps B2 to B4 until all sub-circuit proofs for all tasks to be proved are generated.

2. The method for generating a zero-knowledge proof as claimed in claim 1, wherein: The step A1 comprises the following steps: Step A11: Initialize the constraint dependency graph CDG, a directed acyclic graph, in which each vertex represents a constraint or input, and each edge represents that an input or the output of a constraint is used as the input of another constraint, that is, there is a dependency relationship between the constraints or inputs represented by the two vertices; Step A12: traverse all inputs in the constraint system corresponding to the circuit, including public inputs and private inputs, add them as vertices to the CDG, and mark the vertices as corresponding public or private input vertices; Step A13: traverse all constraints in the constraint system corresponding to the circuit and add them as vertices to the CDG; if the constraint depends on a previous constraint or input, add the corresponding edge in the CDG and update the corresponding previous constraint out-degree; update the current constraint depth according to the depth of all previous constraints of the constraint; Step A14: Traverse all non-input nodes in the CDG and obtain all constraints without post-constraints, that is, no constraints depend on the calculation of these constraints.

3. The method for generating a zero-knowledge proof as claimed in claim 1, wherein: The step A2 comprises the following steps: Step A21: Initialize the current partition number to 1, and initialize the number of nodes contained in the current partition to 0; calculate the maximum number of nodes that each partition can contain; Step A22: traverse all nodes without subsequent nodes in order; Step A23: For all the preceding nodes of each node, the priority is calculated according to the out-degree and depth of these nodes, and the nodes with smaller depth are traversed first, and then the nodes with smaller out-degree are traversed secondly; Step A24: If a node has no preceding node, and if the node is an input node, assign the node to the current partition as input; Otherwise, assign the node to the current partition and increase the number of nodes in the current partition by one. If the number of current partitions reaches the upper limit, increase the number of current partitions and reset the number of nodes in the current node to 0. Step A25: Complete the traversal of all nodes and obtain all node partitions, that is, constrained partitions.

4. The method for generating a zero-knowledge proof as claimed in claim 1, wherein: The step A3 comprises the following steps: Step A31: Initialize all subcircuit constraint systems; initialize the subcircuit dependency graph, a directed acyclic graph, in which each vertex represents a subcircuit, and each edge represents that the calculation process of a subcircuit requires another subcircuit to complete the calculation and then open the shared variables before the calculation can begin, that is, there is a dependency relationship between the two subcircuits; Step A32: traverse all constraint partitions, each constraint partition corresponds to a subcircuit constraint system, and the input node of each partition is added as input to the subcircuit constraint system; Step A33: traverse all constraints in the constraint partition and add the constraints to the subcircuit constraint system; If the post-constraint of a constraint does not belong to the partition, treat the constraint as a shared variable between the two partitions and add the subcircuit dependency in the subcircuit dependency graph; Step A34: The traversal is completed, and all sub-circuit constraint systems and sub-circuit dependency graphs are obtained.

Images