Method and system for implementing private transactions based on range proof

Abstract

The embodiments of this specification provide a method for implementing private transactions based on range proof in a blockchain. According to the method, the first device where the first account is located obtains m numerical values ​​related to the transaction amount of the blockchain, and the m target ranges to be proved correspond to the m digits in binary representation; each numerical value is converted into a bit string of the corresponding digit, and a numerical vector is obtained by sequentially splicing the m bit strings; a challenge array is obtained; based on the numerical vector, the m digits, and the challenge array, two vector polynomials and the result polynomial generated by their inner product are generated, and a first set of commitment values ​​is generated based on the coefficients of the polynomial. Then, the first device obtains the variable value x, substitutes x into the aforementioned polynomial, obtains two verification vectors and the result value, and generates a second set of commitment values ​​accordingly. The verification device verifies whether the m numerical values ​​correspond to the m target ranges based on at least the m digits, the first set of commitment values, and the second set of commitment values.

Description

Technical Field

[0001] One or more embodiments of this specification relate to a blockchain system and data privacy protection, and more particularly, to a method and system for implementing private transactions based on range proof in a blockchain, and a method and system for data verification that protects privacy. Background Art

[0002] Blockchain technology is an application model that uses computer technologies such as peer-to-peer transmission, consensus mechanism, and encryption algorithm to achieve distributed data storage. In the blockchain network, data storage and recording are achieved through transactions. The transaction content of each transaction is jointly maintained by all nodes in the blockchain network, and no party can tamper with the content in the block.

[0003] Due to the transparent and traceable nature of blockchain data, each transaction in a conventional blockchain is publicly recorded in a block and can be accessed and read by any node. However, when a transaction involves personal privacy, how to ensure that nodes can verify and execute transactions normally without leaking private information becomes a problem to be solved.

[0004] Therefore, it is hoped that an effective solution can be provided to verify and execute blockchain transactions without leaking privacy, thereby realizing secure and efficient privacy transactions in the blockchain. Summary of the invention

[0005] One or more embodiments of the present specification describe a method and system for implementing private transactions based on range proofs in a blockchain, wherein for multiple numerical values ​​to be proved in a blockchain transaction, an aggregated range proof can be used to prove that each of them belongs to a corresponding target range, and there are no restrictions or requirements on the number of digits m and the target range, thereby supporting verification of multiple ranges of different digits.

[0006] According to a first aspect, a method for implementing private transactions based on range proof in a blockchain is provided, comprising:

[0007] The first device where the first account is located obtains m numerical values ​​related to the blockchain transaction amount of the first account, and the m target ranges to be proved correspond to the m digits represented by binary;

[0008] Convert each numerical value into a bit string of corresponding digits, and obtain a numerical vector by sequentially concatenating m bit strings;

[0009] Get the challenge array;

[0010] Generate a result polynomial generated by two vector polynomials and their inner product according to the numerical vector, the m digits, and the challenge array, and generate a first set of commitment values ​​based on coefficients of the result polynomial;

[0011] Get a random variable value x;

[0012] Substituting the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and a result value, and generating a second set of commitment values, which at least includes the result value and vector data related to the two verification vectors;

[0013] The verification device verifies whether the m numerical values ​​correspond to the m target ranges based at least on the m digits, the first group of committed values ​​and the second group of committed values.

[0014] According to one embodiment, the first device obtains the challenge array, including receiving the challenge array generated by the verification device; obtaining the random variable value x includes receiving the variable value x generated by the verification device; the method also includes: sending the first set of commitment values ​​and the second set of commitment values ​​to the verification device.

[0015] According to another embodiment, the first device obtains the challenge array, including generating the challenge array according to an agreed first generator and a public first data source; obtaining the random variable value x includes generating the variable value x according to an agreed second generator and a public second data source; the method also includes: the first device generates a zero-knowledge proof based on at least the first set of commitment values ​​and the second set of commitment values, and uploads the zero-knowledge proof to the blockchain; the verification device obtains the zero-knowledge proof from the blockchain.

[0016] In one embodiment, the verification device is a device corresponding to the accounting node, and the method further includes, when the verification device verifies that the m numerical values ​​correspond to the m target ranges, writing transactions related to the m numerical values ​​into the blockchain.

[0017] According to one embodiment, the m numerical values ​​include one or more of the following: transaction amount, account balance, and a transaction ratio value determined based on the transaction amount and account balance.

[0018] According to one embodiment, the two vector polynomials are generated based on a first basis vector and a second basis vector, respectively; wherein the inner product result of the first basis vector and the second basis vector is equal to the sum of a first operation value and a second operation value δ, wherein the first operation value depends on the m numerical values, and the second operation value only depends on the challenge array and the m digits.

[0019] Furthermore, in one embodiment, the method also includes: a first device generates an auxiliary vector having a predetermined relationship with the numerical vector; generates a first and a second blinding vector for confusing the numerical vector and the auxiliary vector; generates a reference value A based on the numerical vector and the auxiliary vector, and generates a blinding value S based on the first and the second blinding vectors.

[0020] Further, in one example, the first device generates two vector polynomials specifically including: introducing a first blinding vector and variables based on the first basis vector to obtain a first vector polynomial; and introducing a second blinding vector and variables based on the second basis vector to obtain a second vector polynomial.

[0021] Correspondingly, in one embodiment, the verification device verifies whether the m numerical values ​​correspond to the m target ranges, specifically including: calculating a first calculated value based on the reference value A, the blinding value S, the challenge array, and the m digits; calculating a second calculated value based on the two verification vectors; and verifying whether the first calculated value is equal to the second calculated value.

[0022] According to one embodiment, the challenge array includes a third challenge number e; the first device generates a first group of commitment values, specifically including: generating a first commitment value T1 based on the coefficient of the linear term of the result polynomial, a locally generated first random number, the second part of the m ciphertexts encrypted by each of the m numerical values ​​under the public key pk of the first account, and the third challenge number; generating a second commitment value T2 based on the coefficient of the quadratic term of the result polynomial, a locally generated second random number, the second part of the m ciphertexts, and the third challenge number, wherein in the calculation of the first commitment value and the second commitment value, the third challenge number e acts on the exponent of the second part.

[0023] Further, in one embodiment, the first device generates a second set of commitment values, specifically including: generating a verification value τ according to the first random number, the second random number, the variable value x, and a private key sk corresponding to the public key x ; Determine a second set of commitment values, which at least includes the verification value τ x , the result value, the two verification vectors.

[0024] Accordingly, in one embodiment, the verification device verifies whether the m values ​​correspond to the m target ranges, specifically including: x, the result value, the second operation value δ, the third challenge number e, and the second part of the m ciphertexts are multiplied to obtain a third calculation value; wherein the third challenge number e acts on the exponent of the second part; according to the first commitment value T1, the second commitment value T2, the variable value x, the third challenge number e, and the first part of the m ciphertexts, a fourth calculation value is calculated; the third challenge number e acts on the exponent of the first part; and verify whether the third calculation value and the fourth calculation value are equal.

[0025] In one embodiment, the method also includes: the first device processes the dimension N of the two verification vectors as an even number; based on the two N-dimensional verification vectors, generates two intermediate values ​​and two N / 2-dimensional sub-vectors; the vector data includes the two intermediate values ​​and the two sub-vectors.

[0026] Furthermore, in an embodiment of the above-mentioned implementation manner, the first device processes the dimension N of the two verification vectors as an even number, specifically including: obtaining a third random value when the original dimension of the two verification vectors is an odd number; adding the third random value as an additional vector element to the two verification vectors respectively to obtain a verification vector with an even dimension.

[0027] In one embodiment, the two verification vectors include a first verification vector and a second verification vector; the first device generates two intermediate values ​​and two sub-vectors of N / 2 dimension, specifically including: splitting the agreed two N-dimensional generation vectors and the two verification vectors into front and back sub-vectors of N / 2 dimension, and calculating the first intermediate value and the second intermediate value based on the exponential combination of these sub-vectors and the agreed parameters; obtaining a fourth random value; generating an N / 2-dimensional first sub-vector based on the front and back sub-vectors of the first verification vector and the fourth random value; generating an N / 2-dimensional second sub-vector based on the front and back sub-vectors of the second verification vector and the fourth random value.

[0028] Correspondingly, in one embodiment, the verification device verifies whether the m numerical values ​​correspond to the m target ranges, specifically including: obtaining two generated sub-vectors based on a combination of the front and rear sub-vectors of the two generated vectors, and obtaining a fifth calculated value based on the exponential operation of the two generated sub-vectors with the first sub-vector and the second sub-vector respectively; calculating a sixth calculated value based on the exponential operation combination of the front and rear sub-vectors of the two generated vectors themselves with the first sub-vector and the second sub-vector respectively; when the fifth calculated value is equal to the sixth calculated value, determining that the auxiliary value provided by the first device is obtained based on the two verification vectors, and verifying the m target ranges based on the auxiliary value.

[0029] According to a second aspect, a method for privacy-preserving data verification is provided, comprising:

[0030] The first device obtains m numerical values ​​to be proved, and the m target ranges to be proved correspond to m digits in binary representation;

[0031] Convert each numerical value into a bit string of corresponding digits, and obtain a numerical vector by sequentially concatenating m bit strings;

[0032] Get the challenge array;

[0033] Generate a result polynomial generated by two vector polynomials and their inner product according to the numerical vector, the m digits, and the challenge array, and generate a first set of commitment values ​​based on coefficients of the result polynomial;

[0034] Get a random variable value x;

[0035] Substituting the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and a result value, and generating a second set of commitment values, which at least includes the result value and vector data related to the two verification vectors;

[0036] The verification device verifies whether the m numerical values ​​correspond to the m target ranges based at least on the m digits, the first group of committed values ​​and the second group of committed values.

[0037] According to a third aspect, a blockchain system for implementing private transactions based on range proof is provided, comprising at least a first device where a first account is located, and a verification device, wherein:

[0038] The first device is configured to obtain m numerical values ​​related to the blockchain transaction amount of the first account, and m target ranges to be proved corresponding to m digits in binary representation; convert each numerical value into a bit string of corresponding digits, and obtain a numerical vector by sequentially splicing the m bit strings; obtain a challenge array; generate a result polynomial generated by two vector polynomials and their inner product according to the numerical vector, the m digits, and the challenge array, and generate a first set of commitment values ​​based on the coefficients of the result polynomial; obtain a random variable value x; substitute the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and a result value, and generate a second set of commitment values, which at least includes the result value and vector data related to the two verification vectors;

[0039] The verification device is configured to verify whether the m numerical values ​​correspond to the m target ranges based on at least the m digits, the first group of committed values ​​and the second group of committed values.

[0040] According to a fourth aspect, a privacy-protecting data verification system is provided, including a first device and a verification device, wherein:

[0041] The first device is configured to obtain m numerical values ​​to be proved and m target ranges to be proved corresponding to m digits in binary representation; convert each numerical value into a bit string of corresponding digits, and obtain a numerical vector by sequentially concatenating m bit strings; obtain a challenge array; generate a result polynomial generated by two vector polynomials and their inner product according to the numerical vector, the m digits, and the challenge array, and generate a first set of commitment values ​​based on the coefficients of the result polynomial; obtain a random variable value x; substitute the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and a result value, and generate a second set of commitment values, which at least includes the result value and vector data related to the two verification vectors;

[0042] The verification device is configured to verify whether the m numerical values ​​correspond to the m target ranges based on at least the m digits, the first group of committed values ​​and the second group of committed values.

[0043] In the embodiments of this specification, the account device in the blockchain system generates a zero-knowledge range proof for multiple values ​​and their respective target ranges, so that the verification device can verify the target ranges to which they belong at one time without knowing the respective sizes of the multiple values, thereby realizing an aggregated zero-knowledge range proof. In addition, the scheme in the embodiment has no restrictions or requirements on the number of digits of the values ​​m to be proved, so it can support the verification of multiple ranges with different digits. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0045] Figure 1 is a schematic diagram of a scheme for conducting a private transaction in one embodiment;

[0046] Figure 2 A flowchart illustrating implementation of private transactions through range proofs according to one embodiment is shown;

[0047] Figure 3 shows an optimized proof process related to verification vectors in one embodiment;

[0048] Figure 4 A schematic diagram showing a blockchain system according to one embodiment;

[0049] Figure 5 A schematic diagram of a data verification system according to one embodiment is shown. DETAILED DESCRIPTION

[0050] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0051] At present, in the blockchain system based on the account model, it is convenient to transfer money between users through blockchain transactions. The account model is a transaction mechanism of the blockchain system, and a typical example includes Ethereum. In this blockchain system, the user of the blockchain independently generates a pair of public and private keys (pk, sk) and publicly registers pk as his or her identity on the chain. At the same time, the user has an account balance on the chain. A user can generate a blockchain transaction, or simply a transaction, declaring that part of the balance v in his account will be sent to another person's account, and use his private key sk to sign the transaction. After receiving the transaction, the consensus node on the chain verifies the signature using the account's public key pk. If it passes, it will check if v≥0. If both are passed, the sender's on-chain account balance will be subtracted from v, and the receiver's on-chain account balance will be added to v. After the on-chain consensus algorithm agrees on the transaction, the corresponding receiver is notified of the existence of the transaction through the blockchain log.

[0052] However, in some scenarios, the transaction amount v and account balance Information such as ciphertext is considered private by users and should not be made public. In order to protect private information, a private transaction scheme is proposed, which is to verify and execute transactions using ciphertext. In order to verify the ciphertext information, zero-knowledge proof is often required.

[0053] Zero-knowledge proof (ZKP) means that the prover can convince the verifier that a statement is correct without providing any useful information to the verifier. Specifically, the prover generates a proof σ of a statement using witness information that only the prover has. The verifier can publicly verify σ to confirm that the prover has the witness of the statement, but cannot obtain any information about the witness.

[0054] Specifically in the scenario of blockchain privacy transactions, range proof is used. Range proof is a special zero-knowledge proof protocol. First, a maximum range [0,v max ], the prover has an amount v and its corresponding ciphertext or commitment c. After generating a range proof σ, the verifier can verify σ and c to determine whether the plaintext v corresponding to c belongs to [0,v max], while not leaking any information of v. This helps to perform necessary verification on the transaction ciphertext in the case of private transactions.

[0055] Figure 1 FIG. 1 is a schematic diagram of a scheme for conducting a private transaction in one embodiment. Figure 1 In the system framework shown, each account has a public key and private key pair (pk, sk) that can be used for homomorphic encryption algorithms, which at least support additive homomorphism. The balance of an account is encrypted with the public key of the account and stored on the chain. In other words, each accounting node of the blockchain (which also acts as a consensus node) maintains the balance status information of all accounts in the form of balance ciphertext.

[0056] Assume there is a sender S whose encryption public and private keys are (pk S ,sk S ), the sender’s encrypted account balance on the chain is The sender needs to send the amount v to the receiver, who uses his own public key pk S and the receiver's public key pk R Encrypt v separately to get the ciphertext and At the same time, the sender generates a zero-knowledge proof σ to prove the ciphertext C S and C R The corresponding plaintexts are the same, v ≥ 0, and

[0057] Next, the sender sends C S , C R The on-chain consensus node verifies the signature and then verifies the authenticity of σ. If both pass, the transaction is confirmed to be valid, recorded on the blockchain, and the addition homomorphic property of the homomorphic encryption algorithm is used to change the on-chain amounts of the sender and receiver. Specifically, in a typical homomorphic encryption algorithm where ciphertext multiplication is equivalent to plaintext addition, the sender's balance can be modified to Modify the receiver's balance to After the transaction is agreed upon by the on-chain consensus algorithm, the corresponding recipient is notified of the existence of the transaction through the blockchain log. The recipient uses his own private key sk R right After decryption, change the local account balance to

[0058] In the above process, the sender needs to at least prove v≥0, Without revealing v, This proof is a range proof. There are some existing technologies that generate zero-knowledge range proofs for single values.

[0059] However, in order to improve the verification efficiency of private transactions, it is also hoped that m different range proofs can be proved at one time using an aggregation protocol, and the number of bits corresponding to the upper bounds of the ranges of these m range proofs can be different. This is a very realistic requirement in practical applications. For example, in some blockchain systems, it is not only required that the account balance is greater than or equal to the transaction amount: It also requires that the ratio of transaction amount to account balance is less than or equal to a certain ratio value p can be expressed in fractional form, that is And the numerator and denominator are limited to integers within a certain range, for example, p1, p2∈[1,15], if p=0.2, then p1=1, p2=5 can be set. In this way, the ratio requirement can also be expressed as: It can be further transformed into That is, the ratio requirement can be converted into a range proof protocol. However, the number of bits in this range proof protocol is significantly different from the number of bits in the amount range, namely

[0060] In response to the above requirements, in an embodiment of the present specification, a range proof for multiple numerical aggregations is provided, wherein the number of bits of each target range may be different.

[0061] The theoretical principle of implementing the above-mentioned range proof of aggregation is first explained below.

[0062] As combined Figure 1 As mentioned above, in the blockchain system framework, each account has a public key and private key pair (pk, sk) under the homomorphic encryption algorithm. Here, it is assumed that twisted-ElGamal is used as the homomorphic encryption algorithm. According to this algorithm, the key generation process is as follows. First, the account randomly selects sk∈Z p As the private key, where Z p is an integer ring modulo p. Then, the public key is calculated based on the private key sk: pk = h sk , where h is a generator in the agreed cyclic group.

[0063] For the plaintext v to be encrypted, the public key pk can be used to encrypt it, and the ciphertext C = (c1, c2) = (g v h r ,pk r ), where g is another generator in the above cyclic group, and r is a random number randomly selected for this encryption. In other words, the ciphertext C encrypted by the public key pk contains two parts, the first part c1 and the second part c2, and the relationship between the two parts satisfies: It should be noted that the generators g and h on which the encryption is based can be agreed upon in advance in the blockchain system.

[0064] Now assume that there are m plaintext values v within the range to be proven in a certain account in the blockchain i , where i = 1, …, m. The account encrypts each plaintext v i under the public key pk into ciphertext C i =(c i,1 , c i,2 ), and makes these ciphertexts public in the blockchain system. Assume that the account needs to convince the verifier through range proof while not leaking any information about v i , where is the target range for each v i . It can be seen here that the target range is generally represented in binary form, where n i is the number of bits corresponding to the binary representation of the target range of v i .

[0065] To achieve the aggregated range proof for the above m values for their respective target ranges, each value v i can first be converted into a binary representation of the corresponding number of bits, i.e., a bit string, and the m bit strings are concatenated in sequence to obtain a numerical vector , where is the binary representation of v i . The dimension of this numerical vector is N, and N is equal to the sum of the m numbers corresponding to the m values, i.e., In addition, for the convenience of expression, denote as the sum of the first i numbers corresponding to the first i values, that is, the position of the end of the bit string corresponding to the i-th value in the numerical vector. Thus, the binary representation corresponding to the i-th value, i.e., corresponding to the subvector composed of the elements in the range [[N L +1:N i-1 +1:N i of the numerical vector a Denote Then proving each is equivalent to proving:

[0066]

[0067] where <a, d> represents the inner product of vectors a and b

[0068] During the implementation of the range proof protocol, assume that an auxiliary vector a L is also generated based on the above numerical vector a R , and the auxiliary vector a R and the numerical vector a L satisfy the following predetermined relationship:

[0069]

[0070] Here, “°” is the Hadamard operator, which means the positional multiplication between two vectors, and the result is a vector with unchanged dimension.

[0071] Based on the above relation (2), if any random number y is applied, the following relation (3) still holds:

[0072]

[0073] Based on the above relation (1), if an arbitrary random number e is applied as follows, the following relation (4) still holds:

[0074]

[0075] in, Yes Pad zeros at the front and back to expand the vector to N dimensions; therefore, Then multiply the left and right sides of equation (1) by the coefficient related to e to obtain equation (4).

[0076] Combining the above equations (3) and (4), and applying an arbitrary random number z, further transformation is performed. Specifically, both sides of equation (4) are multiplied by z. 2 , and since both terms in equation (3) are 0, they are also 0 after applying z. Combining the above results, we can get the following equation (5):

[0077]

[0078] The relationship (5) can be further transformed into the relationship (6):

[0079]

[0080] in, It depends only on the random array (y, z, e) and the number of bits n corresponding to each value. i (Based on the number of digits n i It can be determined ) can be calculated.

[0081] Therefore, the aggregate range proof of m values ​​can be expressed as equation (1), which is ultimately equivalent to proving whether equation (6) holds.

[0082] If the two vectors of the inner product on the left side of equation (6) are called the first basis vector W1 and the second basis vector W2, that is, W1 = a L -z·1 N , Then the inner product result of the first basic vector W1 and the second basic vector W2 can be decomposed into the sum of the first operation value and the second operation value δ(y, z, e), where the first operation value depends on each value v i The second operation value δ(y,z,e) depends only on the random array (y,z,e) and the m-digit number n, which are publicly available information. i .

[0083] Based on the properties of the above relation (6), a range proof scheme for multi-valued aggregation is proposed.

[0084] Figure 2 A flowchart of implementing private transactions through range proof according to one embodiment is shown. The process of the range proof protocol implemented for private transactions is described below in conjunction with the flowchart.

[0085] In step 201, the first device where the first account is located obtains m values ​​v related to the blockchain transaction amount of the first account. i , and the m target ranges to be proved correspond to the m digits n in binary representation i , where i=1,…,m. It should be understood that the first account can be any account in the blockchain system, and the first device is the client device where the account is located. The m values ​​can include one or more transaction amounts, account balances, and transaction ratios determined based on transaction amounts and account balances, as well as other values ​​whose ranges need to be proven in the blockchain scenario, which are not limited here.

[0086] In step 202, the first device sets each value v i Convert it into a bit string of the corresponding number of bits, and obtain a numerical vector by sequentially concatenating m bit strings, that is,

[0087] In step 203, the first device generates an auxiliary vector and performs a blinding operation.

[0088] Specifically, the first device is based on the above numerical vector a L , according to the following relationship (7), an auxiliary vector a having a predetermined relationship with it is generated R :

[0089] a R =a L -1 N (7)

[0090] Obviously, the auxiliary vector a generated in this way R The predetermined relationship shown in relational expression (2) is satisfied.

[0091] In addition, during the blinding operation, the first device also generates a blinding numerical vector aL and auxiliary vector a R The first blinding vector s L and the second blinding vector s R , and generate a reference value A based on the above numerical vector and auxiliary vector, and generate a blinding value S based on the first and second blinding vectors.

[0092] Specifically, the first device uses the following formula (8) according to the numerical vector a L and auxiliary vector a R Generate the benchmark value A:

[0093]

[0094] Where, h is the generator used in encryption, α is a random number randomly selected by the first device, and g,h in bold are N-dimensional vectors formed by the generators in the cyclic group based on encryption, which are called generator vectors. Formula (8) involves exponential operations between vectors, which are defined as follows: vector g = (g1,…,g N ) of the vector l=(l1,…,l N ) is expressed as

[0095] It should be noted that the above generated vectors g, h must satisfy the condition that the discrete relationship is unknown and can be agreed upon in advance in the blockchain system.

[0096] In addition, based on a similar calculation method, the first device generates a blinding value S according to the first and second blinding vectors according to the following formula (9):

[0097]

[0098] Among them, ρ is a random number randomly selected by the first device, and g,h are the aforementioned generated vectors.

[0099] Then, in step 204, the first device may provide the reference value A and the blinded value S to the verification device. The verification device here may be any device in the blockchain system that is expected to verify the m value ranges of the first account. Typically, the verification device may be a device corresponding to an accounting node (or consensus node).

[0100] Next, in step 205, the first device obtains the challenge array (y, z, e). Figure 2 In the embodiment shown, a set of random numbers (y, z, e) is randomly generated by the verification device and sent to the first device, so that the first device receives the random numbers sent by the verification device as a challenge array (y, z, e). It can be understood that the challenge array corresponds to the random numbers y, z, e in the above formula (6).

[0101] Next, in step 206, the first device performs the operation according to the aforementioned numerical vector a L , the m digits, and the challenge array (y, z, e), generate a result polynomial generated by two vector polynomials and their inner product, and generate a first set of commitment values ​​based on the coefficients of the result polynomial and the m ciphertexts corresponding to the m numerical values.

[0102] In a specific embodiment, the first device introduces a blinding vector and a variable X based on the first basis vector W1 and the second basis vector W2, respectively, according to the relationship shown in the above formula (6), thereby generating two vector polynomials. Specifically, in one example, the first blinding vector s can be introduced based on the first basis vector W1. L and variable X, to obtain the first vector polynomial l(X). For example, the first vector polynomial l(X) is constructed according to the following formula (10):

[0103] l(X)=a L -z·1 N +s L ·X (10)

[0104] On the other hand, based on the second basis vector W2, the second blinding vector and the variable X are introduced to generate a second vector polynomial r(X). For example, the second vector polynomial r(X) is constructed according to the following formula (11):

[0105]

[0106] Correspondingly, the inner product of these two vector polynomials produces the resulting polynomial t(X):

[0107] t(X)=〈l(X), r(X)〉=t0+t1·X+t2·X 2 (12)

[0108] It can be understood that the variable X is attached to the blinded vector. Therefore, the constant term t0 in the result polynomial t(X) corresponds to the inner product of the first basis vector W1 and the second basis vector W2. According to the relationship shown in formula (6), the inner product result t0 is equal to

[0109] On the basis of obtaining the above result polynomial, the first device generates a first set of commitment values ​​based on coefficients of the result polynomial.

[0110] In a specific embodiment, the first device generates a first random number τ1 locally based on the coefficient t1 of the first term of the result polynomial t(X), and each value v of the m values j The ciphertext C encrypted under the public key pk of the first account jThe second part of c j,2 The multiplication combination of and the third challenge number e generates a first commitment value T1.

[0111] For example, the first commitment value T1 may be generated according to the following formula (13):

[0112]

[0113] Similarly, the first device can also generate a second random number τ2 locally based on the quadratic term coefficient t2 of the result polynomial t(X), the ciphertext C j The second part of c j,2 , and a third challenge number e, generate a second commitment value T2.

[0114] For example, the second commitment value T2 may be generated according to the following formula (14):

[0115]

[0116] It can be seen that in the calculation of the first commitment value and the second commitment value, the third challenge number e acts on the second part c j,2 on the index.

[0117] Next, in step 207, the first device provides the verification device with the first set of commitment values, ie, the first commitment value T1 and the second commitment value T2.

[0118] Then, in step 208, the first device obtains a random variable value x. Figure 2 In the illustrated embodiment, the variable value x is generated by the verification device and sent to the first device, so that the first device obtains the variable value x.

[0119] Then, in step 209, the first device substitutes the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and the result value, and generates a second set of commitment values.

[0120] Specifically, the first device substitutes the variable value x into the first vector polynomial l(X) to obtain a first verification vector l, that is:

[0121] l=l(x)=a L -z·1 N +s L ·x (15)

[0122] Substitute the variable value x into the second vector polynomial r(X) to obtain the second verification vector r, that is:

[0123]

[0124] Calculate the inner product of the two verification vectors and get the result value

[0125] In addition, the first device can also generate a first verification value τ according to the aforementioned first random number τ1, the second random number τ2, the variable value x, and the private key sk corresponding to the public key pk. x .

[0126] For example, the first verification value τ may be generated as follows x :

[0127] τ x =τ2·x 2 +τ1·x+z 2 ·sk -1 (17)

[0128] Furthermore, the first device may also generate a second verification value μ based on the variable value x and the random numbers α and ρ used when generating the base value A and the blinded value S:

[0129] μ=α+ρ·x (18)

[0130] Based on the above results, the first device can determine a second set of commitment values, which may include the result value Two verification vectors l, r, first verification value τ x , the second verification value μ.

[0131] Then, at step 210, the first device provides the second set of commitment values ​​to the verification device.

[0132] In step 211, the verification device verifies at least m digits n i , the aforementioned first set of committed values ​​and second set of committed values ​​provided by the first device verify whether the m values ​​correspond to the m target ranges.

[0133] In one embodiment, the verification process of the verification device may include: Is it the inner product of the two verification vectors l and r? That is, verify whether the following relationship holds:

[0134]

[0135] In one embodiment, the verification device further performs the following second verification process: Based on the previously obtained reference value A, blinding value S, challenge array (y, z, e), the m digits n i , calculate and obtain the first calculated value P. For example, P can be calculated as follows:

[0136]

[0137] in,

[0138] On the other hand, according to the two verification vectors l, r, a second calculated value V2 is calculated. For example, V2 can be calculated as follows:

[0139] V2=h μ g l (h′) r (21) Then verify whether the first calculated value P is equal to the second calculated value V2, that is, verify:

[0140]

[0141] It can be proved that if the first device constructs the basic value A, the blinded value S, and the two verification vectors l and r according to the above process, the above relationship (22) must be established. Specifically, the basic value A and the blinded value S in formulas (8) and (9) can be substituted into formula (20), and then the vectors g and h′ are generated for the generator h respectively, and the exponents on the left and right sides of the relationship (22) are verified to be equal.

[0142] For example, for the generator h, through the calculation process of the first calculation value P, the exponent of h can be obtained as α+ρx, while the exponent of the generator in the second calculation value V2 is μ; according to the relationship (18), the two are equal. For the generator vector g, through the calculation process of the first calculation value P, the exponent of g can be obtained as a L -z+s L x; and the exponent of g in the second calculated value V2 is l; according to equation (15), the two are equal. A similar verification can be performed for h′.

[0143] By verifying equation (22), it can be determined whether the first device has constructed the base value A, the blinded value S, and the two verification vectors l, r according to the agreement.

[0144] In one embodiment, the verification device further performs the following third verification process.

[0145] According to the obtained verification value τ x , the result value The aforementioned second operation value δ, the third challenge number e, the second part c of the m ciphertexts j,2 , a third calculated value V3 is calculated, wherein the third challenge number e acts on the exponent of the second part. For example, V3 can be calculated as follows:

[0146]

[0147] On the other hand, the verification device can also obtain the first commitment value T1, the second commitment value T2, the variable value x, the third challenge number e, and the first part c of the m ciphertexts. j,1, a fourth calculated value V4 is calculated, wherein the third challenge number e acts on the exponent of the first part. For example, V4 can be calculated as follows:

[0148]

[0149] Then, verify whether the third calculated value V3 is equal to the fourth calculated value V4, that is, verify:

[0150]

[0151] It can be proved that if the m values ​​satisfy the target range, that is, they meet the relation (6), then the relation (25) must be established.

[0152] Specifically, for each value v j For the ciphertext, the first part c j,1 and Part IIc j,2 Satisfying relationship between:

[0153]

[0154] The above relationship (26) can be used to convert the c in (24) into j,1 The term with base is transformed into the generator g and c j,2 Substitute the formula (13) for calculating T1 and the formula (14) for calculating T2 into the right side of (25), respectively. Then, for different base terms, we can verify whether the exponents on both sides of the relationship (25) are equal.

[0155] For example, for the base term Through the calculation process of the fourth calculated value V4, its exponent can be obtained as τ1x+τ2x 2 +z 2 ·sk -1 , and the exponent of the base term in the third calculated value V3 on the left is τ x ; According to equation (17), the two are equal.

[0156] For the generator g, through the calculation process of the fourth calculated value V4, its exponent can be obtained as The exponent of the generator g in the third calculated value V3 on the left is Furthermore, combined with formula (12), we have:

[0157]

[0158] And, as mentioned above, according to the relationship shown in formula (6), the value of the constant term t0 is equal to Therefore, it can be seen that the exponents of the generators g on both sides of equation (25) are also equal.

[0159] By verifying the relation (25), it can be determined whether the m values ​​of the first device are within the declared m digits n i The range of m targets is defined.

[0160] Looking back at the above process, the information generated by the first device and provided to the verification device, from the basic value A, the blinded value S, to the first set of committed values ​​and the second set of committed values, will not leak the individual values ​​v i This allows the verification device to verify the target range of each value at once without knowing the size of each value, thus realizing aggregated zero-knowledge range proof. In addition, the above scheme has no restrictions or requirements on the number of digits of the values ​​m to be proved, so it can support the verification of multiple ranges with different digits.

[0161] In some zero-knowledge proof schemes involving encryption, in addition to the interaction involving the commitment value, the prover often needs to send information such as the random number r used for encryption to the verifier through a secure channel. Figure 2 In the scheme shown, the private key sk is used as one of the witnesses, and the third challenge number e is introduced to aggregate the ciphertexts of various values ​​to realize the verification of encryption-related information without the need to additionally transmit the encrypted random number r.

[0162] Need to understand, Figure 2 An example implementation scenario of range proof is shown, in which the first device obtains the challenge array and variable values ​​by interacting with the verification device and provides each commitment value to it. In another implementation scenario, the above-mentioned aggregated range proof can also be implemented in a non-interactive manner.

[0163] Specifically, in the blockchain system, some data generators can be agreed upon, such as pseudo-random number generators, generators based on hash functions, etc. Using the agreed generators, the same random numbers can be generated based on the same data source. Figure 2In step 205, when the first device needs to obtain a challenge array, the first device can generate a challenge array (y, z, e) according to the agreed first generator and the public first data source. The public first data source can be data disclosed in the blockchain system, or it can be the result of a previous calculation by the first device. For example, after the first device calculates the base value A and the blinded value S, the two values ​​can be used as random seeds and input into a pseudo-random number generator to obtain a challenge array. Similarly, in step 208, when the first device needs to obtain a variable value x, it can generate the variable value x according to the agreed second generator and the public second data source. The second generator can be the same generator as the aforementioned first generator, or it can be a different generator, which is not limited here. The second data source can be data disclosed in the blockchain system, or it can be the result of a previous calculation by the first device, such as a first set of commitment values.

[0164] As above, the first device obtains the challenge array and the variable value x in a non-interactive manner. In addition, after step 209, the first device generates a zero-knowledge proof σ based on the result calculated in the previous step and uploads it to the blockchain. The zero-knowledge proof σ may include the base value A, the blinded value S, the first group of commitment values, the second group of commitment values, etc.

[0165] In this way, any verification device in the blockchain system, for example, each accounting node, can obtain the above zero-knowledge proof σ from the blockchain and verify it. When the challenge array (y, z, e) is needed, the verification device generates the challenge array (y, z, e) according to the agreed first generator and first data source. For example, the base value A and the blinded value S are read from the zero-knowledge proof, used as random seeds, and input into the agreed pseudo-random number generator to obtain the challenge array. Since the generator and data source based on are the same, the verification device can generate the same challenge array as the first device. When the variable value x is needed, the verification device similarly generates the variable value x according to the agreed second generator and second data source, which will not be repeated.

[0166] In this way, the first device does not have to interact with each verification device one by one to generate a zero-knowledge proof corresponding to each verification device; instead, it generates a universal zero-knowledge proof in a non-interactive manner and publishes it to the blockchain, so that after each verification device obtains the zero-knowledge proof from the blockchain, it can verify the numerical range based on the zero-knowledge proof, thereby further improving the verification efficiency.

[0167] It can be understood that based on the above zero-knowledge proof, i.e., the aggregated range proof, each verification device in the blockchain system verifies the target range of the m values. When each verification device passes the verification, the accounting node determines the transaction related to the m values ​​as a valid transaction and writes it into the blockchain, thereby realizing private transactions.

[0168] Further, during the execution of the protocol proven within the above aggregation scope, the maximum amount of data stored and transmitted comes from the N-dimensional vectors l and r. Specifically, 2N numbers need to be stored and transmitted. When the number of values to be proven is large, or the number of bits corresponding to the target range is large, the above N dimension is large. Thus, the storage space required for vectors l and r and the communication cost for transmission are both relatively large. Therefore, to further optimize performance, it is desirable to optimize the storage and transmission of the above vectors.

[0169] Returning to Figure 2 , it can be seen that the first device provides vectors l and r to verify that the verification device can calculate the inner product <l, r> of the two, thereby verifying formula (19), and calculating g l h r (here h is equivalent to h' in formula (21). For the sake of generality and convenience of description, it will be denoted as h hereinafter), thereby verifying formula (22). To simplify storage and transmission, this problem can be transformed into that the first device directly provides the auxiliary values Q = g l h r and c = <l, r> to the verification device, and proves that it knows the vectors l and r that satisfy the auxiliary values Q = g l h r and c = <l, r>. Further, Q = g l h r and c = <l, r> these two proof targets can be transformed, through parameters whose discrete relationship with g and h is unknown, into the first device convincing the verification device that it knows the vectors l and r that satisfy Q = g l h r ·u ＜l,r＞ .

[0170] Optionally, in one embodiment, to ensure the randomness of parameter u, the verification device randomly selects and provides it to the first device. The first device updates u based on x ip as: and updates the value of the above Q based on the updated u, and then starts the subsequent proof. The process of the proof is as Figure 3 shown.

[0171] Figure 3 shows an optimized proof process related to the verification vector in one embodiment. During the proof process of Figure 3 , if the dimension N of l and r is odd, then in step 301, the verification device randomly selects and sent to the first device. For the convenience of distinction, t is referred to as the third random value. In step 302, the first device uses the third random number t to pad the dimensions of l and r to an even number, that is, t is used as the last element of each vector to expand to obtain an N+1-dimensional vector. In addition, g, whose discrete relationship with g and h is unknown, is also used. N , The dimensions of g and h are padded to be even numbers. In step 303, the proof target Q and c are updated as follows according to the random number t:

[0172]

[0173] If the dimension N of l and r is an even number, the above steps 301-303 are skipped and the following vector dimension reduction proof protocol with an even dimension is directly performed. Through the vector dimension reduction proof protocol, the first device generates two intermediate values ​​L and R and two N / 2-dimensional sub-vectors l' and r' based on the N-dimensional verification vectors l and r, and uses them to replace the N-dimensional verification vector as part of the second set of commitment values ​​for verification of the verification device.

[0174] Specifically, in step 304, the first device generates vectors g and h, verifies that each of vectors l and r is split into front and rear sub-vectors of equal dimensions, and calculates the first intermediate value L and the second intermediate value R based on the index combination of these sub-vectors and the aforementioned parameter u. Specifically, the first device may calculate the first and second intermediate values ​​L and R as follows:

[0175]

[0176] in, It is half the value of dimension N. The subscript [:n'] represents the first half of the N-dimensional vector from the starting element to the n'th element; [n'+1:] represents the second half of the N-dimensional vector from the n'+1th element to the last element.

[0177] In step 305, the first device sends the first intermediate value L and the second intermediate value R to the verification device.

[0178] In step 306, the verification device randomly selects And send it to the first device. It should be noted that x here is Figure 2 The variable value in is irrelevant, but is recorded as x for simplicity and convenience of notation. It is referred to as the fourth random value below.

[0179] In step 307, the first device generates an N / 2-dimensional first subvector l' according to the front and back subvectors of the first verification vector l and the fourth random value; and generates an N / 2-dimensional second subvector r' according to the front and back subvectors of the second verification vector r and the fourth random value. For example, the first device generates the first subvector l' according to the following formula (30), and generates the second subvector r' according to the following formula (31):

[0180] l′=x·l [：n′] +x -1 ·l [n′+1：] (30)

[0181] r′=x -1 ·r [：n′] +x·r [n′+1：] (31)

[0182] In step 308 , the first device sends the first sub-vector and the second sub-vector to the verification device.

[0183] In step 309, the authentication device performs authentication.

[0184] Specifically, the verification device obtains two generated sub-vectors based on the combination of the front and back sub-vectors of the generated vector, and obtains the fifth calculated value P' based on the exponential operation of the two generated sub-vectors with the first sub-vector and the second sub-vector. More specifically, the N / 2-dimensional first generated sub-vector g' and the second generated sub-vector h' can be obtained as follows:

[0185]

[0186]

[0187] Based on the above two generated sub-vectors and the first sub-vector and the second sub-vector, the fifth calculated value P' is calculated according to the following formula (33):

[0188]

[0189] In addition, the verification device also calculates a sixth calculated value V6 based on the exponential operation combination of the front and rear sub-vectors of the generated vector and the first sub-vector and the second sub-vector. For example, V6 is calculated according to the following formula (34):

[0190]

[0191] Next, the verification device verifies whether the fifth calculated value P' is equal to the sixth calculated value V6, that is, verifies whether the following relationship (35) holds:

[0192]

[0193] If the verification is passed, the verification device can determine that the first device knows that Q satisfies Q = g l h r and the vectors l and r of c = <l, r>.

[0194] Through the above process, the first device can use the first and second intermediate values L, R, and two N / 2-dimensional sub-vectors l' and r' to replace l and r for storage and transmission, reducing the 2N-dimensional storage to 2n'+2-dimensional storage.

[0195] Furthermore, it can be seen that l' and r' can form a new proof target The above dimension reduction proof scheme can be continuously iterated and compressed. The final storage can be reduced from 2N to

[0196] It should be noted that the above Figure 3 is described by taking the scenario of interaction between the first device and the verification device as an example. This scenario can also be similarly converted into a non-interactive scenario, and the conversion method is as described above, so it will not be elaborated here.

[0197] Through the above method, by reducing the storage and transmission costs of the two verification vectors, the aggregated range proof is further optimized.

[0198] Furthermore, it can be understood that although the above describes the process of aggregated range proof for multiple values in the context of privacy transactions in a blockchain system, the above aggregated range proof process can also be applied to other scenarios that require zero-knowledge proof of numerical ranges. For example, in the scenario of privacy-preserving federated learning, in order not to disclose their respective private data, the data holder and the model trainer need to jointly train the model based on encrypted data. However, before or during the training, the data holder may need to prove to other participants, especially the model trainer, through zero-knowledge proof that the provided training data is legal data within a certain numerical range. In such a case, the data holder can be regarded as the Figure 2 first device in Figure 2 , and the model trainer can be regarded as the Figure 2 verification device in

[0199] According to an embodiment of another aspect, a blockchain system for realizing privacy transactions based on range proof is provided. Figure 4A schematic diagram of a blockchain system according to an embodiment is shown, which includes at least a first device 41 where a first account is located, and a verification device 42. The first device 41 is configured to obtain m numerical values ​​related to the blockchain transaction amount of the first account, and m target ranges to be proved corresponding to m digits in binary representation; convert each numerical value into a bit string of corresponding digits, and obtain a numerical vector by sequentially splicing m bit strings; obtain a challenge array; generate a result polynomial generated by two vector polynomials and their inner product according to the numerical vector, the m digits, and the challenge array, and generate a first set of commitment values ​​based on the coefficients of the result polynomial; obtain a random variable value x; substitute the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and a result value, and generate a second set of commitment values, which at least includes the result value and vector data related to the two verification vectors.

[0200] The verification device 42 is configured to verify whether the m numerical values ​​correspond to and belong to the m target ranges based on at least the m digits, the first set of committed values ​​and the second set of committed values.

[0201] In one embodiment, the first device 41 may further include the following modules to implement its functions. Specifically, the first device 41 may include:

[0202] A first acquisition module 411 is configured to obtain m numerical values ​​related to the blockchain transaction amount of the first account, and the m target ranges to be proved correspond to m digits in binary representation;

[0203] The bit processing module 412 is configured to convert each numerical value into a bit string of corresponding bits, and obtain a numerical vector by sequentially concatenating m bit strings;

[0204] A challenge number acquisition module 413, configured to acquire a challenge array;

[0205] A first commitment module 414 is configured to generate a result polynomial generated by two vector polynomials and their inner product according to the numerical vector, the m digits, and the challenge array, and generate a first set of commitment values ​​based on coefficients of the result polynomial;

[0206] A variable value acquisition module 415 is configured to acquire a random variable value x;

[0207] The second commitment module 416 is configured to substitute the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and a result value, and generate a second set of commitment values, which at least includes the result value and vector data related to the two verification vectors.

[0208] Through the above blockchain system, private transactions based on range proofs can be realized, which supports zero-knowledge range proofs for multiple values ​​and multiple different range aggregations.

[0209] According to yet another aspect of an embodiment, a privacy-preserving data verification system is provided. Figure 5 A schematic diagram of a data verification system according to an embodiment is shown, which includes a first device 51 and a verification device 52. In one example, the first device 51 may be a data provider in a federated learning scenario, and the verification device 52 may be a model trainer. In another example, the first device 51 and the verification device 52 may be participants in multi-party secure computing.

[0210] To perform privacy-preserving data verification, the first device 51 is configured to obtain m numerical values ​​to be proved and m target ranges to be proved corresponding to m digits in binary representation; convert each numerical value into a bit string of the corresponding digit, and obtain a numerical vector by sequentially concatenating the m bit strings; obtain a challenge array; generate a result polynomial generated by two vector polynomials and their inner product based on the numerical vector, the m digits, and the challenge array, and generate a first set of commitment values ​​based on the coefficients of the result polynomial; obtain a random variable value x; substitute the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and a result value, and generate a second set of commitment values, which at least includes the result value and vector data related to the two verification vectors.

[0211] The verification device 52 is configured to verify whether the m numerical values ​​correspond to and belong to the m target ranges based on at least the m digits, the first set of committed values ​​and the second set of committed values.

[0212] Through the above data verification system, data verification based on range proof can be realized, which supports zero-knowledge range proof for multiple values ​​and multiple different range aggregations.

[0213] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute Figure 2 A method performed in a first device and / or a verification device.

[0214] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, Figure 2 A method performed in a first device and / or a verification device.

[0215] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0216] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for implementing private transactions based on range proof in a blockchain, comprising: The first device where the first account is located obtains m numerical values ​​related to the blockchain transaction of the first account, and the m target ranges to be proved correspond to m digits represented in binary; Convert each numerical value into a bit string of corresponding digits, and obtain a numerical vector by sequentially concatenating m bit strings; Get the challenge array; Generate a result polynomial generated by two vector polynomials and their inner product according to the numerical vector, the m digits, and the challenge array, and generate a first set of commitment values ​​based on coefficients of the result polynomial; Get a random variable value x; Substituting the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and a result value, and generating a second set of commitment values, which at least includes the result value and vector data related to the two verification vectors; The m digits, the first set of commitment values ​​and the second set of commitment values ​​are sent to a verification device so that the verification device verifies whether the m numerical values ​​correspond to and belong to the m target ranges.

2. The method according to claim 1, wherein: Acquiring the challenge array includes receiving the challenge array generated by the verification device from the verification device; Obtaining a random variable value x includes receiving a variable value x generated by the verification device from the verification device; The method also includes sending the first set of commitment values ​​and the second set of commitment values ​​to the verification device.

3. The method according to claim 1, wherein: Acquiring the challenge array includes generating the challenge array according to an agreed first generator and a public first data source; Acquiring a random variable value x includes generating the variable value x according to an agreed second generator and a public second data source; The method further includes: the first device generating a zero-knowledge proof based at least on the first set of commitment values ​​and the second set of commitment values, and uploading the zero-knowledge proof to a blockchain; The verification device obtains the zero-knowledge proof from the blockchain.

4. The method according to claim 1, wherein: The verification device is a device corresponding to the accounting node. The method also includes, when the verification device verifies that the m numerical values ​​correspond to the m target ranges, writing transactions related to the m numerical values ​​into the blockchain.

5. The method according to claim 1, wherein: The m numerical values ​​include one or more of the following: transaction amount, account balance, and a transaction ratio value determined based on the transaction amount and account balance.

6. The method according to claim 1, wherein: The two vector polynomials are generated based on a first basis vector and a second basis vector, respectively; wherein the inner product result of the first basis vector and the second basis vector is equal to the sum of a first operation value and a second operation value δ, wherein the first operation value depends on the m numerical values, and the second operation value only depends on the challenge array and the m digits.

7. The method according to claim 6, further comprising: generating an auxiliary vector having a predetermined relationship with the numerical vector; generating first and second blinding vectors for obfuscating the numerical vector and the auxiliary vector; A reference value A is generated according to the numerical vector and the auxiliary vector, and a blinding value S is generated according to the first and second blinding vectors.

8. The method according to claim 7, wherein: The generating of two vector polynomials comprises: Introducing a first blinding vector and a variable based on the first basis vector to obtain a first vector polynomial; A second blinding vector and a variable are introduced based on the second basis vector to obtain a second vector polynomial.

9. The method according to claim 8, wherein: Verifying whether the m values ​​correspond to the m target ranges includes: Calculate a first calculated value according to the reference value A, the blinding value S, the challenge array, and the m digits; Calculate a second calculated value according to the two verification vectors; Verify that the first calculated value is equal to the second calculated value.

10. The method according to claim 6, wherein: The challenge array includes a third challenge number e; generating a first set of commitment values, including: Generate a first commitment value T1 according to the coefficient of the first-order term of the result polynomial, the locally generated first random number, the second part of the m ciphertexts of the m values ​​each encrypted under the public key pk of the first account, and the third challenge number; A second commitment value T2 is generated based on the coefficient of the quadratic term of the result polynomial, a locally generated second random number, the second part of the m ciphertexts, and the third challenge number, wherein in the calculation of the first commitment value and the second commitment value, the third challenge number e acts on the exponent of the second part.

11. The method according to claim 10, wherein: Generate a second set of commitment values, including: Generate a verification value τx according to the first random number, the second random number, the variable value x, and a private key sk corresponding to the public key; A second group of commitment values ​​is determined, which includes at least the verification value τx, the result value, and the two verification vectors.

12. The method according to claim 11, wherein: Verifying whether the m values ​​correspond to the m target ranges includes: A third calculated value is calculated according to the verification value τx, the result value, the second operation value δ, the third challenge number e, and the second part of the m ciphertexts; wherein the third challenge number e acts on the exponent of the second part; A fourth calculated value is calculated according to the first commitment value T1, the second commitment value T2, the variable value x, the third challenge number e, and the first part of the m ciphertexts; the third challenge number e acts on the exponent of the first part; Verify whether the third calculated value and the fourth calculated value are equal.

13. The method according to claim 1, further comprising: The first device processes the dimensions N of the two verification vectors to be an even number; Based on two N-dimensional verification vectors, two intermediate values ​​and two N / 2-dimensional sub-vectors are generated; The vector data includes the two intermediate values, and the two sub-vectors.

14. The method according to claim 13, wherein: The first device processes the dimensions N of the two verification vectors to be an even number, including: When the original dimensions of the two verification vectors are odd numbers, obtaining a third random value; The third random value is used as an additional vector element and is added to the two verification vectors respectively to obtain a verification vector with an even dimension.

15. The method according to claim 13, wherein: The two verification vectors include a first verification vector and a second verification vector; the generating of two intermediate values ​​and two sub-vectors of N / 2 dimension includes: Splitting the agreed two N-dimensional generation vectors and the two verification vectors into N / 2-dimensional front and back sub-vectors, and calculating the first intermediate value and the second intermediate value based on the exponential combination of these sub-vectors and the agreed parameters; Get a fourth random value; Generate a first sub-vector of N / 2 dimension according to the front and back sub-vectors of the first verification vector and the fourth random value; A second sub-vector of dimension N / 2 is generated according to the preceding and following sub-vectors of the second verification vector and the fourth random value.

16. The method according to claim 15, wherein: Verifying whether the m values ​​correspond to the m target ranges includes: Based on the combination of the front and rear sub-vectors of the two generated vectors, two generated sub-vectors are obtained, and based on the exponential operation of the two generated sub-vectors with the first sub-vector and the second sub-vector respectively, a fifth calculated value is obtained; A sixth calculated value is calculated based on the exponential operation combination of the preceding and following sub-vectors of the two generated vectors with the first sub-vector and the second sub-vector respectively; When the fifth calculated value is equal to the sixth calculated value, it is determined that the auxiliary value provided by the first device is obtained based on the two verification vectors, and the m target ranges are verified based on the auxiliary value.

17. A blockchain system for implementing private transactions based on range proof, comprising at least a first device where a first account is located, and a verification device, wherein: The first device is configured to obtain m numerical values ​​related to the blockchain transaction amount of the first account, and m target ranges to be proved corresponding to m digits in binary representation; convert each numerical value into a bit string of corresponding digits, and obtain a numerical vector by sequentially splicing the m bit strings; obtain a challenge array; generate a result polynomial generated by two vector polynomials and their inner product according to the numerical vector, the m digits, and the challenge array, and generate a first set of commitment values ​​based on the coefficients of the result polynomial; obtain a random variable value x; substitute the variable value x into the two vector polynomials and the result polynomial to obtain two verification vectors and a result value, and generate a second set of commitment values, which at least includes the result value and vector data related to the two verification vectors; The verification device is configured to verify whether the m numerical values ​​correspond to the m target ranges based on at least the m digits, the first group of committed values ​​and the second group of committed values.

Images