A homomorphic encryption system satisfying zero-knowledge proof

Abstract

The application relates to a homomorphic encryption system satisfying zero-knowledge proof, comprising the following steps: a first terminal obtains first ciphertext corresponding to data according to a K-Elgamal algorithm and a public key corresponding to a second terminal, obtains second ciphertext corresponding to the data according to the K-Elgamal algorithm and a public key corresponding to a supervision terminal, constructs verification parameters corresponding to the data according to an M-Pedersen commitment, the public key corresponding to the second terminal and the public key corresponding to the supervision terminal, sends the first ciphertext to the second terminal, sends the second ciphertext to the supervision terminal, and uploads the verification parameters to a blockchain platform; the second terminal decrypts the first ciphertext according to a private key corresponding to the second terminal to obtain the data; the supervision terminal decrypts the second ciphertext according to a private key corresponding to the supervision terminal to obtain the data; the blockchain platform performs equality verification according to the first ciphertext, the second ciphertext and the verification parameters, if the verification is passed, the blockchain platform records the data transmitted between the first terminal and the second terminal, and if the verification is not passed, the blockchain platform does not record.

Description

Technical Field

[0001] This invention belongs to the field of privacy data protection algorithm technology, and relates to a homomorphic encryption system that satisfies zero-knowledge proof. Background Technology

[0002] In the era of big data, the value of data has increased dramatically, and its relationship with national security, social development, and individual legitimate rights has become increasingly close. Data circulation is a crucial link in releasing data value, but with the rapid development of the internet, the problem of privacy data leakage has become increasingly serious. Homomorphic encryption is a special encryption method where computationers can directly perform operations on ciphertext, and the decrypted result is the same as the result of computation on plaintext using the same method. Homomorphic encryption allows participants to perform computations without a key, eliminating the need to decrypt the results of each step and thus avoiding high computational costs. The ciphertext used in the computation also does not need to be sent to the party possessing the key, reducing communication costs and allowing distributed computing tasks to be distributed among multiple participants to balance costs. Ciphertext computation allows data users to only obtain the final result, without knowing the intermediate computation process or ciphertext information, improving data security and privacy. Currently, transaction privacy protection schemes based on homomorphic encryption suffer from low verification rates and easy data leakage, making it difficult to find a reasonable way to utilize the contradiction between openness and confidentiality, reducing fairness, credibility, and security in practical applications, and hindering the development of privacy protection technologies. Zero-knowledge proofs can prove the legitimacy of data to others. One of the most important technologies in building zero-knowledge proof systems and designing other security protocols is "commitment." Similar to commitments made in real life, in a commitment protocol, the committing party first makes a commitment to others and then proves in the subsequent verification phase that they have fulfilled that commitment. Simply put, a commitment protocol is a two-phase protocol involving two parties. The first phase is the commitment phase, where the committing party commits to a message v and sends it to the verifier, ensuring that the verifier has no information about message v. The second phase is the opening phase, where the committing party publicly reveals message v, proving that it is consistent with the commitment made in the commitment phase and has not been tampered with. Commitment protocols possess two fundamental properties: concealment and binding. Concealment means that during the commitment phase, no one except the committing party can know any information about the committed message v, effectively hiding the message. Binding means that during the commitment opening phase, no one can open the commitment with information other than message v, and verification will be successful. The combined application of homomorphic encryption and zero-knowledge proof technology can effectively solve problems of data misuse and lack of oversight and verification.

[0003] Based on the above analysis, the problems and defects of the existing technology are as follows: In daily applications, homomorphic encryption algorithms are widely used in various scenarios due to their low computational complexity and good performance. However, encrypted data is invisible, which can lead to data abuse and lack of supervision and verification. Existing semi-homomorphic encryption algorithms cannot perform data supervision or zero-knowledge equality proofs. Summary of the Invention

[0004] To overcome the problems existing in related technologies, this disclosure provides a homomorphic encryption system that satisfies zero-knowledge proof. The technical solution is as follows:

[0005] According to a first aspect of the present disclosure, a homomorphic encryption system satisfying zero-knowledge proof is provided, comprising:

[0006] The first terminal is used to obtain the first ciphertext corresponding to the data based on the K-Elgamal algorithm and the public key corresponding to the second terminal.

[0007] The first terminal is further configured to obtain the second ciphertext corresponding to the data based on the K-Elgamal algorithm and the public key corresponding to the monitoring terminal;

[0008] The first terminal is further configured to construct verification parameters corresponding to the data based on the M-Pedersen commitment, the public key corresponding to the second terminal, and the public key corresponding to the monitoring terminal;

[0009] The first terminal is further configured to send the first ciphertext to the second terminal, send the second ciphertext to the monitoring terminal, and upload the verification parameters to the blockchain platform;

[0010] The second terminal is used to decrypt the first ciphertext according to the private key corresponding to the second terminal to obtain the data;

[0011] The monitoring terminal is used to decrypt the second ciphertext according to the private key corresponding to the monitoring terminal to obtain the data;

[0012] The blockchain platform is used to perform equality verification based on the first ciphertext, the second ciphertext, and the verification parameters. If the verification passes, the blockchain platform records the data transmitted between the first terminal and the second terminal. If the verification fails, the blockchain platform does not record the data transmitted between the first terminal and the second terminal.

[0013] In one embodiment,

[0014] The second terminal is used according to the formula Generate the public key corresponding to the second terminal;

[0015] The monitoring terminal is used to calculate according to the formula. Generate the public key corresponding to the monitoring terminal;

[0016] Among them, the The public key corresponding to the second terminal; The private key corresponding to the second terminal; The public key corresponding to the monitoring terminal; The private key corresponding to the monitoring terminal; For system parameters, the For random prime numbers, according to the above Build a finite field of order , and yes The generator in, the The multiplication group; the are random integers and The are random integers and .

[0017] In one embodiment,

[0018] The first terminal is configured to obtain the ciphertext according to the following formula:

[0019] ;

[0020] ;

[0021] ;

[0022] Wherein, M represents the data;

[0023] When i=1, ( This represents the first ciphertext; the ;and ; , represents the first random number;

[0024] When i=2, ( This represents the second ciphertext; the ;and ; , representing the second random number.

[0025] In one embodiment,

[0026] The second terminal is used for, according to Obtain the data;

[0027] The monitoring terminal is used to... Obtain the data.

[0028] In one embodiment,

[0029] The first terminal is further configured to commit to the data using different parameters to obtain:

[0030] ;

[0031] ;

[0032] in, , The third random number; The data;

[0033] The first terminal is further configured to calculate according to the following formula and ;

[0034] ;

[0035] ;

[0036] Among them, the The second random number;

[0037] The first terminal is further configured to perform a hash function on the first terminal. Perform a hash operation to obtain the hash value. ;

[0038] The first terminal is further configured to calculate according to the following formula ;

[0039] ;

[0040] ;

[0041] ;

[0042] The first terminal is further configured to, according to the Obtain the verification parameters .

[0043] In one embodiment,

[0044] The blockchain platform is also used to receive the ( The above ( and stated Then, based on the first hash function... Perform a hash operation to obtain the hash value. ;

[0045] The blockchain platform is also used to, according to the The above ( The above ( and stated The system checks whether the first verification equation is true. If all of the first verification equations are true, then the verification is considered successful.

[0046] In one embodiment, the first verification equation includes:

[0047]

[0048] . Attached Figure Description

[0049] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0050] Figure 1 This is a schematic diagram of a homomorphic encryption system that satisfies zero-knowledge proof, provided as an embodiment of the present invention. Detailed Implementation

[0051] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0052] The problems and defects of existing technologies are as follows: In daily applications, homomorphic encryption algorithms are widely used in various scenarios due to their low computational complexity and good performance. However, encrypted data is invisible, which can lead to data abuse and lack of supervision and verification. Existing semi-homomorphic encryption algorithms cannot perform data supervision or zero-knowledge equality proofs.

[0053] The difficulty in solving the above problems and defects lies in how to ensure the security of data during homomorphic encryption and its operation, and how to combine commitment technology with homomorphic encryption algorithms to verify the legitimacy of data circulation, that is, to verify whether the information contained in the ciphertext after encryption with different public keys is consistent.

[0054] The significance of addressing the above problems and shortcomings is as follows: Homomorphic encryption technology can hide confidential data and perform calculations through ciphertext, while zero-knowledge proof technology can verify the legitimacy of data circulation. By encrypting data for computation and storing the results in ciphertext, even if stolen by others, the specific data will not be leaked, thus ensuring the security of data in computation and transmission. Privacy-preserving algorithms that satisfy zero-knowledge proofs can generate zero-knowledge proof evidence to prove the legitimacy of encrypted data. Data that passes verification can be stored, while data that fails verification is rejected for storage, thus avoiding the possibility of malicious tampering and misuse, and reducing the risk of user privacy leakage. Therefore, constructing privacy-preserving algorithms that can perform both zero-knowledge proofs and homomorphic encryption has practical significance and broad application prospects.

[0055] Please see Figure 1 , Figure 1 This is a schematic diagram of a homomorphic encryption system that satisfies zero-knowledge proof, provided as an embodiment of the present invention. The system includes:

[0056] The first terminal is used to obtain the first ciphertext corresponding to the data based on the K-Elgamal algorithm and the public key corresponding to the second terminal.

[0057] The first terminal is also used to obtain the second ciphertext corresponding to the data based on the K-Elgamal algorithm and the public key corresponding to the monitoring terminal;

[0058] The first terminal is also used to construct the verification parameters corresponding to the data based on the M-Pedersen commitment, the public key corresponding to the second terminal, and the public key corresponding to the supervisory terminal.

[0059] The first terminal is also used to send the first ciphertext to the second terminal, send the second ciphertext to the regulatory terminal, and upload the verification parameters to the blockchain platform.

[0060] The second terminal is used to decrypt the first ciphertext to obtain the data based on the private key corresponding to the second terminal;

[0061] The monitoring terminal is used to decrypt the second ciphertext to obtain the data based on the private key corresponding to the monitoring terminal;

[0062] The blockchain platform is used to verify the equality of the first ciphertext, the second ciphertext, and the verification parameters. If the verification passes, the blockchain platform records the data transmitted between the first terminal and the second terminal. If the verification fails, the blockchain platform does not record the data transmitted between the first terminal and the second terminal.

[0063] The K-Elgamal algorithm consists of four parts: system parameters, key generation algorithm, encryption algorithm, and decryption algorithm.

[0064] When applying an algorithm, the application design will inevitably include its own system parameters. These system parameters, once set, cannot be modified and must remain unchanged throughout the entire application process. The generation process of the system parameters is as follows:

[0065] 1. System parameters:

[0066] Randomly select a prime number , build a finite field of order ,in, yes ( The generators in the multiplicative group. As a system parameter.

[0067] 2. Key generation algorithm:

[0068] After obtaining the system parameters, each decryptor (e.g., the second terminal and the monitoring terminal) can use the system parameters to generate their own public-private key pair. In one feasible implementation, this can be done according to the formula... Generate the public keys for each decryption party;

[0069] in, Let be the public key of the i-th decryptor. Let be a random integer chosen for the i-th decryptor, and And the private key of the i-th decryptor .

[0070] Specifically, the process of generating the public and private keys for the second terminal is as follows: Select a random integer. Using system parameters calculate .Will The private key used as the second terminal is ,Will The public key as the second terminal is .

[0071] The process of generating the public and private keys for the monitoring terminal is as follows: Select a random integer. Using system parameters calculate .Will The private key used as a monitoring terminal is ,Will The public key used as the regulatory terminal is .

[0072] 3. Encryption Algorithm:

[0073] Choose a first random number for each decryptor. ;and ; And calculate the ciphertext ;

[0074] in,

[0075] ;

[0076] ;

[0077] ;

[0078] in, The random number chosen by the i-th decryptor; Plain text data For the data used to complete zero-knowledge proofs, This is the data used for decryption.

[0079] Specifically, select the first random number for the second terminal. ; ;and ; And calculate the first ciphertext ( ;

[0080] Select a second random number for the monitoring terminal ; ;and ; And calculate the second ciphertext ( ;

[0081] 4. Decryption Algorithm:

[0082] ciphertext The ciphertext is sent to the corresponding decryption party. After receiving the ciphertext, the decryption party can then use a preset formula... Obtain plaintext data Specifically:

[0083] The first ciphertext ( The first ciphertext is sent to the second terminal. After receiving the first ciphertext, the second terminal can then... Obtain plaintext data ;

[0084] The second ciphertext ( The message is sent to the monitoring terminal. After receiving the second encrypted message, the monitoring terminal can then... Obtain plaintext data .

[0085] This disclosure proposes an M-Pedersen commitment that satisfies multiplicative homomorphism, based on the Pedersen commitment. Two application protocols are designed based on this commitment, which can satisfy information hiding and its zero-knowledge equality proof. The M-Pedersen commitment is described in detail below.

[0086] The M-Pedersen commitment structure is divided into three phases:

[0087] (1) Initialization phase: Choose a prime number and Construct a multiplicative group containing another major prime factor. ,in yes In the generator, select random numbers. and calculate ,public ;

[0088] It is worth noting that: M-Pedersen's commitment And in the K-Elgamal algorithm They are interchangeable.

[0089] (2) Commitment phase: The committing party selects a random number. As a blinding factor, the plaintext data M is calculated. Commitment value Then Send to the verifier;

[0090] (3) Opening phase: The committing party sends Give it to the verifier, who uses the known... Calculate pairs The commitment value and verification whether it is consistent with If they are equal, accept; otherwise, reject.

[0091] M-Pedersen promises to satisfy multiplicative homomorphism, if These are the use of blinding factors right The promise, Is it using blinding factors? right The commitment, namely:

[0092] .

[0093] 2. Protocol Design

[0094] The M-Pedersen commitment mentions that data can be used in the construction of the system. The information is sent to a verifier to check the accuracy of the commitment. However, in some cases, the committer may be unwilling to share their information with others but still needs to prove to them that they actually know the data. Directly put the data Sending it to the verifier is inappropriate; in some specific application scenarios, it is necessary to encrypt the same data with different public keys. The verifier verifies the encrypted data. Whether they are the same or not; two protocols were built to address the above issues for different situations.

[0095] Protocol 1: The Prover proves to the Verifier Enabling Established.

[0096] Non-interactive proof process:

[0097] 1. The party making the commitment:

[0098] (1) Select random numbers ,calculate:

[0099] ;

[0100] ;

[0101] (2) The parameters are hashed using the first hash function to obtain:

[0102] );

[0103] (3) Calculation:

[0104] ;

[0105] ;

[0106] .

[0107] (4) Send to the verifier;

[0108] 2. Verification party:

[0109] (1) Calculate using the same first hash function );

[0110] (2) Verification:

[0111]

[0112] ;

[0113] Whether it holds true or not. If both equations hold true, then it proves success; otherwise, it fails.

[0114] Agreement 2: The promisors shall use different parameters for the plaintext data. Making a commitment will result in:

[0115] ;

[0116] ;

[0117] And prove to the verifier that the same data is hidden in both promises.

[0118] Non-interactive proof process:

[0119] 1. The party making the commitment:

[0120] (1) Select random numbers ,calculate:

[0121] ;

[0122] ;

[0123] (2) The parameters are hashed using the second hash function to obtain:

[0124] ;

[0125] (3) Calculation:

[0126] ;

[0127] ;

[0128] ;

[0129] (4) Send to the verifier.

[0130] 2. Verifier:

[0131] (1) Calculate using the same second hash function ;

[0132] (2) Verification:

[0133] ;

[0134] .

[0135] Does it hold true? If both equations hold true, then it proves that the two promises contain the same plaintext data. .

[0136] Specifically, the first terminal is also used to commit data using different parameters:

[0137] ;

[0138] ;

[0139] in, , The third random number; Plaintext data;

[0140] The first terminal is also used to calculate according to the following formula and ;

[0141] ;

[0142] ;

[0143] in, The second random number;

[0144] The first terminal is also used to perform a hash function based on the second hash function. Perform a hash operation to obtain the hash value. ;

[0145] The first terminal is also used to calculate according to the following formula ;

[0146] ;

[0147] ;

[0148] ;

[0149] The first terminal is also used for... Get verification parameters .

[0150] The blockchain platform is also used to receive , and Then, based on the second hash function... Perform a hash operation to obtain the hash value. ;

[0151] Blockchain platforms are also used for... 1. Check if the first verification equation is true. If all the first verification equations are true, then the verification is successful.

[0152] The first verification equation includes:

[0153] ;

[0154] .

[0155] Furthermore, the equality proof process disclosed herein can be referred to Protocol 2. Suppose Alice wants to prove to Bob that the same data was encrypted with different public keys. For ease of description, the protocol proof process is divided into the evidence generation process and the verification process. This represents the evidence generation process function, used to provide a commitment. and The same message is hidden. Generate evidence, This represents the verification process function, where Used for verification and Does it hide the same message? Alice only needs to use a function. Evidence is generated, and Bob uses a function after receiving the evidence. Verification is all that's needed.

[0156] This invention first designs an M-Pedersen commitment that satisfies multiplication operations based on the Pedersen commitment, and then designs a multiplicative homomorphic privacy protection algorithm that satisfies zero-knowledge equality proof by combining the Elgamal encryption algorithm, which effectively solves the problems of data abuse and lack of supervision and verification.

[0157] In this disclosure, the first terminal is the terminal where the first blockchain account is located, the second terminal is the terminal where the second blockchain account is located, the regulatory terminal is the terminal where the regulatory account is located, and the blockchain platform can refer to the verification node in the blockchain platform.

[0158] The following examples will provide a detailed description of the solutions in this disclosure.

[0159] Proofreader C wants to prove that... public key and The public key is used to encrypt the same plaintext data m = 20.

[0160] 1. System parameter generation:

[0161] If a prime number q = 167 is randomly selected, then generators g = 5, h = 13, and G = (167, 5, 13) are used as system parameters.

[0162] 2. Key generation:

[0163] Random selection As The private key is used to generate the public key. ;

[0164] Random selection As The private key is used to generate the public key. ;

[0165] 3. Encryption:

[0166] C selects a random number. use The public key is used to encrypt the following:

[0167] ;

[0168] ;

[0169] ;

[0170] C selects a random number. use The public key is used to encrypt the following:

[0171] ;

[0172] ;

[0173] ;

[0174] in Used for verification Used for decryption.

[0175] 4. Decryption:

[0176] Using private key and Decryption yields:

[0177] ;

[0178] Using private key and Decryption yields:

[0179] ;

[0180] 5. Equality verification:

[0181] 1) Proofreader C selects a random number .

[0182] 2) Building Commitments:

[0183] ;

[0184] ;

[0185] 3) Calculate using a hash function

[0186] ;

[0187] 4) Calculation:

[0188] ;

[0189] ;

[0190] ;

[0191] 5) Proofreader C will Send to the verifier.

[0192] 6) Verifier verification:

[0193] (1) Using the same Function calculation ;

[0194] ;

[0195] (2) ;

[0196] ;

[0197] It can be known .

[0198] (3) ;

[0199] ;

[0200] It can be known .

[0201] From (1) and (2), we know that the verification is successful.

[0202] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0203] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or data point described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or data points described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0204] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A homomorphic encryption system that satisfies zero-knowledge proof, characterized in that, include: The first terminal is used to obtain the first ciphertext corresponding to the data based on the K-Elgamal algorithm and the public key corresponding to the second terminal. The first terminal is further configured to obtain the second ciphertext corresponding to the data based on the K-Elgamal algorithm and the public key corresponding to the monitoring terminal; The first terminal is further configured to construct verification parameters corresponding to the data based on the M-Pedersen commitment, the public key corresponding to the second terminal, and the public key corresponding to the monitoring terminal; The first terminal is further configured to send the first ciphertext to the second terminal, send the second ciphertext to the monitoring terminal, and upload the verification parameters to the blockchain platform; The second terminal is used to decrypt the first ciphertext according to the private key corresponding to the second terminal to obtain the data; The monitoring terminal is used to decrypt the second ciphertext according to the private key corresponding to the monitoring terminal to obtain the data; The blockchain platform is used to perform equality verification based on the first ciphertext, the second ciphertext, and the verification parameters. If the verification passes, the blockchain platform records the data transmitted between the first terminal and the second terminal. If the verification fails, the blockchain platform does not record the data transmitted between the first terminal and the second terminal. The K-Elgamal algorithm includes system parameters, key generation algorithm, encryption algorithm, and decryption algorithm; The system parameters include randomly selecting a prime number. , build a finite field of order ,in, yes ( generators in the multiplicative group; As a system parameter; The key generation algorithm includes, after obtaining the system parameters, applying the formula... Generate the public keys for each decryption party, where Let be the public key of the i-th decryptor. For the i-th decryption party, a random integer is selected. The private key of the i-th decryptor ; The encryption algorithm is used to select a first random number for each decryptor. ;and ; And calculate the ciphertext ; The calculation methods include: ； ； ； in, The random number chosen by the i-th decryptor; This is plaintext data, i.e., the data in question. For the data used to complete zero-knowledge proofs, ( () represents the data used for decryption; The decryption algorithm is used to, after the decryptor receives the ciphertext, apply a preset formula... Obtain the plaintext data; The M-Pedersen commitment includes: The M-Pedersen commitment construction is divided into three phases: Initialization phase: Choose a prime number and Construct a multiplicative group containing another major prime factor. ,in yes In the generator, select random numbers. and calculate ,public ;M-Pedersen commitment And in the K-Elgamal algorithm They can be substituted for each other; Commitment Phase: The committing party selects a random number. As a blinding factor, the plaintext data M is calculated. Commitment value Then Send to the verifier; Opening phase: The committing party sends Give it to the verifier, who uses the known... Calculate pairs The commitment value and verification whether it is consistent with If they are equal, accept; otherwise, reject. Protocol design: Agreement 1: The prover proves to the verifier Enabling Established; Agreement 2: The promisors shall use different parameters for the plaintext data. Make a commitment and prove to the verifier that the commitment contains the same data; specifically including: The first terminal is also used to commit data using different parameters: ； ； in, , The third random number; Plaintext data; The first terminal is also used to calculate according to the following formula. and ; ； ； in, The second random number; The first terminal is also used to perform a hash function based on the second hash function. Perform a hash operation to obtain the hash value. ; The first terminal is also used to calculate according to the following formula. ; ； ； ； The first terminal is also used for... Get verification parameters ; The blockchain platform is also used to receive , and Then, based on the second hash function... Perform a hash operation to obtain the hash value. ; Blockchain platforms are also used for...

1. Check whether the first verification equation is true. If all the first verification equations are true, then the verification is considered successful. The first verification equation includes: ； 。 2. The homomorphic encryption system satisfying zero-knowledge proof according to claim 1, characterized in that, The second terminal is used according to the formula Generate the public key corresponding to the second terminal; The monitoring terminal is used to calculate according to the formula. Generate the public key corresponding to the monitoring terminal; Among them, the The public key corresponding to the second terminal; The private key corresponding to the second terminal; The public key corresponding to the monitoring terminal; The private key corresponding to the monitoring terminal; For system parameters, the For random prime numbers, according to the above Build a finite field of order , and yes The generator in, the The multiplication group; the are random integers and The are random integers and .

3. The homomorphic encryption system satisfying zero-knowledge proof according to claim 2, characterized in that, The first terminal is configured to obtain the ciphertext according to the following formula: ； ； ； Wherein, M is the data; When i=1, ( This represents the first ciphertext; the ;and ; , represents the first random number; When i=2, ( This represents the second ciphertext; the ;and ; , representing the second random number.

4. The homomorphic encryption system satisfying zero-knowledge proof according to claim 3, characterized in that, The second terminal is used for, according to Obtain the data; The monitoring terminal is used to... Obtain the data.

Images