An efficient range proof method based on scalar equation inner product

Abstract

The application provides a high-efficiency range proof method based on scalar equation inner product, constructs a single range equation by using a range interval and a proof value, and calculates a range scalar; the range equation and the range scalar are respectively split into fixed-length inner products; the Pedersen vector commitment is adopted to encapsulate the range scalar, the aggregated inner product and the blinding factor; the aggregated inner product polynomial is calculated, and the zero-order term coefficient expression is calculated; the aggregated polynomial coefficient commitment is generated, and the inner product range evidence set is generated; the evidence set is sent to the smart contract end, the inner product equation and the aggregated polynomial evidence are verified, and the proof process is completed. Meanwhile, the application represents the range interval in the form of the scalar equation based on the polynomial splitting idea, constructs the constant-length inner product, makes the calculation time constant, replaces the legality verification of the numerical inner product with the legality verification of the scalar equation inner product, realizes the flexible range proof, eliminates the off-chain calculation security threat, and optimizes the operation time.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain privacy protection and relates to a zero-knowledge range proof method based on the inner product of scalar equations. Background Art

[0002] The rapid development of the internet industry has led to the gradual application of blockchain technology in numerous fields, including internet finance and e-commerce. Due to the decentralized nature of blockchain, private data at the transaction layer can be easily leaked, raising information security concerns. Range proofs, a blockchain-based zero-knowledge proof technique, encrypt private data while simultaneously proving that the data falls within a specified range, achieving decentralized privacy protection. Current range proofs often rely on third-party trusted mechanisms, which can easily lead to trust issues. Proof methods that don't require third-party trusted mechanisms lack flexibility in the ranges they allow for and lack computational reliability. Therefore, a new method is needed to provide more secure, faster, and flexible range proofs without relying on trusted mechanisms.

[0003] Bulletproofs is one of the most well-known range proof methods. It uses the Pedersen vector commitment scheme to generate a set of inner product vectors for a range interval. The inner product equation is then used to derive the inner product polynomial, which is then executed recursively in half to halve the vector computational dimension. Finally, proof is generated using the inner product polynomial to complete the proof. Bulletproofs does not require a public reference string to provide a trusted mechanism and employs the recursive inner product halving principle, reducing computational dimensions and proof size. However, its drawback lies in the inflexibility of the proof interval. Due to the nature of the proof, even if the inner product protocol is executed twice to prove a number in a differential range form, the proof interval still lacks flexibility, making it difficult to widely apply to industry-standard consortium or private blockchains.

[0004] To address the lack of flexibility inherent in Bulletproofs, some improved methods have combined the Lagrange theorem with the Pedersen vector commitment concept to verify that the scalars of two sets of range equations are positive, achieving flexible range proofs with constant execution time. However, this approach suffers from two issues. Regarding trustworthiness and security, commitments are only made to the scalar values, not the range equations themselves. This makes it impossible to protect against malicious attacks during the off-chain construction phase, potentially posing a security threat to off-chain computations. Secondly, regarding performance, the Lagrange sum-of-squares problem reduces the inner product length to an odd number, preventing the use of a recursive inner product protocol. This increases the computational dimension and complexity. Furthermore, verifying only the numerical commitments requires constructing multiple sets of inner products separately, incurring additional time overhead. Therefore, while achieving flexible range proofs and ensuring constant computation time, improving the trustworthiness of off-chain computations and reducing the computational complexity and dimension are areas worth exploring.

[0005] In summary, the present invention proposes an efficient range proof method based on the inner product of scalar equations. It uses a formalized scalar equation to represent the range interval and constructs an inner product of constant length, so that the calculation time is constant. It uses the legitimacy verification of the inner product of scalar equations instead of the legitimacy verification of the numerical inner product, while achieving flexible range proofs and eliminating off-chain computing security threats. It combines Lagrange's theorem with the recursive inner product protocol to improve the inner product splitting method and optimize the calculation time. Summary of the Invention

[0006] The present invention proposes an efficient range proof method based on the inner product of scalar equations. First, in order to solve the problem of off-chain computational credibility and flexible range proof, the method converts the range interval into a set of scalar equations, and combines the Lagrange theorem and polynomial splitting ideas to construct equation inner products and scalar inner products. Subsequently, an aggregate inner product polynomial is designed, and the Pedersen vector commitment is used to commit to the aggregate inner product and polynomial coefficients. The recursive inner product protocol is used to generate an inner product range evidence set. Finally, the evidence set is sent to the blockchain smart contract end for evidence verification, thereby completing the range proof. In summary, the present invention proposes an efficient range proof method based on the inner product of scalar equations. The method constructs a double inner product by designing a scalar equation of the range interval, and generates evidence for the double inner product using the idea of ​​aggregate proof. Thus, while achieving flexible range proof, the credibility of off-chain computation is improved, and the computation time is shortened, the computation dimension and complexity are reduced while the computation time remains constant.

[0007] To achieve the above objectives, the technical solution of the new range proof method includes the following steps:

[0008] Step 1: Use the range interval and the proof value to construct a single range scalar equation and calculate the range scalar;

[0009] Step 2: Split the range equation and range scalar into fixed-length inner products respectively;

[0010] Step 3: Use Pedersen vector commitment to encapsulate range scalars Aggregate inner product and blinding factor;

[0011] Step 4: Calculate the aggregate inner product polynomial and calculate the coefficient expression of the zero-order term;

[0012] Step 5: Generate aggregate polynomial coefficient commitment and generate inner product range evidence set;

[0013] Step 6: Send the evidence set to the smart contract to verify the inner product equation and the aggregate polynomial evidence;

[0014] The present invention provides the following beneficial effects: It designs a dual inner product based on a joint range scalar equation for flexible range intervals and constructs an aggregate inner product commitment, allowing the inner product to reliably represent the range interval. It then designs an aggregate inner product polynomial and generates aggregate evidence using an improved inner product protocol. This invention enables flexible range interval verification without relying on any trusted mechanisms, while also providing greater reliability for off-chain polynomial computation. Furthermore, the present invention achieves faster constant computation and lower computational complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 Diagram of efficient range proof framework based on inner product of scalar equality;

[0016] Figure 2 Flowchart of the method proposed in the present invention. DETAILED DESCRIPTION

[0017] The embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0018] Figure 1 This is a diagram of an efficient range proof framework based on the inner product of scalar equations. First, the present invention merges the two sets of inequalities in the range interval, converts them into a single set of range scalar equations, calculates the range scalar, and generates a commitment for the scalar. Secondly, the Lagrange four-square sum theorem and polynomial splitting are used to construct the range scalar equation into an equation inner product and a scalar inner product, respectively. Then, the Pedersen vector commitment is used to aggregate the two sets of inner products and generate an aggregate inner product commitment. Subsequently, an aggregate inner product polynomial is constructed based on the inner product, and a recursive inner product protocol is used to perform the range proof. Finally, the commitment and evidence are summarized into an evidence set and sent to the smart contract end for verification.

[0019] The specific steps are as follows:

[0020] Step 1: Use the range interval and the proof value to construct a single range scalar equation and calculate the range scalar;

[0021] The relationship between the natural and flexible non-negative range interval and the proof value can be expressed as shown in formula (1):

[0022] m∈[a,b]∧a>0∧b>0 (1)

[0023] ma>0∧bm>0∧a>0∧b>0 (2)

[0024] Where m represents the proof value, a and b represent the upper and lower bounds of the interval respectively. Formula (1) can be equivalent to formula (2).

[0025] In zero-knowledge proofs, since smart contracts can only handle equality verification relationships, traditional relationships are obviously not applicable to zero-knowledge range proofs. After derivation, the range interval can be formalized as the following equation:

[0026]

[0027] Among them, in formula (3) Represents a range scalar calculated from a range equation, which can be used to convert an inequality into an equation.

[0028] If and only if ma>0, bm<0 holds, on the contrary, if ma<0, bm>0 holds. Therefore, if and only if ma>0∧bm>0∧a>0∧b>0, Then, in order to construct a fixed-length inner product vector from formula (3) and generate an inner product agreement argument, we split and merge formula (3) to obtain the following range scalar equation:

[0029]

[0030] Step 2: Split the range equation and range scalar into fixed-length inner products respectively;

[0031] The present invention adopts multi-factor splitting and Lagrange's theorem at the proof end to construct inner product commitments on both ends of the range scalar equation, so as to achieve range proof without relying on a trusted mechanism while protecting against the false construction threat of off-chain calculations.

[0032] First, construct the inner product of the range equation to verify the scalar The construction is legal. Specifically, due to the recursive execution problem of the inner product protocol, the processing vector length must be a power of 2. Therefore, the present invention uses a multi-partitioning method to design an equation inner product vector with a constant length of 4, and combines it into a range equation inner product, as shown in formula (5):

[0033]

[0034] Among them, q1 and e1 represent the inner product vector of the equation, and their length is 4. The range scalar is obtained by performing inner product processing on q1 and e1

[0035] Then, construct the range scalar inner product to verify the scalar Greater than 0. Specifically, the calculated range scalar According to Lagrange's Four Square Sum Theorem, it can also be split into four square numbers. The combination can be formally expressed as expression (6):

[0036]

[0037] Among them, k i is representable as 4 integers if and only if there are 4 integers whose sum of squares is equal to hour, Therefore, the range scalar It is expressed as the sum of four square numbers, as shown in formula (7), and the inner product obtained by splitting formula (7) is shown in formula (8):

[0038]

[0039]

[0040] Among them, q2 and e2 represent The two scalar inner product vectors of . Thus, we can get the inner product of the range equation<q1,e1> and range scalar inner product<q2,e2> .

[0041] To verify<q2,e2> Decomposed from Lagrange, the inner product constraint is designed to constrain q2 and e2 to be equal. The constraint is shown in formula (9):

[0042]

[0043] Among them, y n Theoretically, it can be represented as a set of integer ring vectors Z with a length of 4 and a modulus of P generated by the verification end. p 8 The random number vector generated by the prover is y, but in order to reduce the number of interaction rounds between the prover and the verifier, according to the Fiat-Shamir heuristic, the vector y n The element y of is generated by the hash function of the prover's commitment A and S without interacting with the verifier to achieve the purpose of non-interactive proof.

[0044] Step 3: Use Pedersen vector commitment to encapsulate range scalars Aggregate inner product and blinding factor;

[0045] In order to make the proof process zero-knowledge, the proof end cannot directly use the inner product of the equation, the inner product of the scalar, and When sending to the verifier, the commitments encapsulated with Pedersen vector commitments should be sent instead of plaintext. To reduce the inner product polynomial verification overhead and compress the size of the range proof, this step needs to merge the single commitments into an aggregate commitment during the commitment generation process.

[0046] Specifically, Pedersen vector commitment is used to generate a set of scalars on the range The commitments are combined into a commitment vector. The commitment formula and the combined commitment vector are shown in formulas (9) and (10):

[0047]

[0048]

[0049] Among them, r j Represents a random point generated on the integer ring modulo P; w1, w2 both represent scalars in the range Commitment; W represents the commitment vector composed of w1, w2, G p represents the cyclic group of prime order P; g and h represent the points generated by the two cyclic groups.

[0050] Then, the equation inner product and the scalar inner product are aggregated to generate a commitment, and the aggregate commitment expression is shown in formula (11):

[0051]

[0052] Where A represents the aggregate commitment for equational inner products and scalar inner products; h represents a random point generated on the cyclic group of prime order P; q j 、e i Two inner product vectors representing the inner product of the equation and the inner product of the scalar respectively; g, h represent the cyclic group vector G with a prime order of P of length 8 p 8 In the two point vectors generated; α represents the integer ring Z with a modulus of P p A random number taken from .

[0053] To ensure zero knowledge of the inner product of the equation and the scalar inner product, a blinding factor is introduced and a commitment is made to it so that the inner product can be blinded. The Pedersen vector commitment formula generated for the blinding factor is shown in formula (12):

[0054]

[0055] Among them, s L 、sR Represents a set of integer ring vectors Z of length 8 p 8 The generated blinding factor; S represents the Pedersen vector commitment generated for the blinding factor; ρ represents the integer ring Z modulo P p A random number taken from .

[0056] Step 4: Calculate the aggregate inner product polynomial and calculate the coefficient expression of the zero-order term;

[0057] To convert equational and scalar inner products into zero-knowledge proofs, the prover designs a polymeric inner product polynomial. This is obtained by taking the inner product of a set of vector polynomials containing equational and scalar inner products. This allows the coefficient of the zeroth-degree term of the polymeric inner product polynomial to be expressed in a special formalization if and only if the equational and scalar inner products are calculated correctly.

[0058] Specifically, according to the inner product vector and the inner product constraint, the inner product of the equation and the scalar inner product are blinded, and then the vectors are split and aggregated and formalized into a vector polynomial group. The vector polynomial group is shown in formula (13):

[0059]

[0060] Where l(x) and r(x) represent vector polynomials. The x in l(x) and r(x) is generated by the verifier and sent to the prover as a random challenge value. It is an integer ring Z modulo P. p Random numbers taken from; z and y n Similarly, it is generated by the hash function of A, S, and y according to the Fiat-Shamir heuristic; n is represented by the length of the inner product vector, and the length of the equation inner product and the scalar inner product in the present invention are both 4.

[0061] Then, the inner product of the aggregate polynomial l(x) and r(x) is taken to obtain the aggregate inner product polynomial as shown in formula (14):

[0062]

[0063] Where t(x) represents the aggregate inner product polynomial; t i Represents the coefficient of the i-th term of t(x).

[0064] In summary, the analysis shows that if and only if condition (15) holds, the zero-order coefficient t0 of t(x) is as shown in formula (16):

[0065]

[0066]

[0067] Among them, Q is the front aggregation item, E is the back aggregation item, and finally Q and E are used to derive the special expression when t0 meets the conditions.

[0068] Step 5: Generate aggregate polynomial coefficient commitment and generate inner product range evidence set;

[0069] The prover generates evidence in a zero-knowledge state for the verifier to verify that the aggregate inner product polynomial is valid. The prover generates evidence in a zero-knowledge state for the verifier to verify that the aggregate inner product polynomial is valid. i Commitments are generated separately. The coefficients of the zero-order terms can be derived and verified from expressions, so there's no need to generate commitments. Then, the random numbers from the aggregate inner product commitments A and S, along with the random numbers from the polynomial coefficient commitments and scalar commitments, are combined to form two random scalars for verification by the verifier. Furthermore, the aggregate inner product commitment A, the blinding factor commitment S, and the aggregate inner product polynomial t(x) are sent to the verifier as evidence. Finally, the Bulletproofs recursive inner product protocol is used to encapsulate l(x) and r(x) into an inner product protocol argument. This yields the complete evidence set for the range proof.

[0070] Specifically, the commitment formula for the coefficients of the non-zero-order terms of the aggregate inner product polynomial adopts the Pedersen vector commitment as shown in formula (17):

[0071]

[0072] Where T1 and T2 represent the commitments of the coefficients of the linear term and the quadratic term respectively; τ1 and τ2 represent the integer ring Z modulo P. p A random number taken from .

[0073] The random number in the polynomial coefficient commitment is combined with the scalar commitment random number to form a random number scalar, whose scalar form is shown in formula (18):

[0074]

[0075] Among them, τ x represents the random number scalar formed by T1, T2, and W; τ i Represents two random numbers in T1 and T2; r j Represent two random numbers in W.

[0076] The random number in the aggregate inner product commitment A and the blinding factor commitment S is combined to form a random number scalar, whose scalar form is shown in formula (19):

[0077] μ=α·z+ρ·x (19)

[0078] Among them, μ represents the random number scalar formed by A and S; α represents the random number of A, and ρ represents the random number of S.

[0079] Finally, the Bulletproofs recursive inner product protocol is used to encapsulate the aggregate polynomials l(x) and r(x) into an inner product protocol argument, and the argument evidence is sent to the verification end instead of the plaintext l(x) and r(x), thereby reducing the size of the evidence. The inner product argument evidence for l(x) and r(x) is shown in formula (20):

[0080] pt=g l(x) h r(x) u <l(x),r(x)> ,u∈G (20)

[0081] Among them, pt represents the evidence of the argument; u represents a random point generated by the cyclic group of prime order P.

[0082] In summary, T1, T2, t, τ x ,μ,A,S,pt is used as the evidence set for verification by the verification end program.

[0083] Step 6: Send the evidence set to the smart contract verification terminal to verify the inner product equation and polynomial evidence;

[0084] The prover sends the evidence set to the smart contract verifier, which verifies the legitimacy of the evidence. If the verification passes, the prover's integer m is deemed to be within the specified range [a, b], and the data is allowed to be uploaded to the blockchain. Otherwise, the prover's request to upload the data is rejected. This completes the range proof.

[0085] Specifically, the smart contract constructs two sets of verification equations based on the evidence set sent by the proving end to verify the evidence set. If the equal signs on both sides of the verification equation are equal, the evidence is considered legal; if not, the evidence is considered illegal. The verification equations are shown in formulas (21) and (22) respectively:

[0086]

[0087]

[0088] The random challenge value x in the verification equation, as well as the random numbers z and y, are also generated by the Fiat-Shamir heuristic through a hash function.

[0089] Method flow description:

[0090] The overall process of the present invention is divided into four parts: the equation scalar inner product construction process, the aggregate polynomial group construction process, the aggregate inner product polynomial evidence generation process, and the smart contract verification process. First, the present invention formalizes the range interval into an equation of the range scalar, and constructs the inner product of the equation through Lagrange's theorem and polynomial decomposition. Secondly, a Pedersen aggregate commitment about the inner product is generated, and an aggregate polynomial group is constructed according to the properties of the inner product itself, and the aggregate inner product polynomial is calculated. Then, a coefficient commitment corresponding to the aggregate inner product polynomial is generated, and a recursive inner product protocol is used to encapsulate the polynomial commitment to generate evidence and form an evidence set. Finally, the evidence set generated by the proof end is sent to the smart contract verification end for polynomial verification. If the polynomial is true, it passes, otherwise it is rejected. The specific process is as follows. Figure 2 shown.

Claims

1. An efficient range proof method based on the inner product of scalar equality, characterized in that: Here are the steps: Step 1: Use the range interval and the proof value to construct a single range equation and calculate the range scalar; Step 2: Split the range equation and range scalar into fixed-length inner products respectively; First, construct the inner product of the equation to verify the range scalar The construction is legal; specifically, affected by the recursive execution problem of the inner product protocol, the length of the processing vector must be a power of 2; therefore, the multi-partition method is used to design an equation inner product vector with a constant length of 4, and combined into an equation inner product, as shown in formula (5): Among them, m represents the proof value, a and b represent the upper and lower bounds of the interval respectively, q1 and e1 represent the inner product vector of the equation, and their length is 4; the range scalar is obtained by performing the inner product of q1 and e1 Then, construct the scalar inner product to verify the range scalar Greater than 0; specifically, the calculated range scalar According to Lagrange's Four Square Sum Theorem, it can be split into four square numbers; the properties and range scalar of Lagrange's Four Square Sum Theorem Combined with the formal expression (6): Among them, k i Expressed as 4 integers, a value is a square if and only if there are 4 integers whose sum is equal to hour, holds; therefore, the range scalar It is expressed as the sum of four square numbers, as shown in formula (7), and the inner product obtained by splitting formula (7) is shown in formula (8): Among them, q2 and e2 represent The two scalar inner product vectors of ; thus, we get the inner product of the equation<q1,e1> and the scalar inner product<q2,e2> ; To verify<q2,e2> Decomposed from Lagrange, the inner product constraint is designed to constrain q2 and e2 to be equal. The constraint is shown in formula (9): Among them, y n It is represented by a set of integer ring vectors with a length of 4 and a modulus of P generated by the verification end. The random number vector generated by the prover is y, but in order to reduce the number of interaction rounds between the prover and the verifier, according to the Fiat-Shamir heuristic, the vector y n The element y of is generated by the hash function of the prover's commitment A and S without interacting with the verifier to achieve the purpose of non-interactive proof; Step 3: Use Pedersen vector commitment to encapsulate range scalars Aggregate inner product and blinding factor; Step 4: Calculate the aggregate inner product polynomial and calculate the coefficient expression of the zero-order term; Step 5: Generate aggregate polynomial coefficient commitment and generate inner product range evidence set; Step 6: Send the evidence set to the smart contract verification end to verify the inner product equation and polynomial evidence.

2. The efficient range proof method based on the inner product of scalar equality according to claim 1, characterized in that: The step 1 is specifically as follows: The relationship between the natural and flexible non-negative range interval and the proof value is expressed as shown in formula (1): m∈[a,b]∧a>0∧b>0 (1) ma>0∧bm>0∧a>0∧b>0 (2) Wherein, formula (1) is equivalent to formula (2); In zero-knowledge proofs, since smart contracts can only handle equality verification relations, traditional relations are not applicable to zero-knowledge range proofs. After derivation, the range interval is formalized as the following equation: Among them, in formula (3) Represents the range scalar calculated from the range equation, converting the inequality into an equation; If and only if ma>0∧bm>0∧a>0∧b>0, Then, in order to construct a fixed-length inner product vector from formula (3) and generate an inner product agreement argument, we split and merge formula (3) to obtain the following range equation:

3. The efficient range proof method based on the inner product of scalar equality according to claim 2, characterized in that: In step 2, multiple splitting and Lagrange's theorem are used on the proof side to construct inner product commitments on both ends of the range equation, so as to achieve range proof without relying on a trusted mechanism while protecting against false construction threats in off-chain calculations.

4. The efficient range proof method based on the inner product of scalar equality according to claim 3, characterized in that: The step 3 is specifically as follows: In order to make the proof process zero-knowledge, the proof end cannot directly use the inner product of the equation, the inner product of the scalar, and When sending to the verifier, the commitments encapsulated with Pedersen vector commitments should be sent instead of plaintext. To reduce the inner product polynomial verification overhead and compress the size of the range evidence, this step needs to merge the single commitments into an aggregate commitment during the commitment generation process. Specifically, Pedersen vector commitment is used to generate a set of scalars on the range The commitments are combined into a commitment vector. The commitment formula and the combined commitment vector are shown in formulas (10) and (11): Among them, r j Represents the ring Z of integers modulo P p Random points generated on the scalar range; w1, w2 are both scalars Commitment; W represents the commitment vector composed of w1, w2, G p represents the cyclic group vector of prime order P, G p 2 represents a cyclic group vector of prime order P with a length of 2; g, h represent the cyclic group vector G p The two points generated in Then, the equation inner product and the scalar inner product are aggregated to generate a commitment, and the aggregate commitment expression is shown in formula (12): Where A represents the aggregation commitment for equational inner products and scalar inner products; q j 、e i Two inner product vectors representing the inner product of the equation and the inner product of the scalar; G p 8 represents a cyclic group vector of prime order P with a length of 8; α represents the integer ring Z with a modulus of P p The random number taken from In order to ensure the zero-knowledge property of the inner product of the equation and the scalar inner product, a blinding factor is introduced and a commitment is made to it so as to blind the inner product. The Pedersen vector commitment formula generated for the blinding factor is shown in formula (13): Among them, S L 、S R Represents a set of integer ring vectors Z of length 8 p 8 The generated blinding factor; S represents the Pedersen vector commitment generated for the blinding factor; ρ represents the integer ring Z modulo P p A random number taken from .

5. The efficient range proof method based on the inner product of scalar equality according to claim 4, characterized in that: The step 4 is specifically as follows: To convert equational inner products and scalar inner products into zero-knowledge evidence, the proof side designs an aggregate inner product polynomial. This is obtained by taking the inner product of a group of vector polynomials containing equational inner products and scalar inner products. This ensures that the coefficient of the zero-order term of the aggregate inner product polynomial is formalized specifically if and only if the equational inner product and scalar inner product are calculated correctly. Specifically, according to the inner product vector and the inner product constraint, the inner product of the equation and the scalar inner product are blinded, and then the vectors are split and aggregated and formalized into a vector polynomial group. The vector polynomial group is shown in formula (14): Where l(x) and r(x) represent vector polynomials. The x in l(x) and r(x) is generated by the verifier and sent to the prover as a random challenge value. It is an integer ring Z modulo P. p Random numbers taken from; z and y n Similarly, it is generated by the hash function of A, S, and y according to the Fiat-Shamir heuristic; n is represented by the length of the inner product vector, and the length of the inner product of the equation and the scalar inner product is 4; Then, the inner product of the aggregate polynomial l(x) and r(x) is taken to obtain the aggregate inner product polynomial as shown in formula (15): Where t(x) represents the aggregate inner product polynomial; t i represents the coefficient of the i-th term of t(x); In summary, the analysis shows that if and only if condition (16) holds, the zero-order coefficient t0 of t(x) is as shown in formula (17): Among them, Q is the front aggregation item, E is the back aggregation item, and finally Q and E are used to derive the special expression when t0 meets the conditions.

6. The efficient range proof method based on the inner product of scalar equality according to claim 5, characterized in that: The step 5 is specifically as follows: The proving end generates evidence in a zero-knowledge state for the verification end to verify that the aggregate inner product polynomial is valid; the proving end generates evidence for the coefficient t of the non-zero degree term of the aggregate inner product polynomial. i Generate commitments separately. The coefficient of the zero-order term can be derived and verified by the expression, so there is no need to generate commitments; Then, the random numbers of the aggregate inner product commitments A and S and the random numbers in the polynomial coefficient commitments and scalar commitments are combined to form two random number scalars for verification by the verifier. In addition, the aggregate inner product commitment A, the blinding factor commitment S, and the aggregate inner product polynomial t(x) are sent to the verifier in the form of evidence. Finally, the Bulletproofs recursive inner product protocol is used to encapsulate l(x) and r(x) into an inner product protocol argument. In summary, the complete evidence set of the range proof is obtained. Specifically, the commitment formula for the coefficients of the non-zero-order terms of the aggregate inner product polynomial adopts the Pedersen vector commitment as shown in formula (18): Where T1 and T2 represent the commitments of the coefficients of the linear term and the quadratic term respectively; τ1 and τ2 represent the integer ring Z modulo P. p The random number taken from The random number in the polynomial coefficient commitment is combined with the scalar commitment random number to form a random number scalar, whose scalar form is shown in formula (19): Among them, τ x represents the random number scalar formed by T1, T2, and W; τ i Represents two random numbers in T1 and T2; r j Represents two random numbers in W; The random number in the aggregate inner product commitment A and the blinding factor commitment S is combined to form a random number scalar, whose scalar form is shown in formula (20): μ=α·z+ρ·x (20) Among them, μ represents the random number scalar formed by A and S; α represents the random number of A, and ρ represents the random number of S; Finally, the Bulletproofs recursive inner product protocol is used to encapsulate the aggregate polynomials l(x) and r(x) into an inner product protocol argument, and the argument evidence is sent to the verification end instead of the plaintext l(x) and r(x), thereby reducing the size of the evidence. The inner product argument evidence for l(x) and r(x) is shown in formula (21): pt=g l(x) h r(x) u< l(x),r(x) >, u∈G (21) Among them, pt represents the evidence of the argument; u represents a random point generated by the cyclic group vector of prime order P; In summary, T1, T2, t, τ x ,μ,A,S,pt is used as the evidence set for verification by the verification end program.

7. The efficient range proof method based on the inner product of scalar equality according to claim 6, characterized in that: The step 6 is specifically as follows: The prover sends the evidence set to the smart contract verifier. The smart contract verifies the legitimacy of the evidence. If the verification passes, the prover's integer m is considered to be within the specified range [a, b], and the data is allowed to be uploaded to the blockchain. Otherwise, the prover's application for data upload is rejected. At this point, the range proof is completed. Specifically, the smart contract constructs two sets of verification equations based on the evidence set sent by the proving end to verify the evidence set. When the equal signs on both sides of the verification equation are equal, the evidence is considered legal; if not, the evidence is considered illegal. The verification equations are shown in formulas (22) and (23) respectively: The random challenge value x in the verification equation, as well as the random numbers z and y, are also generated by the Fiat-Shamir heuristic through a hash function.

Images