Proof method and device for blockchain, electronic device, and storage medium

Abstract

The present disclosure provides a blockchain proof method and apparatus, an electronic device, and a storage medium. The method is implemented by: obtaining one or more binding declarations from an address controller for a public address of the address controller, the one or more binding declarations indicating a binding relationship between the public address and one or more private addresses of the address controller; for each of the one or more private addresses, obtaining signature data after signing a corresponding binding declaration in the one or more binding declarations, wherein the signing of the corresponding binding declaration is based on a private key corresponding to the private address; and generating first proof data for verifying the one or more binding relationships using a zero-knowledge proof circuit that meets preset conditions, wherein the input of the zero-knowledge proof circuit includes the signature data.

Description

Technical Field

[0001] The present disclosure relates to the field of blockchain technology, and in particular to a blockchain certification method and device, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Blockchain technology, also known as "distributed ledger technology," is a decentralized, collectively maintained distributed ledger. Decentralization refers to the absence of a centralized entity to ensure the fulfillment of one or more of the system's properties. For example, on some public blockchains, transaction records are maintained by all participating nodes, rather than being managed by a single central server. Collective maintenance of a distributed ledger involves the participation of multiple nodes in different locations, using a multi-party storage and multi-party computation approach to ensure that data is difficult to tamper with and computation results are trustworthy. For example, when there are a large number of participants and their distribution is relatively dispersed, it is difficult for a single or small number of nodes to tamper with transaction records.

[0003] The approaches described in this section are not necessarily approaches that have been previously conceived or employed. Unless otherwise indicated, it should not be assumed that any approach described in this section is prior art simply by virtue of its inclusion in this section. Similarly, unless otherwise indicated, the issues raised in this section should not be considered as having been recognized in any prior art. Summary of the Invention

[0004] The present disclosure provides a blockchain certification method and apparatus, an electronic device, a computer-readable storage medium, and a computer program product.

[0005] According to one aspect of the present disclosure, there is provided a proof method for a blockchain, comprising: obtaining one or more binding statements from an address controller for a public address of the address controller, the one or more binding statements indicating a binding relationship between the public address and one or more private addresses of the address controller; for each of the one or more private addresses, obtaining signature data after signing a corresponding binding statement in the one or more binding statements, wherein signing the corresponding binding statement is based on a private key corresponding to the private address; and generating first proof data for verifying the one or more binding relationships using a zero-knowledge proof circuit that meets preset conditions, wherein an input of the zero-knowledge proof circuit includes the signature data.

[0006] According to another aspect of the present disclosure, a proof device for a blockchain is also provided, including: a first acquisition module, configured to obtain one or more binding declarations of an address controller for a public address of the address controller, the one or more binding declarations indicating a binding relationship between the public address and one or more private addresses of the address controller; a second acquisition module, configured to obtain, for each of the one or more private addresses, signature data after signing a corresponding binding declaration in the one or more binding declarations, wherein signing the corresponding binding declaration is based on a private key corresponding to the private address; and a generation module, configured to generate first proof data for verifying the one or more binding relationships using a zero-knowledge proof circuit that meets preset conditions, wherein the input of the zero-knowledge proof circuit includes the signature data.

[0007] According to another aspect of the present disclosure, an electronic device is also provided, comprising: at least one processor; and at least one memory communicatively connected to the at least one processor, wherein the at least one memory stores a computer program that, when executed by the at least one processor, implements the above-mentioned certification method for blockchain.

[0008] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing a computer program is further provided, wherein the computer program implements the above-mentioned certification method for blockchain when executed by a processor.

[0009] According to another aspect of the present disclosure, a computer program product is further provided, including a computer program, wherein the computer program implements the above-mentioned certification method for blockchain when executed by a processor.

[0010] According to one or more embodiments of the present disclosure, the binding statement of the public address is signed using the private key corresponding to the private address, and the signature data is used as the input of a zero-knowledge proof circuit that meets preset conditions. On the one hand, the binding relationship between the private address of the address controller and the public address can be accurately proved. On the other hand, since the zero-knowledge proof circuit meets the preset conditions (for example, operating in a preset secure operating environment), it can be ensured that there is no need to disclose the relationship between the private address and the public address. Furthermore, in view of the "zero knowledge" characteristics of the zero-knowledge proof circuit, the outside world cannot recover or infer the private address itself based on the output of the zero-knowledge proof circuit.

[0011] According to one or more other embodiments of the present disclosure, the above-mentioned use of a zero-knowledge proof circuit that meets preset conditions to prove whether a private address and a public address are bound can eliminate the reliance on a third party to provide proof to the greatest extent, thereby further enhancing the decentralization of the entire system.

[0012] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings illustrate exemplary embodiments and constitute a part of the specification. Together with the description of the specification, they serve to explain exemplary implementation of the embodiments. The illustrated embodiments are for illustrative purposes only and do not limit the scope of the claims. Throughout the drawings, the same reference numerals designate similar, but not necessarily identical, elements.

[0014] Figure 1 A flowchart of a blockchain certification method according to some embodiments of the present disclosure is shown;

[0015] Figure 2 A schematic diagram showing structured data of a binding declaration according to an embodiment of the present disclosure is shown;

[0016] Figure 3 A schematic diagram showing structured data of a signature according to an embodiment of the present disclosure is shown;

[0017] Figure 4 A flowchart of a blockchain certification method according to other embodiments of the present disclosure is shown;

[0018] Figure 5 A flowchart of a blockchain certification method according to some further embodiments of the present disclosure is shown;

[0019] Figure 6 The figure shows a structural block diagram of a certification device for blockchain according to an embodiment of the present disclosure;

[0020] Figure 7 A structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0021] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0022] In this disclosure, unless otherwise specified, the use of terms such as "first" and "second" to describe various elements is not intended to limit the positional relationship, temporal relationship, or importance relationship of these elements. Such terms are only used to distinguish one element from another. In some examples, the first element and the second element may refer to the same instance of the element, while in some cases, based on the context of the description, they may also refer to different instances.

[0023] The terms used in the descriptions of the various examples described in this disclosure are for the purpose of describing specific examples only and are not intended to be limiting. Unless the context clearly indicates otherwise, if the number of elements is not specifically limited, the element may be one or more. In addition, the term "and / or" used in this disclosure encompasses any one and all possible combinations of the listed items.

[0024] Blockchain technology, also known as "distributed ledger technology," is a decentralized, collectively maintained distributed ledger. Decentralization refers to the absence of a centralized entity to ensure the fulfillment of one or more of the system's properties. For example, on some public blockchains, transaction records are maintained by all participating nodes, rather than being managed by a single central server. Collective maintenance of a distributed ledger involves the participation of multiple nodes in different locations, using a multi-party storage and multi-party computation approach to ensure that data is difficult to tamper with and computation results are trustworthy. For example, when there are a large number of participants and their distribution is relatively dispersed, it is difficult for a single or small number of nodes to tamper with transaction records.

[0025] On a blockchain, each address can be used to identify an account. In some cases, a blockchain participant (individual or institution) may have more than one address, and some of these addresses may be private addresses that are not fully publicly bound to the participant. For example, an address controller may have a public address A that is fully publicly bound to it, and private addresses B and D that are not fully publicly bound to it. In this case, the blockchain cannot reveal the validity of the address controller's control over addresses B and D, nor can it reveal the relationship between address A and addresses B and D. However, in scenarios where further application development is desired (for example, merging assets under the name of the address controller and issuing asset proof tokens, obtaining proof that the address controller owns certain crypto assets, etc.), proving the validity of the address controller's control over private addresses B and D is desirable.

[0026] The inventors have discovered that, in the prior art, the following two methods are generally used to prove the validity of the address controller's control over a private address:

[0027] (1) Use the private key corresponding to the private address to perform signature verification. For example, a specific text signature can be completed in the browser through a specific plug-in to verify the identity of the address controller. However, verifying the control of the address controller by the signature will result in the explicit or implicit disclosure of information about the private address (for example, the private address itself, the association between the private address and the public address controlled by the same address controller, etc.) during the proof process, which is actually not what the address controller wants.

[0028] (2) Use a third party to prove whether the address controller controls a private address. Although this method can ensure that the private address of the address controller and other information are not leaked through a third party, on the one hand, since other participants in the blockchain must trust the third party in order to trust the proof results obtained through it, this makes the entire system more centralized. On the other hand, the third party will face the trust challenge of other participants, that is, other participants may not be able to fully trust that the third party did not cheat or leak information about the private address during the entire proof process. As a result, the decentralization and trustlessness of blockchain technology may be affected.

[0029] In view of this, an embodiment of the present disclosure provides a proof method for blockchain, which uses a private key corresponding to a private address to sign a binding statement of a public address, and uses the signature data as the input of a zero-knowledge proof circuit that meets preset conditions. On the one hand, the binding relationship between the private address of the address controller and the public address can be accurately proved. On the other hand, since the zero-knowledge proof circuit meets the preset conditions (for example, operating in a preset safe operating environment), it can be ensured that there is no need to disclose the relationship between the private address and the public address. Furthermore, in view of the "zero knowledge" characteristics of the zero-knowledge proof circuit, the outside world cannot recover or infer the private address itself based on the output of the zero-knowledge proof circuit. In addition, using a zero-knowledge proof circuit that meets the preset conditions to prove whether the private address and the public address are bound can eliminate the reliance on the need for a third party to provide proof to the greatest extent, thereby further enhancing the decentralized nature of the entire system.

[0030] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0031] Figure 1 FIG2 shows a flowchart of a method 200 for proving a blockchain according to some embodiments of the present disclosure. Figure 1As shown, method 100 may include: step S110, obtaining one or more binding statements of the address controller for the public address of the address controller, the one or more binding statements indicating the binding relationship between the public address and one or more private addresses of the address controller; step S120, for each of the one or more private addresses, obtaining signature data after signing the corresponding binding statement in the one or more binding statements, wherein the signing of the corresponding binding statement is based on the private key corresponding to the private address; and step S130, using a zero-knowledge proof circuit that meets preset conditions to generate first proof data for verifying the one or more binding relationships, wherein the input of the zero-knowledge proof circuit includes the signature data.

[0032] In some examples, the address controller may be a Controller, its public address may be AddrPublic, and its private address may be AddrPriviate. Compared to the traditional method of proving that AddrPriviate and AddrPublic are bound by the address controller Controller using the private key corresponding to AddrPrivate to sign a specific text statement (for example, certain fields in the text statement indicate that the private address currently being verified is bound to the public address), the proof method for blockchain according to the present disclosure uses the private key corresponding to the private address to sign the binding statement of the public address, and uses the signature data as the input of a zero-knowledge proof circuit that meets preset conditions. The preset conditions include any operating environment that allows the zero-knowledge proof circuit to operate safely, for example, running the zero-knowledge proof circuit on the address controller side or running the zero-knowledge proof circuit in a confidential computing container as described in detail below. As a result, the binding relationship between the private address of the address controller and the public address can be proved without disclosing this binding relationship to the outside world. At the same time, given the "zero-knowledge" nature of the zero-knowledge proof circuit, the outside world cannot recover or infer the private address itself based on the output of the zero-knowledge proof circuit. Furthermore, a zero-knowledge proof circuit that meets preset conditions can reliably prove whether AddrPriviate and AddrPublic are bound, thereby eliminating the reliance on third-party proof to the greatest extent, further enhancing the decentralization of the entire system.

[0033] According to some embodiments of the present disclosure, an address is used to identify a corresponding participant on a blockchain. For example, an address can be obtained by generating a random private key; generating a public key corresponding to the private key; and calculating the corresponding address from the public key using a specific algorithm (e.g., Keccak-256 hash). Addresses can include public addresses and private addresses. A public address may refer to an address that is publicly associated with the address controller, while a private address may refer to an address that is not publicly associated with the address controller.

[0034] According to some embodiments of the present disclosure, in step S110, the binding declaration of the public address by the address controller may be structured data, and the structured data may include the public address.

[0035] In some examples, the binding declaration can be structured data that complies with the EIP-712 specification. EIP-712 is a type of structured message signature standard that provides the information to be signed to the signer in a structured and readable format, allowing the signer to clearly understand the specific content they will sign, thereby avoiding situations such as incorrect signing. In addition, structured data is also more conducive to application in zero-knowledge proof circuits.

[0036] According to some embodiments of the present disclosure, for each binding declaration, the structured data may further include one or more of the following: a valid start time for the binding declaration; a valid end time for the binding declaration; and a timestamp indicating the time when the binding declaration was generated.

[0037] According to some examples, the start time and the end time may both be in seconds, calculated from 00:00 UTC on January 1, 1970. By setting the number of digits representing the start time and the end time in the structured data, a longer valid binding period may be provided.

[0038] According to some examples, the timestamp can also be in seconds and calculated from UTC 1970.1.1 00:00. By setting the timestamp, situations such as replay attacks can be effectively prevented. For example, if the time of generating the binding statement is 00:00 on October 1, 2021, and the valid threshold time set by the service provider is, for example, 1 year, then after 00:00 on October 1, 2022 (that is, exceeding the valid threshold time from the time the binding statement is generated), the signature data signed by the address controller for the binding statement will automatically become invalid, making it impossible for the attacker to continue to use the data as the input of the zero-knowledge proof circuit to prove the binding relationship between the private address and the public address.

[0039] Figure 2 FIG. 1 shows a schematic diagram of a binding declaration for structured data according to an embodiment of the present disclosure. Figure 2As shown, the name of the binding declaration is AddressBinding, and the function struct indicates that the generated binding declaration is structured data. The structured data includes the field address base representing the public address to be bound to the private address, the field validFrom representing the effective start time of the binding declaration, the field validTo representing the effective end time of the binding declaration, and the timestamp timeStamp. In the structured data, mandatory indicates that the public address is a required field, and optional indicates that the start time, end time and timestamp are optional fields. Among them, validFrom and validTo can be calculated from UTC 1970.1.1 00:00, and uint40 ensures that the structured data can provide timing corresponding to the start time and end time. Similarly, timeStamp can also be calculated from UTC 1970.1.1 00:00, and uint32 ensures that the structured data can provide timing corresponding to the timestamp.

[0040] It should be understood that the diagrams shown are for illustrative purposes. Figure 2 A structured binding declaration is shown, which can also be structured data in any other format.

[0041] According to some embodiments of the present disclosure, the signature data after the address controller signs the binding statement may be structured data, and the structured data may include both the binding statement and data indicating the address controller's control over the private key.

[0042] By setting the signature data as structured data and using it as the input of the zero-knowledge proof circuit, it can be more conducive to the operation of the zero-knowledge proof circuit.

[0043] According to some embodiments of the present disclosure, the structured data further includes a public key corresponding to the private key. Whether the structured signature data includes the public key corresponding to the private key may depend on the signature algorithm used.

[0044] For example, when the address controller signs using an algorithm such as the Elliptic Curve Digital Signature Algorithm (ECDSA), the corresponding public key can be calculated from the signature data. In this case, the public key may not be included in the structured signature data.

[0045] For example, when the address controller signs using an algorithm such as the SM2 algorithm, the corresponding public key cannot be calculated from the signature data. In this case, the structured signature data needs to include the public key.

[0046] Figure 3 FIG. 1 shows a schematic diagram of structured signature data according to an embodiment of the present disclosure. Figure 3 As shown, the signature is named AddressBindingSignature, and the function struct indicates that the generated signature is structured data. The structured data includes the binding declaration described above, the data signed with the private key, and the public key. In the structured data, mandatory indicates that the binding declaration and the data signed with the private key are required fields, while optional indicates that the public key is an optional field (depending on the signature algorithm used).

[0047] It should be understood that the diagrams shown are for illustrative purposes. Figure 3 The structured signature data shown is a structured data, which can also be structured data in any other format.

[0048] According to some embodiments of the present disclosure, the zero-knowledge proof circuit in step S130 can be any suitable software, program, or code based on the zero-knowledge proof technical solution that is applicable to the operations herein. Although "circuit" is referenced herein, it should be understood that the zero-knowledge proof circuit is not an actual physical circuit.

[0049] Zero-knowledge proof technology refers to a technology that allows the prover to prove that he knows the private data without revealing the private data, or to complete a calculation and prove the integrity of the calculation process without revealing the private data (that is, the result is proved to be obtained by the established algorithm based on the private data). Generally speaking, the zero-knowledge proof technology satisfies the following three properties: (1) completeness, that is, if the prover knows one or more private data, then he can convince the verifier; (2) reliability, that is, if the prover does not know one or more private data, then he cannot convince the verifier that he knows the private data; (3) zero knowledge, that is, the verifier cannot infer the specific details of the private data from the proof data provided by the prover (except for data that the verifier knows in advance and can know without proof, or information that can be inferred based on the proof data itself).

[0050] It should be understood that the input of the zero-knowledge proof circuit may include one or more signature data, and accordingly, the zero-knowledge proof circuit may output separate proof data for each signature data or output a data set including these proof data. The scope of protection claimed in the present disclosure is not limited in this respect.

[0051] According to some embodiments of the present disclosure, continue to refer to Figure 1The method 100 may further include step S140, for each of the one or more private addresses, generating a corresponding alias for the private address using a zero-knowledge proof circuit for disclosure; and step S150, determining whether there is cheating for the private address based on the corresponding alias, wherein the aliases corresponding to each private address are different from each other.

[0052] On a blockchain, there may be situations where, based on the assets in a private address, the controller of a public address bound to that private address is granted certain privileges or benefits. This may lead the controller to bind a private address under their name to multiple public addresses or rent it out to others in order to obtain the corresponding privileges or benefits. This situation is referred to as "cheating" in this article.

[0053] In the prior art, cheating can be determined through a third party. Specifically, the third party can collect all bound address pairs, including private and public addresses, and determine whether the same private address is bound to multiple different public addresses. If a private address is determined to be bound to multiple public addresses, then the address controller of that private address can be determined to have engaged in cheating. However, as mentioned above, blockchain participants must trust the third party in order to trust the results obtained through it, and the third party may face trust challenges from other participants, which will affect the blockchain's centralized and trustless nature. In contrast, by utilizing a zero-knowledge proof circuit to generate a corresponding alias for each private address and making it public, it is possible to determine whether a private address is repeatedly bound to multiple public addresses without revealing the privacy of the address controller. This is because the corresponding aliases generated for each private address are highly likely to be different from each other (it should be understood that for the purpose of greater accuracy, the description herein describes the aliases corresponding to each private address as highly likely to be different from each other, but in reality, the probability of generating the same alias for multiple different private addresses is extremely low, so it can also be understood here that the corresponding aliases generated for each private address are different from each other).

[0054] According to some embodiments of the present disclosure, any algorithm adapted to a zero-knowledge proof circuit may be used to generate a corresponding alias for each private address, such that, for example, the following properties are satisfied: (1) irreversibility, i.e., it is impossible to reversely calculate or deduce specific details about the private address based on the alias; (2) unavailability to the outside world, i.e., a corresponding alias is generated for each private address based on a certain secret value, such that a participant who does not know the secret value cannot forwardly calculate the alias corresponding to the private address; (3) anti-collision, i.e., it is almost impossible to find two different private addresses with the same alias (it should be understood that, for the purpose of greater accuracy, anti-collision is defined here as the property that it is "almost" impossible to find two different private addresses with the same alias, but in practice, the probability of generating the same alias for two or more different private addresses is extremely low, so it can also be understood here as the property that it is impossible to find two different private addresses with the same alias); and (4) confidentiality, i.e., the disclosure of a small number of private addresses and their corresponding aliases will not affect the above properties (1)-(3).

[0055] Therefore, the scope of the present disclosure is not limited in this respect with respect to the algorithm used to generate the corresponding alias for the private address. In some examples, a zero-knowledge proof circuit-friendly hash algorithm (e.g., the Poseidon algorithm, the Rescue algorithm, etc.) can be selected to generate the corresponding alias for each private address.

[0056] According to some embodiments of the present disclosure, step S150, determining whether there is cheating for the private address based on the corresponding alias may include: determining a binding address pair including the generated corresponding alias, the binding address pair also including a public address bound to the corresponding alias; based on the binding address pair, determining the number of public addresses bound to the corresponding alias; and in response to determining that the number of public addresses bound to the corresponding alias is greater than 1, determining that there is cheating for the private address.

[0057] For example, the address controller Controller can simultaneously control the private addresses AddrPriviate1, AddrPriviate2, and AddrPriviate3, as well as the public address AddrPublic. The zero-knowledge proof circuit described above can be used to generate corresponding aliases Alias1, Alias2, and Alias3 for each of AddrPriviate1, AddrPriviate2, and AddrPriviate3 for disclosure on the chain. Then, the binding address pairs including Alias1, Alias2, and Alias3 can be determined respectively, for example, the binding address pair for alias Alias1 is (Alias1, AddrPublic), the binding address pair for alias Alias2 is (Alias2, AddrPublic), (Alias2, AddrPublic1), (Alias2, AddrPublic2), and the binding address pair for alias Alias3 is (Alias3, AddrPublic). In this case, since the number of public addresses bound to Alias2 is greater than 1, it can be determined that the private address AddrPriviate2 corresponding to Alias2 is bound to multiple public addresses, thereby determining that the address controller Controller is a cheating user.

[0058] By identifying the bound address pair that includes the alias corresponding to a private address, it is possible to quickly and intuitively determine whether the private address is repeatedly bound to multiple public addresses, effectively preventing cheating on the blockchain. Furthermore, since the determination of cheating is not dependent on a third party, the decentralized and trustless nature of the blockchain is furthered.

[0059] According to some embodiments of the present disclosure, continue to refer to Figure 1 The above-mentioned proof method 100 for blockchain may also include: step S160, determining a confidential computing container that can communicate with the application being used by the address controller, wherein the zero-knowledge proof circuit is located in the confidential computing container.

[0060] According to some embodiments of the present disclosure, a confidential computing container is a specific implementation of confidential computing technology. Examples of confidential computing technology include SGX technology.

[0061] It should be understood that the above-mentioned SGX technology is shown for illustrative purposes only, and examples of confidential computing technologies are not limited thereto. It may be any suitable technology that ensures encryption of memory data during operation at the hardware level, so that even if an attacker fully controls the operating system and underlying hardware devices (e.g., memory controller, basic input and output system BIOS, etc.), the encrypted and protected memory contents cannot be obtained. The scope of protection claimed in the present disclosure is not limited in this respect.

[0062] By running the zero-knowledge proof circuit in a confidential computing container that meets the specific security requirements as described above, it can be further ensured that the data and information input into the zero-knowledge proof circuit cannot be obtained by any user or organization, even the developers and operators of related services, thereby effectively protecting the private data or business secrets of the address controller.

[0063] According to some embodiments of the present disclosure, determining a confidential computing container that can communicate with an application that an address controller is using may include: determining a first identity ID and a first version of the confidential computing container; comparing the first identity ID and the first version with a second identity ID and a second version pre-set in the application, respectively; and in response to determining that the first identity ID is the same as the second identity ID, and the first version is the same as the second version, determining that the confidential computing container is a confidential computing container that can communicate with the application.

[0064] According to some embodiments of the present disclosure, each confidential computing container may have an identity ID (such as a serial number, etc.) and a version (such as a current version number, etc.), and the identity ID and version of the secure and trusted confidential computing container indicating that it can connect are pre-stored in the corresponding application of the address controller.

[0065] Before establishing a communication channel between an application and a confidential computing container, the application needs to confirm whether the confidential computing container being connected to is a known, secure, and trusted confidential computing container. This can be achieved, for example, by comparing the identity ID and version of the confidential computing container pre-stored in the application with the identity ID and version of the confidential computing container currently being connected to. If both the identity ID and version match, the confidential computing container currently being connected to can be determined to be a secure, trusted confidential computing container permitted by the application.

[0066] According to some embodiments of the present disclosure, the communication channel between the application and the confidential computing container can comply with any common security standards, such as the Transport Layer Security (TLS) protocol (TLS 1.2 version, TSL 1.3 version).

[0067] By verifying the identity and version of the confidential computing container, a secure and reliable communication channel can be established between the confidential computing container and the application in use, thereby protecting the private data input into the zero-knowledge proof circuit from being obtained by any user or organization, even the developers and operators of related services.

[0068] Figure 4 FIG. 4 is a flowchart of a blockchain certification method 400 according to other embodiments of the present disclosure. Figure 4 As shown, method 400 may include: Figure 1 Steps S410-S460 similar to steps S110-S160 in the described proof method 100 for blockchain; and step S470, generating a first salt value using a random number generator within the confidential computing container; step S480, encrypting the first salt value using the confidential computing container; and step S490, storing the encrypted first salt value outside the confidential computing container.

[0069] In this article, salt refers to a random data that is used to improve the security of operations and can be used as additional input information when hashing private data.

[0070] According to some embodiments of the present disclosure, in step S470, a secure random number generator can be used in the confidential computing container to generate a first salt value, and the generated first salt value can have a sufficient length, such as 256 bits, 512 bits or even more bits, to prevent attackers from cracking the salt value and private data in an exhaustive manner.

[0071] By generating a salt value within a confidential computing container and running a zero-knowledge proof circuit within the container, the salt value is ensured to be confidential and inaccessible to any user or organization, including the developer and operator of the service. Furthermore, storing the encrypted salt value outside the confidential computing container ensures that the generated salt value is not lost if the confidential computing container is restarted or migrated. Additionally or alternatively, storing the encrypted salt value outside the confidential computing container allows multiple confidential computing containers to run simultaneously, thereby improving availability and stability.

[0072] According to some embodiments of the present disclosure, step S440, for each of one or more private addresses, generating a corresponding alias for the private address using a zero-knowledge proof circuit for public disclosure may include: step S442, obtaining a second salt value, wherein the storage location of the second salt value is the same as the storage location of the first salt value; and step S444, using the signature data and the second salt value as inputs to the zero-knowledge proof circuit to generate a corresponding alias.

[0073] By using a confidential salt value in the process of calculating the alias for each private data (such as a private address), the computational complexity of an attacker's exhaustive collision of the private data can be made so large that it is completely infeasible, thereby effectively ensuring the irreversibility of the alias.

[0074] According to some examples, the second salt value may be the same as the first salt value. This allows for confirmation that the service provider has not modified the salt value. In this case, for the same private address, the same alias value will be output via the zero-knowledge proof circuit.

[0075] According to other examples, the second salt value may be different from the first salt value. It can be determined that the service provider has modified the salt value. In this case, for the same private address (such as AddrPrivate), if the above-mentioned different salt values ​​and corresponding signature data are input into the zero-knowledge proof circuit, different alias values ​​will be generated, such as Alias1 and Alias2. This may result in the following situation: when Alias1 and Alias2 are respectively bound to different public addresses to obtain the binding address pairs (Alias1, AddrPublic1) and (Alias2, AddrPublic2), it is impossible to identify this cheating behavior (that is, in fact, Alias1 and Alias2 both correspond to the same private address, and the number of public addresses bound to them exceeds 1).

[0076] To solve this problem, the above-mentioned proof method for blockchain may further include: generating a current hash value corresponding to a second salt value using a zero-knowledge proof circuit; obtaining a previous hash value corresponding to the first salt value; determining whether the current hash value is the same as the previous hash value; and determining that cheating exists in response to determining that the current hash value is different from the previous hash value.

[0077] By outputting the hash value corresponding to the salt value through the zero-knowledge proof circuit, it is possible to promptly detect whether the salt value has been modified, thereby effectively avoiding cheating by modifying the salt value without being discovered. As mentioned above, this is because for the same private address, if different salt values ​​and corresponding signatures are input into the zero-knowledge proof circuit, different alias values ​​will be generated.

[0078] Figure 5 FIG. 5 shows a flowchart of a method 500 for proving a blockchain according to some other embodiments of the present disclosure. Figure 5 As shown, method 500 may include: Figure 1 and Figure 4Steps S510-S530 similar to steps S110-S130 and S410-S430 in the described proof methods 100 and 400 for blockchain; and step S540, obtaining public information associated with the one or more private addresses as input to the zero-knowledge proof circuit; and step S550, using the zero-knowledge proof circuit to generate second proof data corresponding to the public information for verifying the output result of the zero-knowledge proof circuit.

[0079] According to some embodiments of the present disclosure, public information may include, but is not limited to, the distribution of a certain crypto asset, the most recent transaction price, the price estimated based on a specific model, etc.

[0080] By obtaining public information as input to the zero-knowledge proof circuit, the business-related parts of the calculation results (such as the total number of assets, whether the controller of the address owns a certain asset, etc.) can be publicly verified, thereby ensuring the accuracy of the relevant information.

[0081] According to some other embodiments of the present disclosure, one or more outputs of the zero-knowledge proof circuit can be obfuscated based on actual circumstances to prevent the leakage of private data or trade secrets. The reason for performing the obfuscation process is that although private data such as private addresses will not be leaked to any individual or organization during the use of zero-knowledge proof technology and confidential computing technology, the zero-knowledge proof circuit can output information such as the total number of assets. In certain specific scenarios, other individuals or organizations may be able to infer the private address based on the output information. For example, in a scenario where the total assets are 2999 and distributed among 1000 addresses, one address has 2000 assets and the other 999 addresses each have one address, if the public information output by the zero-knowledge proof circuit indicates that a bound address pair has 2001 assets, it can be determined that the private address with 2000 assets is bound to the public address in the bound address pair, thereby causing the leakage of private data. The fuzzification process may include, for example, not outputting precise values ​​such as the total number of assets, but outputting, for example, a value indicating whether the assets owned by the bound address exceed a set value, wherein the set value may be changed according to actual conditions.

[0082] According to some embodiments of the present disclosure, the address controller may also bind one or more private addresses without assets to a public address to obfuscate information. By binding a private address without assets to a public address and, for example, outputting a value indicating whether the bound address holds assets exceeding a set value, such as described above, to obfuscate the information, other individuals or organizations can be prevented from inferring the private address bound to the public address from the output of the zero-knowledge proof circuit.

[0083] Figure 6FIG. 6 shows a structural block diagram of a certification device 600 for blockchain according to an embodiment of the present disclosure. Figure 7 As shown, the device 600 may include: a first acquisition module 610, configured to obtain one or more binding declarations of the address controller for the public address of the address controller, the one or more binding declarations indicating the binding relationship between the public address and one or more private addresses of the address controller; a second acquisition module 620, configured to obtain, for each of the one or more private addresses, signature data after signing a corresponding binding declaration in the one or more binding declarations, wherein signing the corresponding binding declaration is based on a private key corresponding to the private address; and a generation module 630, configured to generate first proof data for verifying the one or more binding relationships using a zero-knowledge proof circuit that meets preset conditions, wherein the input of the zero-knowledge proof circuit includes signature data.

[0084] According to some embodiments of the present disclosure, the device 600 may further include: an alias generation module, configured to generate a corresponding alias for each of the one or more private addresses using a zero-knowledge proof circuit for the private address for disclosure; and a cheating determination module, configured to determine whether there is cheating for the private address based on the corresponding alias, wherein the aliases corresponding to each private address are different from each other.

[0085] According to some embodiments of the present disclosure, the cheating determination module may include: a module configured to determine a binding address pair associated with the corresponding alias, the binding address pair also including a public address bound to the corresponding alias; a module configured to determine the number of public addresses bound to the corresponding alias based on the binding address pair; and a module configured to determine that there is cheating against the private address in response to determining that the number of public addresses bound to the corresponding alias is greater than 1.

[0086] According to some embodiments of the present disclosure, the device 600 may also include a confidential computing container determination module, configured to determine a confidential computing container that can communicate with the application being used by the address controller, wherein the zero-knowledge proof circuit is located in the confidential computing container.

[0087] According to some embodiments of the present disclosure, a module for determining a confidential computing container may include: a module configured to determine a first identity ID and a first version of a confidential computing container; a module configured to compare the first identity ID and the first version with a second identity ID and a second version pre-set in an application, respectively; and a module configured to determine that the confidential computing container is a confidential computing container capable of communicating with an application in response to determining that the first identity ID is the same as the second identity ID, and the first version is the same as the second version.

[0088] According to some embodiments of the present disclosure, the device 600 may further include a salt value generation module, which is configured to generate a first salt value using a random number generator within the confidential computing container; an encryption module, which is configured to encrypt the first salt value using the confidential computing container; and a storage module, which is configured to store the encrypted first salt value outside the confidential computing container.

[0089] According to some embodiments of the present disclosure, a salt value generation module may include: a module configured to obtain a second salt value, wherein a storage location of the second salt value is the same as a storage location of the first salt value; and a module configured to use signature data and the second salt value as inputs of a zero-knowledge proof circuit to generate a corresponding alias.

[0090] According to some embodiments of the present disclosure, the apparatus 600 may further include: a module configured to generate a current hash value corresponding to a second salt value using a zero-knowledge proof circuit; a module configured to obtain a previous hash value corresponding to a first salt value; a module configured to determine whether the current hash value is the same as the previous hash value; and a module configured to determine that cheating has occurred in response to determining that the current hash value is different from the previous hash value.

[0091] According to some embodiments of the present disclosure, the device 600 may also include: a module configured to obtain public information associated with one or more private addresses as input to a zero-knowledge proof circuit; and a module configured to use the zero-knowledge proof circuit to generate second proof data corresponding to the public information for verifying the output result of the zero-knowledge proof circuit.

[0092] According to some embodiments of the present disclosure, each of the one or more binding declarations is structured data, and the structured data includes a public address.

[0093] According to some embodiments of the present disclosure, for each binding declaration, the structured data further includes one or more of the following: a valid start time for the binding declaration; a valid end time for the binding declaration; and a timestamp indicating the time when the binding declaration was generated.

[0094] According to some embodiments of the present disclosure, the signature data is structured data, and wherein the structured data includes both a binding statement and data indicating the control of the address controller over the private key.

[0095] According to some embodiments of the present disclosure, the structured data further includes a public key corresponding to the private key.

[0096] It should be understood that Figure 6 The modules 610-630 of the apparatus 600 shown in FIG. 6 can be compared with the modules 610-630 of FIG. Figure 1The steps S110-S130 in the method 100 described above correspond to each other. Therefore, the operations, features and advantages described above for the method 100 are also applicable to the apparatus 600 and the modules included therein. For the sake of brevity, some operations, features and advantages are not described in detail here.

[0097] It should also be understood that various techniques may be described herein in the general context of software hardware elements or program modules. Figure 6 The various modules described can be implemented in hardware or in hardware in combination with software and / or firmware. For example, these modules can be implemented as computer program code / instructions, which are configured to be executed in one or more processors and stored in a computer-readable storage medium. Alternatively, these modules can be implemented as hardware logic / circuits. For example, in some embodiments, one or more of the first acquisition module 610, the second acquisition module 620, and the generation module 630 can be implemented together in a system on chip (SoC). The SoC may include an integrated circuit chip (which includes a processor (e.g., a central processing unit (CPU), a microcontroller, a microprocessor, a digital signal processor (DSP), etc.), a memory, one or more communication interfaces, and / or one or more components in other circuits), and may optionally execute the received program code and / or include embedded firmware to perform the function.

[0098] According to another aspect of the present disclosure, an electronic device is also provided, comprising: at least one processor; and at least one memory communicatively connected to the at least one processor; wherein the at least one memory stores a computer program, and when the computer program is executed by the at least one processor, the computer program implements the above-mentioned certification method for blockchain.

[0099] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing a computer program is further provided, wherein the computer program implements the above-mentioned certification method for blockchain when executed by a processor.

[0100] According to another aspect of the present disclosure, a computer program product is further provided, including a computer program, wherein the computer program implements the above-mentioned certification method for blockchain when executed by a processor.

[0101] See also Figure 7, a block diagram of an electronic device 700 that can serve as a server of the present disclosure will now be described, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device can be different types of computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0102] like Figure 7 As shown, the electronic device 700 may include at least one processor 710 , a working memory 720 , an input unit 740 , a display unit 750 , a speaker 760 , a storage unit 770 , a communication unit 780 , and other output units 790 , which can communicate with each other via a system bus 730 .

[0103] The processor 710 may be a single processing unit or multiple processing units, all of which may include a single or multiple computing units or multiple cores. The processor 710 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuits, and / or any device that manipulates signals based on operational instructions. The processor 710 may be configured to retrieve and execute computer-readable instructions stored in the working memory 720, the storage unit 770, or other computer-readable media, such as program code of an operating system 720a, program code of an application 720b, and the like.

[0104] The working memory 720 and the storage unit 770 are examples of computer-readable storage media for storing instructions that are executed by the processor 710 to implement the various functions described above. The working memory 720 may include both volatile memory and non-volatile memory (e.g., RAM, ROM, etc.). In addition, the storage unit 770 may include a hard drive, a solid-state drive, removable media, including external and removable drives, memory cards, flash memory, floppy disks, optical disks (e.g., CDs, DVDs), storage arrays, network attached storage, storage area networks, etc. The working memory 720 and the storage unit 770 may all be collectively referred to herein as memory or computer-readable storage media, and may be non-transitory media capable of storing computer-readable, processor-executable program instructions as computer program code, which may be executed by the processor 710 as a specific machine configured to implement the operations and functions described in the examples herein.

[0105] The input unit 760 can be any type of device capable of inputting information into the electronic device 700. The input unit 760 can receive input numeric or character information and generate key signal input related to user settings and / or function control of the electronic device, and can include but is not limited to a mouse, keyboard, touch screen, trackpad, trackball, joystick, microphone, and / or remote control. The output unit can be any type of device capable of presenting information, and can include but is not limited to a display unit 750, a speaker 760, and other output units 790. Other output units 790 can include, but are not limited to, video / audio output terminals, vibrators, and / or printers. The communication unit 780 allows the electronic device 700 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, an 802.11 device, a Wi-Fi device, a WiMAX device, a cellular communication device, and / or the like.

[0106] The application 720b in the working register 720 can be loaded to execute the various methods and processes described above, such as Figure 1 Steps S110-S160, Figure 4 Steps S410-S490, Figure 5 For example, in some embodiments, the various methods described above may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 770. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via the storage unit 770 and / or the communication unit 780. When the computer program is loaded and executed by the processor 710, one or more steps of the methods 100, 400, and 500 described above may be performed. Alternatively, in other embodiments, the processor 710 may be configured to perform the methods 100, 400, and 500 in any other appropriate manner (e.g., by means of firmware).

[0107] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0108] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0109] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0110] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0111] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0112] Computer systems may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The client and server relationship arises through computer programs running on the respective computers and having a client-server relationship to each other.

[0113] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0114] Although the embodiments or examples of the present disclosure have been described with reference to the accompanying drawings, it should be understood that the above-mentioned methods, systems and devices are merely exemplary embodiments or examples, and the scope of the present invention is not limited by these embodiments or examples, but is only limited by the claims after authorization and their equivalents. Various elements in the embodiments or examples may be omitted or replaced by their equivalents. In addition, the steps may be performed in an order different from that described in this disclosure. Further, the various elements in the embodiments or examples may be combined in various ways. It is important that as technology evolves, many of the elements described herein may be replaced by equivalent elements that appear after this disclosure.

Claims

1. A blockchain certification method, comprising: Obtaining one or more binding declarations from an address controller for a public address of the address controller, the one or more binding declarations indicating a binding relationship between the public address and one or more private addresses of the address controller; For each of the one or more private addresses, obtaining signature data of a corresponding binding statement in the one or more binding statements, wherein the signing of the corresponding binding statement is based on a private key corresponding to the private address; and A zero-knowledge proof circuit that meets preset conditions is used to generate first proof data for verifying the one or more binding relationships, wherein an input of the zero-knowledge proof circuit includes the signature data.

2. The method according to claim 1, further comprising: For each of the one or more private addresses, generate a corresponding alias for the private address using the zero-knowledge proof circuit for public disclosure; as well as Determine whether there is cheating against the private address based on the corresponding alias, The aliases corresponding to each private address are different from each other.

3. The method according to claim 2, wherein: Determining whether there is cheating against the private address based on the corresponding alias includes: Determining a binding address pair including the corresponding alias, the binding address pair also including a public address bound to the corresponding alias; Based on the bound address pair, determining the number of public addresses bound to the corresponding alias; and In response to determining that the number of public addresses bound to the corresponding alias is greater than 1, it is determined that cheating exists with respect to the private address.

4. The method according to claim 2 or 3, further comprising: Identifying a confidential computing container capable of communicating with the application being used by the controller of the address, Wherein, the zero-knowledge proof circuit is located in the confidential computing container.

5. The method according to claim 4, wherein The confidential computing containers identified as being able to communicate with the application being used by the controller of the address include: Determining a first identity ID and a first version of the confidential computing container; Comparing the first identity ID and the first version with a second identity ID and a second version preset in the application, respectively; and In response to determining that the first identity ID is the same as the second identity ID, and the first version is the same as the second version, the confidential computing container is determined to be a confidential computing container capable of communicating with the application.

6. The method according to claim 4, further comprising: generating a first salt value using a random number generator within the confidential computing container; encrypting the first salt value using the confidential computing container; as well as The encrypted first salt value is stored outside the confidential computing container.

7. The method according to claim 6, wherein: For each of the one or more private addresses, generating a corresponding alias for the private address using the zero-knowledge proof circuit for public disclosure includes: Obtaining a second salt value, wherein the storage location of the second salt value is the same as the storage location of the first salt value; and The signature data and the second salt value are used as inputs of the zero-knowledge proof circuit to generate the corresponding alias.

8. The method according to claim 7, further comprising: generating, using the zero-knowledge proof circuit, a current hash value corresponding to the second salt value; Obtaining a previous hash value corresponding to the first salt value; determining whether the current hash value is the same as the previous hash value; as well as In response to determining that the current hash value is different from the previous hash value, cheating is determined to have occurred.

9. The method according to any one of claims 1 to 3, further comprising: Obtaining public information associated with the one or more private addresses as input to the zero-knowledge proof circuit; as well as The zero-knowledge proof circuit is used to generate second proof data corresponding to the public information and used to verify an output result of the zero-knowledge proof circuit.

10. The method according to any one of claims 1 to 3, wherein: Each of the one or more binding declarations is structured data, and wherein the structured data includes the public address.

11. The method according to claim 10, wherein: For each binding declaration, the structured data further includes one or more of the following: The effective start time of the binding statement; the effective expiration date of the binding statement; and A timestamp indicating when this binding declaration was generated.

12. The method according to any one of claims 1 to 3, wherein: The signature data is structured data, and wherein the structured data includes both the binding statement and data indicating the address controller's control over the private key.

13. The method according to claim 12, wherein: The structured data also includes a public key corresponding to the private key.

14. A blockchain certification device, comprising: a first acquisition module configured to acquire one or more binding declarations of an address controller for a public address of the address controller, the one or more binding declarations indicating a binding relationship between the public address and one or more private addresses of the address controller; a second obtaining module configured to obtain, for each of the one or more private addresses, signature data of a corresponding binding statement in the one or more binding statements, wherein the signing of the corresponding binding statement is based on a private key corresponding to the private address; and The generation module is configured to generate first proof data for verifying the one or more binding relationships by using a zero-knowledge proof circuit that meets preset conditions, wherein the input of the zero-knowledge proof circuit includes the signature data.

15. An electronic device comprising: at least one processor; as well as at least one memory communicatively coupled to the at least one processor, The at least one memory stores a computer program, and when the computer program is executed by the at least one processor, the method according to any one of claims 1 to 13 is implemented.

16. A non-transitory computer-readable storage medium storing a computer program, wherein: When the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 13.

17. A computer program product comprising a computer program, wherein When the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 13.

Images