Multi-level group accumulator construction, member and non-member proof method, device and system
By constructing a multi-level group accumulator, the elements to be accumulated are grouped and sub-accumulation values are calculated, which solves the problem of large storage space occupation of cryptographic accumulators in massive data scenarios and realizes efficient member/non-member evidence generation.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-07-19
- Publication Date
- 2026-03-20
AI Technical Summary
Existing cryptographic accumulators require traversing all elements when generating member/non-member evidence in scenarios with massive amounts of data, resulting in excessive storage space consumption and an inability to generate evidence efficiently and in real time.
A multi-level group accumulator construction method is adopted, which groups the elements to be accumulated and calculates the sub-accumulated values. By using the root accumulator value to nest the sub-accumulated values in a hierarchical grouping manner, the data requirements for generating evidence are reduced.
It effectively reduces the data size required to generate member/non-member evidence and improves the proof efficiency in scenarios with massive amounts of data.
Smart Images
Figure CN116225367B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and in particular to a method and apparatus for constructing a multi-level group accumulator, a method and system for member proof, and a method and system for non-member proof. Background Technology
[0002] In current research on cryptographic accumulators, generating member or non-member evidence for a specific element requires traversing all elements in the accumulator except the element in question. This mechanism means that when applying cryptographic accumulators to massive data scenarios to achieve real-time generation of member / non-member evidence for a given element, pre-computation is the only viable method. However, pre-computation of element evidence consumes a significant amount of system storage space, hindering the effective application of cryptographic accumulators in massive data scenarios. Therefore, achieving real-time generation of member / non-member evidence for elements in massive data scenarios using cryptographic accumulators is one of the most pressing problems to be solved in this field. Summary of the Invention
[0003] The present invention aims to provide a method and apparatus for constructing a multi-level group accumulator, a membership proof method and system, and a non-membership proof method and system to overcome or at least partially solve the above-mentioned problems.
[0004] To achieve the above objectives, the technical solution of the present invention is specifically implemented as follows:
[0005] The first aspect of the present invention provides a method for constructing a multi-level grouped accumulator, comprising: S1, a service provider grouping the current elements to be accumulated into n groups, each group including any d elements to be accumulated, to obtain a set of grouped accumulator elements X = {[X1, X2, ..., X...} d ],…,[X (i-1)*d+1 ,…,X i*d ],…,[X (n-1)*d+1 ,…,X n*d S2, the service provider calculates the cumulative value of each group to obtain n sub-cumulative values Acc = {Acc1, ..., Acc}; i ,…,Acc n If n≠1, then the sub-accumulated value is used as the current element to be accumulated, and execution returns to S1. If n=1, then execution returns to S3. In S3, the service provider uses the n sub-accumulated values as the root accumulator value RAcc to construct a group accumulator, which includes each sub-accumulated value and the root accumulator value RAcc.
[0006] The method further includes: the service provider sending the root accumulated value RAcc and some sub-accumulated values during the accumulation process to the verifier.
[0007] The method further comprises: the service provider receiving the required related parameters for generating the accumulated calculation according to a preset rule by the accumulator administrator.
[0008] The service provider calculates the accumulated value of each group respectively by using the related parameters.
[0009] The second aspect of the application provides a member proof method, comprising the following steps: S1, a service provider constructs a group accumulator according to the multi-level group accumulator construction method described above; S2, the service provider receives a to-be-proved element X i from a verifier, determines the lowest group in which the to-be-proved element X i may be located; S3, the service provider generates the sub-accumulated value Acc i of the to-be-proved element X r , generates the member evidence w1 of the to-be-proved element X r under the sub-accumulated value, takes w1 as a new to-be-proved element, generates the member proof of w1 under the sub-accumulated value, and iterates the process until the member evidence w n under RAcc is generated; S4, the service provider aggregates the member evidence generated in the process into w=(w1, w2, …, w n ); and S5, the service provider sends the member evidence w of the to-be-proved element to the verifier; S6, the verifier judges according to the parameter known in advance and the member evidence w of the to-be-verified element, calculates according to the member proof method corresponding to each level accumulator and w, compares the calculation result with the known parameter, and if the calculation result is consistent with the known parameter, the verification is passed, otherwise the verification fails.
[0010] The third aspect of the application provides a non-member proof method, comprising the following steps: S1, a service provider constructs a group accumulator according to the multi-level group accumulator construction method described above; S2, the service provider receives a to-be-proved element X n from a verifier, determines the lowest group in which the to-be-proved element X n may be located, generates the non-member evidence π j of the to-be-proved element X n under the accumulated value Acc j , generates the member evidence w of the sub-accumulated value Acc n under RAcc, and generates the member evidence w of the to-be-proved element X j under RAcc; S3, the service provider sends the member evidence (π n , w) of the to-be-proved element to the verifier; S4, the verifier verifies the legitimacy of the member evidence w of the accumulated value Acc j ; S5, if the member evidence w is legitimate, the verifier verifies the legitimacy of the member evidence w; and S6, the verifier verifies the legitimacy of the member evidence w under the accumulated value Acc jThe corresponding non-member evidence verification method is used for element X. n Non-member evidence π n judge.
[0011] A fourth aspect of the present invention provides a multi-level grouped accumulator construction apparatus, comprising: a grouping module, used to group the current elements to be accumulated into n groups, each group including any d elements to be accumulated, to obtain a set of grouped accumulated elements X = {[X1, X2, ..., X...} d ],…,[X (i-1)*d+1 ,…,X i*d ],…,[X (n-1)*d+1 ,…,X n*d The calculation module is used to calculate the cumulative value of each group separately, and obtain n sub-cumulative values Acc = {Acc1, ..., Acc}. i ,…,Acc n If n≠1, then the sub-accumulated value is used as the current element to be accumulated, and execution returns to S1. If n=1, then execution returns to S3. The construction module is used to construct a group accumulator by using the n sub-accumulated values as the root accumulator value RAcc. The group accumulator includes: each of the sub-accumulated values and the root accumulator value RAcc.
[0012] The device further includes a sending module, used to send the root accumulated value RAcc and some sub-accumulated values during the accumulation process to the verifier.
[0013] The device also includes a receiving module for receiving the necessary parameters for the accumulation calculation generated by the accumulator administrator according to preset rules.
[0014] The calculation module calculates the cumulative value of each group in the following ways: it calculates the cumulative value of each group using the relevant parameters.
[0015] A fifth aspect of the present invention provides a membership verification system, comprising: a service provider configured to construct a block accumulator using the aforementioned multi-level block accumulator construction apparatus; and to receive an element X to be verified sent by a verifier. i Determine the lowest-level group to which the element to be proved belongs; generate the sub-accumulation value Acc. i For the corresponding membership evidence w1, take w1 as the new element to be proved, generate membership proofs for w1 under its sub-accumulations, and iterate this process until membership evidence w under RAcc is generated. r The member evidence generated in this process is aggregated into w = (w1, w2, ..., w rThe verifier sends the evidence w of the member of the element to be proved to the verifier. The verifier makes a judgment based on its own known parameters and the member evidence w of the element to be verified, calculates according to the member proof method corresponding to each layer accumulator and w, compares the calculation result with the known parameters, and if it is consistent with the known parameters, the verification is successful; otherwise, the verification fails.
[0016] A sixth aspect of the present invention provides a non-membership proof system, comprising: a service provider configured to construct a block accumulator using the aforementioned multi-level block accumulator construction apparatus; and to receive an element X to be proved sent by a verifier. n Determine the element X to be proved. n The lowest-level group it might belong to, based on the accumulated value Acc corresponding to that group. j The cryptographic accumulation algorithm used generates element X. n At Acc j Non-member evidence π n And the generated sub-accumulated value Acc j Membership evidence w under RAcc; evidence of the membership of the element to be proved (π) n (w) is sent to the verifier; the verifier is used to first verify Acc. j The validity of the member evidence w; if the validity of the member evidence w is verified, according to Acc j The corresponding non-member evidence verification method is used for element X. n Non-member evidence π n judge.
[0017] Therefore, the multi-level block accumulator construction method and apparatus provided by this invention can be applied to service providers to construct a multi-level block cipher accumulator composed of sub-accumulator values and a root accumulator value. By using the root accumulator value to hierarchically group and nest the sub-accumulator values, the size of the data required to generate member evidence / non-member evidence is effectively reduced. It also has the characteristics of unordered data within the group and fixed identity of data elements within the group, making the multi-level block cipher accumulator more effectively applicable to application scenarios with massive amounts of data.
[0018] The membership proof method and system provided by this invention can effectively reduce the data size required to generate non-member evidence and improve the efficiency of proof.
[0019] The non-member proof method provided by this invention can effectively reduce the data size required to generate non-member evidence and improve the efficiency of proof. Attached Figure Description
[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort based on these drawings.
[0021] Figure 1 The flow chart of the multi-level grouping accumulator construction method provided by the embodiments of the present application is shown in FIG. 1.
[0022] Figure 2 The structure diagram of the multi-level grouping accumulator provided by the embodiments of the present application is shown in FIG. 2.
[0023] Figure 3 The flow chart of the accumulator parameter initialization provided by the embodiments of the present application is shown in FIG. 3.
[0024] Figure 4 The flow chart of the accumulator value calculation provided by the embodiments of the present application is shown in FIG. 4.
[0025] Figure 5 The flow chart of the member proof method provided by the embodiments of the present application is shown in FIG. 5.
[0026] Figure 6 The flow chart of the member proof provided by the embodiments of the present application is shown in FIG. 6.
[0027] Figure 7 The flow chart of the non-member proof method provided by the embodiments of the present application is shown in FIG. 7.
[0028] Figure 8 The flow chart of the non-member proof provided by the embodiments of the present application is shown in FIG. 8.
[0029] Figure 9 The flow chart of the accumulator element addition provided by the embodiments of the present application is shown in FIG. 9.
[0030] Figure 10 The flow chart of the accumulator element deletion provided by the embodiments of the present application is shown in FIG. 10.
[0031] Figure 11 The structure diagram of the multi-level grouping accumulator construction device provided by the embodiments of the present application is shown in FIG. 11.
[0032] Figure 12 The structure diagram of the member proof system provided by the embodiments of the present application is shown in FIG. 12.
[0033] Figure 13 The structure diagram of the non-member proof system provided by the embodiments of the present application is shown in FIG. 13. DETAILED DESCRIPTION
[0034] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.
[0035] Figure 1 A flow chart of the method for constructing the multi-level grouping accumulator according to an embodiment of the present disclosure is shown in FIG. 2. Figure 1 The method for constructing the multi-level grouping accumulator according to an embodiment of the present disclosure includes:
[0036] S1, the service provider groups the current elements to be accumulated into n groups, each group including any d current elements to be accumulated, to obtain a set of grouped accumulated elements X = {[X1, X2, …, Xd}, …, [Xn-d+1, Xn-d+2, …, Xn]}. d (i-1)*d+1 i*d (n-1)*d+1 n*d
[0037] S2, the service provider calculates the accumulated value of each group to obtain n sub-accumulated values Acc = {Acc1, …, Accn}. i n If n ≠ 1, the sub-accumulated values are taken as the current elements to be accumulated, and the process returns to S1. If n = 1, the process proceeds to S3.
[0038] S3, the service provider takes the n sub-accumulated values as the root accumulated value RAcc, and constructs the grouping accumulator, which includes each sub-accumulated value and the root accumulated value RAcc.
[0039] Specifically, in the multi-level grouping accumulator according to an embodiment of the present disclosure, the accumulated value of the element to be accumulated is not directly calculated, but the element to be accumulated is first grouped, and the accumulated value of each group is calculated, which is denoted as a sub-accumulated value Acc j . The sub-accumulated values of each group are taken as new elements to be accumulated and grouped, and the iteration is repeated until the final root accumulated value RAcc is obtained. By grouping and nesting the elements to be accumulated in layers, the number of elements contained in the root accumulator can be effectively reduced, thereby effectively reducing the data size required for generating element membership / non-membership evidence, and making the multi-level grouping accumulator have the data characteristics of unordered data within the group and fixed identity of data elements within the group. An example of the structure of the multi-level grouping accumulator is shown in FIG. 3. Figure 2
[0040] Definition 1 describes a multi-level group accumulator scheme as a five-tuple Acc = (Gen, Eval, Witness, Verify, Update)
[0041] Gen: represents a generation algorithm of an initial parameter of an accumulator.
[0042] Eval: represents an accumulator generation algorithm, and different accumulators have different accumulator generation methods.
[0043] Witness: represents an element member / non-member evidence generation algorithm, and the data size required for generating element evidence can be effectively reduced by grouping and layering the elements to be accumulated.
[0044] Verify: represents an element member / non-member evidence verification algorithm, and the evidence output by the Witness algorithm and the accumulator output by the Eval algorithm are input to verify the element evidence.
[0045] Update: represents an accumulator update algorithm.
[0046] Definition 2 sets an accumulated element set as X, and X contains {X1, X2, …, X n} elements.
[0047] Definition 3: Accumulator administrator: generates a key pair and an accumulator.
[0048] Definition 4: Service provider: generates member / non-member evidence of an element.
[0049] Definition 5: Verifier: verifies whether an element exists in a set by verifying the evidence provided by the service provider and the accumulated value disclosed by the accumulator.
[0050] As can be seen, the multi-level group accumulator construction method provided by the embodiment of the application can be applied at a service provider, and a multi-level group password accumulator is constructed, which is composed of sub-accumulation values and root accumulation values. The root accumulation values are nested by layering and grouping the sub-accumulation values, effectively reducing the data size required for generating element member evidence / non-member evidence, and having the characteristics of unordered data in the group and fixed identity of data elements in the group, so that the multi-level group password accumulator can be more effectively applied to a massive data application scenario.
[0051] As an optional implementation of the embodiment of the application, the multi-level group accumulator construction method provided by the embodiment of the application further includes: the service provider sends the root accumulation value RAcc and part of the sub-accumulation values in the accumulation process to the verifier. Thus, it is convenient for the verifier to verify subsequently.
[0052] As an optional implementation of the embodiment of the present application, the method for constructing the multi-level grouping accumulator further comprises: the service provider receives the required related parameters for the accumulator administrator to generate the accumulated calculation according to the preset rules.
[0053] Specifically, the present application takes the RSA accumulator and Figure 2 The structure is taken as an example to illustrate the flow of the multi-level grouping cipher accumulator, and it should be noted that the multi-level grouping cipher accumulator is not only applicable to the RSA accumulator, but also can be applied to various cipher accumulator modes, and supports using different cipher accumulators between different levels and different groups. The specific description is as follows:
[0054] The accumulator parameter initialization flow is shown in Figure 3 , and the specific steps are as follows:
[0055] Step 1: Determine which accumulation operations should be included in the system.
[0056] Step 2: The accumulator administrator generates the required related parameters for the accumulated calculation according to the system rules.
[0057] Step 3: The accumulator administrator sends the related parameters to the service provider.
[0058] For example, the accumulator administrator generates the RSA accumulator related parameters; input λ to generate two large prime numbers p and q, calculate N = p*q; send the key pair (sk acc , pk acc ) = ((p, q), N) to the service provider.
[0059] As an optional implementation of the embodiment of the present application, the method for constructing the multi-level grouping accumulator further comprises: the service provider respectively calculates the accumulated values of each group, including: the service provider respectively calculates the accumulated values of each group using the related parameters.
[0060] Specifically, the element accumulated value calculation flow is shown in Figure 4 , and the specific steps are as follows:
[0061] Step 1: The service provider groups the elements to be accumulated according to the system requirements, which can be grouped according to the data number d or other standards.
[0062] Step 2: Calculate the accumulated value of each group after grouping, and record the calculated accumulated value as the sub-accumulated value Acc j .
[0063] Step 3: Based on system requirements, design each group in a hierarchical manner. Let the initial element be located at level i, and each element's sub-accumulated value be at level i+1. Elements in each level are sub-accumulated values of the elements in the lower levels. Perform multi-level nested loops on the sub-accumulated values until the last level has only one accumulated value, denoted as the root accumulated value RAcc.
[0064] Step 4: Send the root accumulated value RAcc and some sub-accumulated values during the accumulation process to the verifier.
[0065] For example: group the elements to be accumulated according to length d; calculate the accumulated value of each group. Convert the accumulated values of each group into prime numbers Acc. j ←HashToPrime(Acc j ); (Acc) j Accumulate Return RAcc to the validator.
[0066] Figure 5 A flowchart of the membership proof method provided in an embodiment of the present invention is shown. See also: Figure 5 The membership verification method provided in this embodiment of the invention includes:
[0067] S1, The service provider constructs the group accumulator according to the multi-level group accumulator construction method described above;
[0068] S2, the service provider receives the element X to be proved sent by the verifier. i Determine the element X to be proven. i The lowest level group it belongs to;
[0069] S3, the service provider generates the sub-accumulated value Acc. i For the corresponding membership evidence w1, take w1 as the new element to be proved, generate membership proofs for w1 under its sub-accumulations, and iterate this process until membership evidence w under RAcc is generated. r The member evidence generated in this process is aggregated into w = (w1, w2, ..., w r );
[0070] S4, the service provider sends the evidence w of the element member to be proved to the verifier;
[0071] S5, the verifier makes a judgment based on its own known parameters and the membership evidence w of the element to be verified, calculates according to the membership proof method corresponding to each layer accumulator and w, and compares the calculation result with the known parameters. If it is consistent with the known parameters, the verification passes; otherwise, the verification fails.
[0072] In practice, the element membership proof process is as follows: Figure 6The specific steps are as follows:
[0073] Step 1 When the verifier wants to obtain the membership evidence of an element, the verifier sends the element X to be proved to the service provider i .
[0074] Step 2 The service provider receives the element X to be generated for membership proof i , and first locates the lowest layer group to which the element X belongs. i
[0075] Step 3 The service provider generates the membership evidence w1 of the element X i in the group, takes w1 as a new element to be proved, generates the membership proof of w1 under its child accumulation value, and iterates the process until the membership evidence w r under RAcc is generated. The membership evidence generated in this process is aggregated as w=(w1,w2,…,w r ). It should be noted that in the process of iteratively generating w, the amount of data required in the process of generating w can be reduced by reasonable grouping.
[0076] Step 4 The membership evidence w of the element is returned to the verifier, and the existence verification is performed by the verifier.
[0077] Step 5 The verifier performs verification calculation according to the membership evidence w i of each layer element, i∈[1,r], until the root accumulation value RAcc or the child accumulation value Acc j known by the verifier is calculated. The self can realize the pre-knowledge of related parameters through local saving or remote storage, etc.
[0078] Step 6 The verifier verifies w layer by layer. Under the condition that the verifier pre-knows part of the child accumulation values, the verifier verifies w layer by layer from bottom to top according to the membership proof method corresponding to each layer accumulator. If the calculation result of the i-th layer is consistent with the child accumulation value corresponding to the layer, it means that the verification is passed; if the calculation result of the i-th layer is inconsistent with the child accumulation value corresponding to the layer, it means that the verification fails, and no subsequent calculation is performed in both cases. If the verifier only pre-knows RAcc, the verifier needs to calculate all the evidence of r layers from bottom to top, and compare the final calculation result with RAcc. If the calculation result is equal to RAcc, the proof verification is passed, otherwise the proof verification fails.
[0079] For example: for the element X i , first locate the lowest layer group to which the element X i belongs, that is, {X1,X2,…,X i-1 ,X i ,X i+1 ,…,Xd};calculate Return w as evidence of element membership to the verifier. Given that the verifier only knows RAcc in advance, the verifier calculates... Convert A to a prime number A←HashToPrime(A); Calculate Res = w2 A mod N; the verifier verifies element X by verifying whether the equation Res = RAcc holds true. i If the verification is successful, output 1; otherwise, output 0.
[0080] Therefore, the membership proof method provided by the embodiments of the present invention can effectively reduce the data size required to generate non-member evidence and improve the efficiency of proof.
[0081] Figure 7 A flowchart of the non-membership proof method provided in an embodiment of the present invention is shown. See also: Figure 7 The non-membership proof method provided in this embodiment of the invention includes:
[0082] S1, The service provider constructs the group accumulator according to the multi-level group accumulator construction method described above;
[0083] S2, the service provider receives the element X to be proved sent by the verifier. n Determine the element X to be proven. n The lowest-level group it might belong to, based on the accumulated value Acc corresponding to that group. j The cryptographic accumulation algorithm used generates element X. n At Acc j Non-member evidence π n And the generated sub-accumulated value Acc j Membership evidence under RAcc;
[0084] S3, the service provider will provide evidence of the element members to be proven (π) n (w) Send to the verifier;
[0085] S4, Verifier verifies Acc j The legitimacy of the member's evidence w;
[0086] S5, if the validator verifies that the member's evidence w is valid, according to Acc... j The corresponding non-member evidence verification method is used for element X. n Non-member evidence π n judge.
[0087] In practice, the non-membership proof process for elements is as follows: Figure 8 As shown, the specific steps are as follows:
[0088] Step 1: When a validator wants to obtain non-membership evidence for a certain element, the validator sends the element X to be proved to the service provider. n .
[0089] Step 2: The service provider first locates the lowest-level group where the element may exist.
[0090] Step 3: Based on the accumulated value Acc of this group j The cryptographic accumulation algorithm used generates element X. n At Acc j Non-member evidence π n .
[0091] Step 4: Generate the sub-accumulated value Acc j Membership evidence w under RAcc.
[0092] Step 5: The service provider will (π) n The result (w) is returned to the validator, who then performs non-member evidence verification.
[0093] Step 6: The verifier first verifies Acc. j The member's evidence w, if verified, is used according to Acc. j The corresponding non-member evidence verification method completes element X. n Non-member evidence assessment.
[0094] For example: for element X n First, find X. n Possible grouping, definition According to Bezout's theorem, aX n +bX * =1 Calculate the coefficients (a,b); Let B = g a mod N, π n =(Acc) j ,b,B); Call w←MemWit(pk acc Acc j ,RAcc) generates Acc j Member evidence w; will (π n The element (w) is returned to the validator as evidence of non-membership. The validator calls the validation method in the MemWit function to verify the validity of w; by checking the equation... The function checks whether an element exists in the accumulator. If the verification is successful, it returns 1; otherwise, it returns 0.
[0095] Therefore, the non-member proof method provided by the embodiments of the present invention can effectively reduce the data size required to generate non-member evidence and improve the efficiency of proof.
[0096] Of course, the present invention also provides an evidence update scheme, which supports dynamic updates of elements in the set, including element addition and element deletion.
[0097] (I) Adding elements in batches
[0098] The flowchart for adding an element to the accumulator is as follows: Figure 9 As shown, the specific steps are as follows:
[0099] Step 1: When the accumulator needs to add a new element, the service provider receives the new element to be accumulated.
[0100] Step 2: Group the new elements according to the grouping rules agreed upon by the system.
[0101] Step 3: Update the sub-cumulative value and the root cumulative value according to the accumulation method of each group.
[0102] Step 4: Update the member evidence and non-member evidence of the element.
[0103] For example: An accumulator receives newly added elements and checks the set of elements. Calculate the new sub-accumulated value Acc n Convert to prime number Acc n ←HashToPrime(Acc n Update the root accumulated value. Update element member evidence Updating non-member evidence does not require updating, according to Bezout's theorem and the VerNonMem formula.
[0104] (II) Element Deletion Del
[0105] The flowchart for deleting an element from an accumulator is as follows: Figure 10 As shown, the specific steps are as follows:
[0106] Step 1: When the accumulator needs to delete an element, the accumulator administrator receives the element to be deleted.
[0107] Step 2 updates the sub-cumulative value and the root cumulative value according to the accumulation method of each group.
[0108] Step 3: Update the member evidence and non-member evidence of the element.
[0109] For example: The accumulator administrator deletes element X. n Update X n Sub-accumulation value Acc n Convert ' to prime number Acc n'←HashToPrime(Acc) n Update root accumulated value ′); Update element X i Membership evidence, when X n With X i When they do not belong to the same sub-accumulated value, When X n With X i When they belong to the same sub-accumulated value, Updating non-member evidence does not require updating, according to Bezout's theorem and the VerNonMem formula.
[0110] Figure 11 This diagram illustrates the structure of a multi-level group accumulator construction apparatus provided in an embodiment of the present invention. This apparatus applies the aforementioned method. The following is only a brief description of the structure of the multi-level group accumulator construction apparatus; for other matters not covered herein, please refer to the relevant descriptions in the aforementioned multi-level group accumulator construction method. Figure 11 The multi-level group accumulator construction apparatus provided in this embodiment of the invention includes:
[0111] The grouping module is used to group the current elements to be accumulated into n groups, each group containing any d elements to be accumulated, resulting in a set of grouped accumulated elements X = {[X1, X2, ..., X...}. d ],…,[X (i-1)*d+1 ,…,X i*d ],…,[X (n-1)*d+1 ,…,X n*d ]};
[0112] The calculation module is used to calculate the cumulative value of each group separately, and obtain n sub-cumulative values Acc = {Acc1, ..., Acc i ,…,Acc n If n≠1, then the sub-accumulated value is used as the current element to be accumulated, and the grouping module is notified; if n=1, then the construction module is notified.
[0113] The module is used to construct a grouped accumulator by taking n sub-accumulators as the root accumulator RAcc. The grouped accumulator includes: each sub-accumulator and the root accumulator RAcc.
[0114] As an optional embodiment of the present invention, the multi-level group accumulator construction device provided in the present invention further includes: a sending module, used to send the root accumulator value RAcc and some sub-accumulator values in the accumulation process to the verifier.
[0115] As an optional implementation of the present invention, the multi-level group accumulator construction device provided in the present invention further includes: a receiving module, used to receive the required relevant parameters for the accumulation calculation generated by the accumulator administrator according to preset rules.
[0116] As an optional implementation of this invention, the calculation module calculates the cumulative value of each group in the following manner: calculating the cumulative value of each group using relevant parameters.
[0117] Therefore, the multi-level block accumulator construction device provided by the embodiments of the present invention can be applied to service providers to construct a multi-level block cipher accumulator, which consists of sub-accumulator values and a root accumulator value. By nesting the sub-accumulator values in a hierarchical manner through the root accumulator value, the size of the data required to generate member evidence / non-member evidence is effectively reduced. It also has the characteristics of unordered data within the group and fixed identity of data elements within the group, making the multi-level block cipher accumulator more effectively applicable to application scenarios with massive amounts of data.
[0118] Figure 12 This diagram illustrates the structure of a membership verification system provided in an embodiment of the present invention. This system applies the aforementioned method. The following is only a brief description of the system's structure; for other matters not covered herein, please refer to the relevant descriptions in the membership verification method described above. Figure 12 The membership verification system provided in this embodiment of the invention includes:
[0119] The service provider constructs a block accumulator using the aforementioned multi-level block accumulator construction apparatus; and receives the element X to be proved sent by the verifier. i Determine the element X to be proven. i The lowest-level group it belongs to; the sub-accumulated value Acc is generated. i For the corresponding membership evidence w1, take w1 as the new element to be proved, generate membership proofs for w1 under its sub-accumulations, and iterate this process until membership evidence w under RAcc is generated. r The member evidence generated in this process is aggregated into w = (w1, w2, ..., w r Send the evidence w of the element member to be proved to the verifier;
[0120] The verifier is used to make judgments based on its own known parameters and the membership evidence w of the element to be verified. It performs calculations according to the membership proof methods corresponding to each layer accumulator and w, and compares the calculation results with the known parameters. If they are consistent with the known parameters, the verification passes; otherwise, the verification fails.
[0121] Therefore, the membership proof system provided by the embodiments of the present invention can effectively reduce the data size required to generate non-member evidence and improve the efficiency of proof.
[0122] Figure 13 This diagram illustrates the structure of a non-membership proof system provided in an embodiment of the present invention. This non-membership proof system applies the aforementioned method. The following is only a brief description of the structure of the non-membership proof system; for other matters not covered herein, please refer to the relevant descriptions in the aforementioned non-membership proof method. Figure 13 The non-membership verification system provided in this embodiment of the invention includes:
[0123] The service provider constructs a block accumulator using the aforementioned multi-level block accumulator construction apparatus; and receives the element X to be proved sent by the verifier. n Determine the element X to be proven. n The lowest-level group it might belong to, based on the accumulated value Acc corresponding to that group. j The cryptographic accumulation algorithm used generates element X. n At Acc j Non-member evidence π n And the generated sub-accumulated value Acc j Membership evidence w under RAcc; evidence of the membership of the element to be proven (π) n (w) Send to the verifier;
[0124] The verifier is used to first verify Acc. j The validity of member evidence w; if member evidence w is valid, according to Acc j The corresponding non-member evidence verification method is used for element X. n Non-member evidence π n judge.
[0125] Therefore, the non-member proof system provided by the embodiments of the present invention can effectively reduce the data size required to generate non-member evidence and improve the efficiency of proof.
[0126] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. A membership attestation method, characterized by, Comprising: S1, the service provider constructs a group accumulator according to a multi-level group accumulator construction method; The multi-level group accumulator construction method comprises: S11, the service provider groups the current elements to be accumulated into n groups, each group including any d of the current elements to be accumulated, to obtain a set of grouped accumulated elements X = {[X1, X2, …, Xn} of the current elements to be accumulated, to obtain a set of grouped accumulated elements X = {[X1, X2, …, Xn d ],…,[X (i-1)*d+1 ,…,X i*d ],…,[X (n-1)*d+1 ,…,X n*d ]}; S12, the service provider calculates the cumulative value of each group respectively, and obtains n sub-cumulative values Acc = {Acc1, ..., Acc i ,…,Acc n If n≠1, then the sub-accumulated value is taken as the current element to be accumulated, and the process returns to execute S11; if n=1, then the process executes S13. S13, the service provider constructs a group accumulator by taking the n sub-accumulation values as a root accumulation value RAcc, and the group accumulator comprises each sub-accumulation value and the root accumulation value RAcc; S2, the service provider receives the to-be-proved element X sent by the verifier i determines the to-be-proved element X i the most bottom layer group to which the service provider belongs S3, the service provider generates the sub-accumulation value Acc i The corresponding member evidence w1, taking w1 as a new element to be proved, generates the member proof of w1 under its sub-accumulation value, and iterates this process in a loop until the member evidence w under RAcc is generated r , the member evidence generated in this process is aggregated as w=(w1, w2, …, w r ) S4, the service provider sends the evidence w of the element member to be proved to the verifier; S5, the verifier judges according to the parameters known by itself and the evidence w of the element member to be proved, calculates according to the member proof method corresponding to each level accumulator and w, compares the calculation result with the known parameters, and if they are consistent, the verification is passed, otherwise the verification fails.
2. The method according to claim 1, characterized in that, Further comprising: The service provider sends the root accumulation value RAcc and part of the sub-accumulation values in the accumulation process to the verifier.
3. The method of claim 1, wherein, Further comprising: The service provider receives the required related parameters for accumulation calculation generated by the accumulator administrator according to the preset rules.
4. The method of claim 3, wherein, The service provider calculates the accumulation values of each group respectively, comprising: The service provider calculates the accumulation values of each group respectively by using the related parameters.
5. A non-member attestation method, characterized by, Comprising: S1, the service provider constructs a group accumulator according to a multi-level group accumulator construction method; The multi-level group accumulator construction method comprises: S11, the service provider groups the current elements to be accumulated into n groups, each group including any d of the current elements to be accumulated, to obtain a set of grouped accumulated elements X = {[X1, X2, …, Xn} of the current elements to be accumulated, to obtain a set of grouped accumulated elements X = {[X1, X2, …, Xn d ],…,[X (i-1)*d+1 ,…,X i*d ],…,[X (n-1)*d+1 ,…,X n*d ]}; S12, the service provider calculates the cumulative value of each group respectively, and obtains n sub-cumulative values Acc = {Acc1, ..., Acc i ,…,Acc n If n≠1, then the sub-accumulated value is taken as the current element to be accumulated, and the process returns to execute S11; if n=1, then the process executes S13. S13, the service provider constructs a group accumulator by taking the n sub-accumulation values as a root accumulation value RAcc, and the group accumulator comprises each sub-accumulation value and the root accumulation value RAcc; S2, the service provider receives the to-be-proved element X sent by the verifier n , determines the lowest layer group where the to-be-proved element X n may be located, generates the element X j based on the cumulative value Acc n corresponding to the group and the cryptographic cumulative algorithm adopted by the group, generates the non-member evidence π j under Acc n , and generates the member evidence w under RAcc j of the sub-cumulative value Acc S3, the service provider sends the proof (π n ,w) of the element membership to the prover; S4, the verifier verifies the legality of the membership evidence w of Acc j of the membership evidence w. S5, the verifier verifies the membership witness w is legal, according to Acc j The corresponding non-member witness verification method is element X n The non-member witness π n Judgment.
6. The method of claim 5, wherein, Further comprising: The service provider sends the root accumulation value RAcc and part of the sub-accumulation values in the accumulation process to the verifier.
7. The method of claim 5, wherein, Further comprising: The service provider receives the required related parameters for accumulation calculation generated by the accumulator administrator according to the preset rules.
8. The method of claim 7, wherein, The service provider calculates the accumulation values of each group respectively, comprising: The service provider calculates the accumulation values of each group respectively by using the related parameters.
9. A membership proof system characterized by, Comprising: The service provider is used for constructing a group accumulator by using a multi-level group accumulator construction device; Receiving the to-be-proved element X sent by the verifier i Determining the to-be-proved element X i The most bottom layer group to which the to-be-proved element belongs; generating a sub-accumulation value Acc i The corresponding member evidence w1, taking w1 as a new to-be-proved element, generating the member proof of w1 under its sub-accumulation value, and iteratively circulating the process until the member evidence w under RAcc is generated r Aggregating the member evidence generated in this process into w=(w1, w2, …, w r ); and sending the evidence w of the to-be-proved element member to the verifier The verifier is used for judging according to the parameters known by itself and the evidence w of the element member to be proved, calculating according to the member proof method corresponding to each level accumulator and w, comparing the calculation result with the known parameters, and if they are consistent, the verification is passed, otherwise the verification fails; Wherein: The multi-level group accumulator construction device comprises: A grouping module is configured to group the current elements to be accumulated into n groups, each group including any d current elements to be accumulated, to obtain a set of grouped accumulated elements X={ [X1, X2, …, Xn-1, Xn}. d ],…,[X (i-1)*d+1 ,…,X i*d ],…,[X (n-1)*d+1 ,…,X n*d} The calculation module is used to calculate the cumulative value of each group separately, and obtain n sub-cumulative values Acc = {Acc1, ..., Acc i ,…,Acc n If n≠1, then the sub-accumulated value is used as the current element to be accumulated, and the grouping module is notified; if n=1, then the construction module is notified. A construction module is used for constructing a group accumulator by taking the n sub-accumulation values as a root accumulation value RAcc, and the group accumulator comprises each sub-accumulation value and the root accumulation value RAcc.
10. The apparatus of claim 9, wherein, Further comprising: A sending module is used for sending the root accumulation value RAcc and part of the sub-accumulation values in the accumulation process to the verifier.
11. The apparatus of claim 9, wherein, Further comprising: A receiving module is used for receiving the required related parameters for accumulation calculation generated by the accumulator administrator according to the preset rules.
12. The apparatus of claim 11, wherein, The calculation module calculates the accumulation values of each group respectively by using the related parameters.
13. A non-member attestation system, characterized by, Comprising: The service provider constructs a block accumulator using a multi-level block accumulator construction device; it receives the element X to be proved from the verifier. n Determine the element X to be proved. n The lowest-level group it might belong to, based on the accumulated value Acc corresponding to that group. j The cryptographic accumulation algorithm used generates element X. n At Acc j Non-member evidence π n And the generated sub-accumulated value Acc j Membership evidence w under RAcc; evidence of the membership of the element to be proven (π) n (w) is sent to the verifier; The verifier is used to firstly verify the legitimacy of the member evidence w of Acc j ; if the member evidence w is legitimate, the corresponding non-member evidence verification method of Acc j is used to judge the non-member evidence π n of element X n . The multi-level group accumulator construction device comprises: A grouping module is configured to group the current elements to be accumulated into n groups, each group including any d current elements to be accumulated, to obtain a set of grouped accumulated elements X={ [X1, X2, …, Xn-1, Xn}. d ],…,[X (i-1)*d+1 ,…,X i*d ],…,[X (n-1)*d+1 ,…,X n*d} The calculation module is used to calculate the cumulative value of each group separately, and obtain n sub-cumulative values Acc = {Acc1, ..., Acc i ,…,Acc n If n≠1, then the sub-accumulated value is used as the current element to be accumulated, and the grouping module is notified; if n=1, then the construction module is notified. A constructing module is configured to construct a group accumulator by taking the n sub-accumulation values as a root accumulation value RAcc, wherein the group accumulator comprises each of the sub-accumulation values and the root accumulation value RAcc.
14. The apparatus of claim 13, wherein, Further comprising: A sending module is configured to send the root accumulation value RAcc and part of the sub-accumulation values in the accumulation process to a verifier.
15. The apparatus of claim 13, wherein, Further comprising: A receiving module is configured to receive required related parameters of the accumulation calculation generated by an accumulator administrator according to preset rules.
16. The apparatus of claim 15, wherein, The calculating module calculates the accumulation values of each group respectively by using the related parameters.
Citation Information
Patent Citations
Systems and methods for trustless proof of possession and transmission of secured data
US10846372B1