A gpu parallel acceleration method for zk-snark operation

Abstract

The application discloses a GPU parallel acceleration method for zk-SNARK operation, a CPU executes an input and output task, reads to-be-processed data into a memory, the CPU executes a Prescan process, divides an index according to a given base, and separates the base corresponding to the index; the CPU allocates memory space and a bucket array for a GPU, and puts the base into a bucket; the GPU executes BucketMul calculation according to the bucket data, and completes product calculation of data in each bucket; the GPU uses the value of the completed product calculation in the bucket to execute WindowReduce operation, and performs product calculation among groups between the buckets; the GPU integrates the value of each bit, executes a FinalReduce process, makes the index corresponding to the bit complete self-multiplication, and multiplies the numerical value after the self-multiplication to obtain a final result. The application is implemented on the GPU, and can better support the demand of large-scale data calculation and processing.

Description

Technical Field

[0001] This invention belongs to the field of encryption technology, specifically relating to a GPU parallel acceleration method for zk-SNARK operations. Background Technology

[0002] Zero-Knowledge Proofs (ZKPs) are a commonly used privacy protection method in cryptography. First proposed by S. Goldwasser, S. Micali, and C. Rackoff, their core is the construction of a zero-knowledge system. The proof process mainly involves two participants: the prover (P) and the verifier (V). Suppose P possesses some information X and wants to prove to V that P indeed possesses X. If a protocol can prove to V that P indeed possesses X, while V has no information about X itself, then this protocol is called a zero-knowledge proof protocol. Zero-knowledge proofs must satisfy the following conditions:

[0003] 1. Correctness: If P does not possess X, the probability that P makes V believe that P possesses X is very low.

[0004] 2. Completeness: If P possesses X, P can make V believe with an overwhelming probability that P possesses X.

[0005] 3. Zero knowledge content: V cannot acquire any additional knowledge, especially not X.

[0006] Generally speaking, zero-knowledge proofs construct a proof system based on probabilistic methods. Theoretically, the success rate of P forging X to gain V's trust converges to zero according to the measure; in practice, however, it is an extremely low probability event.

[0007] zk-SNARK is short for zero-knowledge succinct non-interactive arguments of knowledge. Compared to general interactive zero-knowledge proofs, zk-SNARK is concise and non-interactive, meaning that the verification information of zk-SNARK is relatively short and does not require multiple question-and-answer interactions. Currently implemented algorithms for zk-SNARK include Groth16, GM17, and BCTV14. Among them, the Groth16 algorithm has the advantages of fast verification speed and short proof string, but its trusted initialization overhead is relatively large. The implementation of the Groth16 algorithm can be described as follows: (1) Establishing the conversion relationship from R1CS to QAP; (2) Setup stage; (3) Prove stage; (4) Verify stage. In the stage of establishing the conversion relationship from R1CS to QAP, R1CS (Rank 1 Constraint System) is essentially a matrix and vector representation of logic circuits; QAP (Quadratic Arithmetic Program) is essentially a polynomial function composed of matrices and vectors, and Lagrange interpolation is used in the process of converting matrices into polynomial functions. In the setup stage, constants α, β, γ, δ, and x are randomly selected from a range, and x is substituted into the polynomial calculation. Homomorphic hiding of data is performed using elliptic curves, and the following parameters are published: [α]1, [β]2, [γ]1, [δ]1, [δ]2. And the powers of x after homomorphic hiding [x]1, [x] 2 ]1,…[x n ]1 is used as the public string. And the vector Cut the slice at point l into two segments, for example Cut into In the Prove phase, the prover uses public strings and their own private evidence. Randomly select constants r and q within a range to calculate [A]1, [B]2, and [C]1 as proofs and send them to the verifier. Here, t(x) is the modulo polynomial used when selecting the finite field of the elliptic curve. During the Verify phase, the verifier verifies the following expression based on the common string and the proposition.

[0008] GPUs (Graphics Processing Units) originated from users' demands for high-quality graphics. By freeing the CPU from graphics rendering, they improved image quality and freed up CPU computing power. GPU cores are much lighter than CPU cores. They constrain the computation of large amounts of data of the same type that can be parallelized and are independent of each other, greatly reducing the use of control circuitry and cache on chip resources. This allows for a far greater number of cores than CPUs with the same chip resources and power, achieving high-performance parallel computing capabilities far exceeding those of traditional CPUs.

[0009] Currently, the main implementations of zero-knowledge proofs based on zk-SNARK are as follows:

[0010] CPU Implementation: libsnark is an open-source library that implements the zk-SNARK algorithm, developed by SCIPR Lab. It supports the construction and transformation of various constraint systems, various elliptic curves, and various zk-SNARK algorithms. The bellman project, developed by the ZCash team using Rust, is also an open-source library that implements various zk-SNARK algorithms and is used to update the zero-knowledge proof algorithms in ZCash.

[0011] Dedicated circuits: Existing technologies utilize ASICs to implement dedicated circuits for NTT and Multiexp operations in zk-SNARK, achieving speedup ratios of over 5.8 through CPU-ASIC heterogeneous computing. The open-source project Fpga_snark_prover attempts to accelerate zk-SNARK on the bn-128 curve using CPU-FPGA heterogeneous computing. While this project has not yet completed a fully usable proof system, the core algorithm appears to have achieved excellent speedup results. Although FPGA and ASIC solutions offer very high speedup ratios and power consumption performance far exceeding that of CPU-GPU solutions, the introduction of dedicated circuits means they cannot be easily run on most computers. Furthermore, their inherent portability is relatively poor, requiring significant investment of human and material resources for design and development to suit different scenarios.

[0012] GPU acceleration solutions: CPU-GPU heterogeneous computing can be executed directly on most machines with GPUs. Furthermore, CUDA programming offers high versatility and scalability, with development costs far lower than hardware development. Therefore, research on CPU-GPU heterogeneous computing acceleration is also very important. Existing technologies have used CPU-GPU heterogeneous computing to accelerate the calculation of constraint circuits in proof systems using the zk-SNARK algorithm, specifically PoRep, Winning Post, and Window Post, achieving speedups of 4.2, 1.19, and 1.5 respectively on an AMD Threadripper 3970x + RTX 2080 Ti. Existing technologies have also used CPU-GPU heterogeneous computing to accelerate the calculation of constraint circuits in Bulletproofs, achieving a speedup of 3.66 on an Intel Xeon Gold 6230 + RTX 2080 Ti.

[0013] Zero-knowledge proofs and zk-SNARKs can be applied to data privacy protection in various fields. In the blockchain field, zk-SNARKs in Zerocash help users authenticate and execute transactions while hiding their true identities and specific transactions, preventing user information from being exposed on the public internet. In Filecoin, zk-SNARKs are used to prove that storage service providers are performing storage tasks, verifying the authenticity and validity of data storage without providing the user's stored data. In the field of online voting, zk-SNARKs can be used to maintain the privacy of voters, preventing the leakage of voters' personal data and voting information to the public internet. zk-SNARKs first convert the data to be executed (such as database information, images, files, etc.) into a high-dimensional vector that can be executed by the algorithm through circuit transformation, and then take measures to establish the transformation relationship from R1CS to QAP on the vector. The computational task is described below. Right now A concrete representation of multiplication, in which Private evidence possessed by the witness. They are vector-valued polynomials. Summary of the Invention

[0014] The technical problem to be solved by the present invention is to provide a GPU parallel acceleration method for zk-SNARK operations, which is better than existing methods and solves the problems of weak scalability and poor performance in large-scale operations of existing libsnark GPU optimization methods.

[0015] To achieve the above-mentioned technical objectives, the technical solution adopted by the present invention is as follows:

[0016] A GPU parallel acceleration method for zk-SNARK operations includes:

[0017] Step (1): The CPU executes the input / output task, reads the data to be processed into memory, and executes the Prescan process to divide the exponent according to the given base and separate the base of the corresponding exponent; where the input / output task refers to the multi-point addition task on the finite field of the elliptic curve. And give the results M, P1…P N Let a1…a be the base. N These are the corresponding indices for each item; the data to be processed is then input.

[0018] Step (2): The CPU allocates memory space and a bucket array for the GPU and puts the base number into the bucket;

[0019] Step (3): The GPU performs BucketMul calculation based on the bucket data, and completes the product calculation of the data within each bucket;

[0020] Step (4): The GPU uses the value of the completed product calculation within the bucket to perform the WindowReduce operation to realize the calculation of the product of all bases within the inter-bucket group, that is, the product of all bases at a certain digit of the exponent.

[0021] Step (5): Based on the results of the previous step, the GPU integrates the values ​​of each bit and executes the FinalReduce process to make the exponents of the corresponding bits multiply by themselves, and then multiplies the multiplied values ​​to obtain the final result.

[0022] To optimize the above technical solution, the specific measures also include:

[0023] The specific process of step (1) above is as follows:

[0024] In step (1.1), the CPU executes the input / output task to read the data to be processed into memory, and then executes the Prescan task to calculate the T value for each bucket. im The element index is stored within the GPU design, and a storage area is allocated for it.

[0025] Step (1.2) uses a one-time allocation method, using a tag array to record the start and end positions of the index cache area corresponding to each bucket, thereby dividing the index cache area of ​​each bucket.

[0026] In step (1.1) above, according to The calculation content was analyzed, and it was found that T im If i is the same, then they belong to the same R. i The buckets, when combined, form the entire set of inputs P1, P2, ..., P. N ;R i The number of exponents is 2. C Number of bases Therefore, a common allocation is required. The space of each index. In the above operations, assume P1…P N The base is , and the Multiexp operation has N terms, where each exponent is a binary number of B bits, and each C bits are grouped together.

[0027] In step (1.2) above, the position of each input in the bucket is determined based on the value of the exponent. For k = 0 to N, the input exponent a is obtained by right shifting and taking the AND operation. k In 2 C The value of the i-th digit in the base b ki Then index k should be placed in the bucket. The index cache area.

[0028] The specific process of step (2) above is as follows:

[0029] Step (2.1), CPU allocation The index cache idxbuf for each index is allocated. The start and end positions of each index are recorded in the marker array `searr`.

[0030] Step (2.2) involves scanning the input to count the number of elements in each bucket, filling the searcher array based on the element count information, scanning the input again, and combining this with the bucket count recorded in the searcher array. The starting position is where index k is actually placed in the corresponding position of idxbuf.

[0031] The BucketMul calculation described in step (3) above is completed using the multi-threading capabilities of the GPU, with one thread corresponding to each bucket. Therefore, bucket T... ij It should correspond to the i*2nd C +j threads, each thread reads the index from the idxbuf area belonging to the corresponding bucket, retrieves the data from the input based on the index, multiplies it by the result, and returns it.

[0032] The specific process of step (4) above is as follows:

[0033] In step (4.1), WindowReduce needs to compute... R i The computational task is assigned to the i-th thread for completion, requiring a total of [number] threads. There are several threads; after assigning tasks to each thread, the product of the data is calculated using the concept of cumulative multiplication, with the following formula:

[0034]

[0035] Step (4.2) implements R iResult calculation: Multiply the RunningSum process by the sum in R. i And iterate.

[0036] The above step (4.2) first involves setting the variable RunningSum and R... i Initialize to identity element, then from Traverse to T i1 T will be placed in each round. ij Ride onto RunningSum, and then ride RunningSum onto R. i Once the traversal is complete, the final required R is obtained. i .

[0037] The specific process of step (5) above is as follows:

[0038] Step (5.1), FinalReduce uses single-threaded computation. Using the concept of cumulative multiplication, the product operation is performed as follows:

[0039]

[0040] Step (5.2) initializes M as the identity element from R. W Iterate to R0, then process each round of R... i Multiply by M, and multiply M by itself C times. After traversing all the steps, you will get the final M.

[0041] The present invention has the following beneficial effects:

[0042] Existing GPU optimization methods for Groth16 zk-SNARK use the Strauss method, which suffers from insufficient parallelism, inability to handle large-scale data, low computational efficiency, and limited applicability. This invention addresses the problems of existing Groth16 zk-SNARK GPU optimization methods by designing a CPU-GPU hybrid architecture for zk-SNARK acceleration based on Pippenger's fast exponentiation calculation. The main task of this invention is to complete the Multiexp calculation. The implementation method is to first use 2 to transform the exponents of each term of length B in binary. C The system uses a number system representation, then generates basic computational buckets based on the number of exponents, and finally merges the buckets to complete the final computation task. This improves the GPU's ability to handle large-scale zk-SNARK computations. Furthermore, this invention designs a CPU Prescan scheme, leveraging the advantages of different hardware devices in a CPU-GPU heterogeneous system to achieve reasonable allocation of computational tasks and reduce computational time overhead. Attached Figure Description

[0043] Figure 1This is an example diagram of the Pippenger algorithm calculation in this invention;

[0044] Figure 2 This is a flowchart of the GPU parallel acceleration method in this invention;

[0045] Figure 3 This is a diagram showing the execution of Prescan and GPU tasks in this invention. Detailed Implementation

[0046] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0047] like Figure 1 The image shows a computational example of the Pippenger algorithm. Figure 1 by Multiplication is the objective of the calculation, and C=4 is chosen as the standard for the exponent base, that is, the exponent is represented in hexadecimal.

[0048] First, construct the corresponding bucket T. ij This stage is related to BucketMul. The indices of different buckets are distinguished based on the units, tens, and hundreds digits of the exponents of the three bases, and the corresponding bases are placed into the appropriate buckets. In-bucket multiplication is then performed after the data is placed into a bucket.

[0049] Secondly, based on the constructed buckets, perform intra-group product calculations to obtain R. i This stage is related to WindowReduce. Depending on the exponent value, the number of multiplications required to calculate the product within a group corresponds to the number of exponent values.

[0050] Finally, use R i Perform inter-group multiplication to obtain the final result; this stage is related to FinalReduce. Initialize M first, and then multiply it by 2 in each round. 4 Then multiply by the corresponding round's R. i Continue until the least significant bit is reached, to obtain M, which needs to be calculated in the final step.

[0051] like Figure 2 As shown, the present invention provides a GPU parallel acceleration method for zk-SNARK operations, comprising:

[0052] Step (1): The CPU executes input / output tasks, reads the data to be processed into memory, and executes the Prescan process to divide the exponent according to the given base and separate the base of the corresponding exponent. This step builds the CPU's Prescan method, uses the CPU to scan and preprocess the task to be computed, and provides information for the GPU to build the bucket array.

[0053] The specific process of step (1) is as follows:

[0054] In step (1.1), the CPU executes the input / output task to read the data to be processed into memory, and then executes the Prescan task to calculate the T value for each bucket. im The element index is stored within the GPU design, and a storage area is allocated for it.

[0055] Firstly, according to The calculation content was analyzed, and the conclusion was drawn that they belong to the same R. i (i.e. T) im The buckets with the same i in the input (P1, P2, ..., Pn) are combined to form the entire set of inputs P1, P2, ..., Pn. N And R i The number of exponents is 2. C Number of digits in the number system, i.e. Therefore, a common allocation is required. The space of one index.

[0056] In step (1.2), based on the fact that the total space within the group is a uniquely identifiable value N, a one-time allocation method is adopted. Another marker array is used to record the start and end positions of the index cache area corresponding to each bucket, thereby dividing the index cache area of ​​each bucket.

[0057] The position of each input in the bucket is determined based on the index value. For k = 0 to N, the input exponent a is obtained by right shifting and taking the AND operation. k In 2 C The value of the i-th digit in the base b ki Then index k should be placed in the bucket. The index cache area.

[0058] Step (2): The CPU allocates memory space and a bucket array for the GPU and puts the base number into the bucket; this step generates an array for the GPU and uses the CPU's Prescan information to build a task allocation array. The GPU can then perform preliminary calculation tasks using the bucket array information.

[0059] The specific process of step (2) is as follows:

[0060] Step (2.1) is first allocated by the CPU. The index cache idxbuf for each index is allocated. The start and end positions of each index are recorded in the array `searr`.

[0061] Step (2.2) then scans the input to count the number of elements in each bucket. Based on the number of elements, it fills the searcher array, and then scans the input again, combining the bucket counts recorded in searcher. The starting position is where index k is actually placed in the corresponding position of idxbuf.

[0062] The exponent has a very large number of digits, and according to the algorithm, it is divided into a total of C digits per C digit. Each group can be scanned using a single CPU thread, thus leveraging multithreading on the CPU to further accelerate the Prescan process. In this case, each CPU thread scans the entire input and fills a segment of length n in idxbuf and a segment of length 2m in searcher, with the actual number of buckets filled being T. i0 To T im .

[0063] Step (3): The GPU performs BucketMul calculation based on the bucket data, and completes the multiplication calculation of the data within each bucket; this step realizes BucketMul calculation and completes the multiplication calculation within the bucket;

[0064] The specific process of step (3) is as follows:

[0065] BucketMul, being the most computationally intensive part, is... This is completed by one GPU thread. This part utilizes the multi-threading capabilities of the GPU, with one thread corresponding to each bucket, so bucket T... ij It should correspond to the i*2nd C +j threads, each thread reads the index from the idxbuf area belonging to the corresponding bucket, retrieves the data from the input based on the index, multiplies it by the result, and returns it.

[0066] Step (4): The GPU uses the value from the completed intra-bucket product calculation to perform a WindowReduce operation, realizing the calculation of the product of all bases within the inter-bucket group, that is, the product of all bases at a certain digit of the exponent. This step implements the WindowReduce calculation, completing the multiplication calculation within the inter-bucket group.

[0067] The specific process of step (4) is as follows:

[0068] Step (4.1) WindowReduce requires computation R i The computational task is assigned to the i-th thread for completion, requiring a total of [number] threads. One thread.

[0069] After assigning tasks to each thread, the product of each data is realized by using the idea of ​​cumulative multiplication, and the calculation method is expressed as (1).

[0070]

[0071] Step (4.2) implements R i The result is calculated by multiplying the RunningSum process by the sum in R. i And then iterate. First, the variable RunningSum is compared with R. i Initialize to identity element, then from Traverse to T i1 T will be placed in each round. ij Ride onto RunningSum, and then ride RunningSum onto R. i Once the traversal is complete, the final required R is obtained. i .

[0072] Step (5): Based on the results of the previous step, the GPU integrates the values ​​of each bit and executes the FinalReduce process, causing the exponents of the corresponding bits to be multiplied by themselves, and then multiplies the multiplied values ​​to obtain the final result. This step implements the FinalReduce calculation and completes the inter-group multiplication calculation.

[0073] The specific process of step (5) is as follows:

[0074] Step (5.1), FinalReduce uses single-threaded computation. The product operation is implemented by using the concept of cumulative multiplication, and the calculation expression method is constructed as (2).

[0075]

[0076] Step (5.2) calculates the result of M. First, M is initialized to the identity element, and then from R... W Iterate to R0, then process each round of R... i Multiply by M, and multiply M by itself C times (equivalent to finding 2). C Once the traversal is complete, the final M is obtained.

[0077] like Figure 3 As shown, this is a graph of Prescan and GPU task execution.

[0078] First, the CPU executes the Prescan task to scan the data to be calculated and analyze the base number that should be placed in each bucket at different index positions.

[0079] Secondly, the CPU provides a basis for partitioning based on the base and exponent distribution obtained after the Prescan task is executed.

[0080] Figure 3 The idxbuf array is used to store the base, and the searcher (start and ending array) array is used to indicate the starting position of the base of a specific value of an exponent in the idxbuf array.

[0081] by Figure 3Taking the input exponents 0x12eeec18 and 0x41a5dc87 as examples, their third digit (or hundreds digit) from the lowest to the highest is 'c', and their corresponding base numbers are 2 and n, respectively, which are placed in idxbuf; the base numbers possessed by the exponent 'c' are 8 and 9 respectively at the starting position of idxbuf, and are stored by searcher.

[0082] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A GPU parallel acceleration method for zk-SNARK operations, characterized in that, include: Step (1): The CPU executes the input / output task, reads the data to be processed into memory, and executes the Prescan process to divide the exponents according to the given base and separate the bases of the corresponding exponents; where the input / output task refers to the multi-point addition task on the finite field of the elliptic curve. And give the result M, As the base, These are the corresponding indices for each item; the data to be processed is then input. The specific process is as follows: In step (1.1), the CPU executes the input / output task to read the data to be processed into memory, and then executes the Prescan task to calculate the value of each bucket. The element index is stored within the GPU design, and a storage area is allocated for it. Step (1.2) uses a one-time allocation method, using a tag array to record the start and end positions of the index cache area corresponding to each bucket, thereby dividing the index cache area of ​​each bucket; In step (1.2), the position of each input in the bucket is determined based on the value of the exponent. , The exponent of the input is obtained by right shifting and ANDing. exist The second base The value of the bit Then the index It should be put into a bucket. The index cache area; Step (2): The CPU allocates memory space and a bucket array for the GPU, and puts the base number into the bucket; Step (3): The GPU performs BucketMul calculation based on the bucket data, completing the product calculation of the data within each bucket; the BucketMul calculation is completed using the GPU's multi-threading capability, with one thread corresponding to each bucket. It should correspond to the first One thread reads the index from the idxbuf area belonging to the corresponding bucket, retrieves the data from the input based on the index, multiplies it with the result, and returns it; Step (4): The GPU uses the value from the completed intra-bucket product calculation to perform the WindowReduce operation, which calculates the inter-bucket product, i.e., the product of all bases at a certain exponent. The specific process is as follows: Step (4.1), WindowReduce needs to compute... ,Will The computational task is assigned to the i-th thread for completion, requiring a total of [number] threads. There are several threads; after assigning tasks to each thread, the product of the data is calculated using the concept of cumulative multiplication, with the following formula: Step (4.2) is implemented. Result calculation: Multiply the RunningSum process result by the sum of the results. And iterate; Step (4.2) first involves setting the variable RunningSum and... Initialize to identity element, then from Traversing to Each round will Ride onto RunningSum, and ride RunningSum to... Once the traversal is complete, the final result will be obtained. ; Step (5): Based on the calculation results of step (4), the GPU integrates the values ​​of each bit, executes the FinalReduce process, multiplies the exponents of the corresponding bits, and multiplies the multiplied values ​​to obtain the final result.

2. The GPU parallel acceleration method for zk-SNARK operations according to claim 1, characterized in that, In step (1.1), according to The calculation content was analyzed and concluded that... middle Same, meaning belonging to the same category The buckets, put together, are the entire input. ; The number of exponents is the number of exponents. Number of bases Therefore, a total allocation is required. The space of each index, in the above operations, assumes The base is , and the Multiexp operation has N terms, where each exponent is a binary number of B bits, and each C bits are grouped together.

3. The GPU parallel acceleration method for zk-SNARK operations according to claim 1, characterized in that, The specific process of step (2) is as follows: Step (2.1), CPU allocation The index cache idxbuf for each index is allocated. The start and end positions of each index are recorded in the marker array `searr`. Step (2.2): Scan the input to count the number of elements in each bucket. Based on the number of elements, fill the searcher array. Scan the input again and combine the data with the buckets recorded in the searcher array. The starting position of the index It is actually placed in the corresponding location of idxbuf.

4. The GPU parallel acceleration method for zk-SNARK operations according to claim 1, characterized in that, The specific process of step (5) is as follows: Step (5.1), FinalReduce uses single-threaded computation. Using the concept of cumulative multiplication, the product operation is performed, and the formula is: Step (5.2), will Initialize to identity element, from Traversing to Then each round Take a ride Up, and will Self-multiplication Once the traversal is complete, the final result will be obtained. .

Images