An asset certification method and device

Abstract

An embodiment of the present invention relates to an asset certification method and apparatus. The method includes: receiving an asset verification request from a verification end for n users, where the asset verification request is used to request a provider to provide a proof that the asset amounts of the n users are within a preset range; obtaining the asset amounts of the n users, and after determining that the asset amount of each of the n users is within the preset range, forming a first vector using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; forming a second vector using multiple different amounts within the preset range, and each element in the first vector exists in the second vector; determining a proof according to the first vector and the second vector; and sending the proof to the verification end. It is realized that the verification end proves that the assets of the n users are within the preset range without knowing the specific asset amounts of the n users, and the method is simpler and more time-saving.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular, to an asset certification method, apparatus, computing device, and computer-readable storage medium. Background Art

[0002] With the development of computer technology, more and more technologies are applied in the financial field, and traditional finance is gradually transforming into financial technology (Fintech). However, due to the security and real-time requirements of the financial industry, higher requirements are also put forward for technology.

[0003] In daily life, there are some institutions that provide corresponding services to users only when the users' assets meet a preset range. Therefore, it is necessary for the asset certifier to present the asset certificate of the user and send the asset certificate to the asset verifier, which can be the institution. For the protection of user privacy, the specific amount of the user's assets will not appear in the asset certificate. The asset verifier can determine whether the user's assets are within the preset range based on the asset certificate, and then provide corresponding services. For example, a certain loan platform stipulates that a user's assets must be greater than 100,000 yuan to obtain a loan on this loan platform. A certain user wants to obtain a loan on this loan platform and requests the asset certifier to provide an asset certificate. The asset certifier verifies and determines that the user's assets are 150,000 yuan, forms an asset certificate based on the specific amount of the user's assets and the preset range, and the specific amount of the user's assets does not appear in this asset certificate. The asset certifier sends the asset certificate to the asset verifier. The asset verifier determines based on the asset certificate that the user's assets are indeed greater than 100,000 yuan, but the asset verifier cannot know the specific amount of the user's assets.

[0004] The algorithm used by the asset certifier to form an asset certificate based on the specific amount of the user's assets and the preset range is the proof algorithm. The commonly used proof algorithms currently all need to first convert each input, such as the specific amount and the preset range, into logic gates, and then perform range proof. Commonly used proof algorithms include the Merkle proof algorithm, the zero-knowledge proof system Groth16, etc. Taking Groth16 as an example, after converting the specific amount of the user's assets into binary, a set of logic gates is constructed (for example, 15 is represented as 1111 in binary, so this set of logic gates includes 4 logic gates); after converting the preset range into binary, a set of logic gates is constructed (for example, 10 is represented as 1010 in binary, so this set of logic gates includes 4 logic gates); then, based on the proof framework of Groth16, a zero-knowledge proof is made for the two sets of logic gates.

[0005] However, the above method has the following problems: 1. Each input needs to be converted into a logic gate first. If the input value is very large, the number of logic gates will increase accordingly, and the time for proof and the consumption of computing resources will increase accordingly; 2. If it is necessary to prove the assets of multiple users, the number of logic gate sets needs to increase, and the time for proof and the consumption of computing resources will also increase accordingly. For example, if the asset prover wants to prove the assets of user A (the specific amount of assets is 150,000), user B (the specific amount of assets is 200,000), and user C (the specific amount of assets is 300,000), it is necessary to construct logic gate sets for 15, 20, and 30 respectively.

[0006] Existing technologies all need to convert the input into logic gates first, and cannot directly prove the range according to each input. It takes a long time and consumes a large amount of resources, and is not simple enough. Summary of the Invention

[0007] An embodiment of the present invention provides an asset proof method for more quickly and simply proving assets.

[0008] In a first aspect, an embodiment of the present invention provides an asset proof method, which is applied to a providing end and includes:

[0009] Receiving an asset verification request from a verification end for n users, where the asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range;

[0010] Obtaining the asset amounts of the n users. After determining that the asset amount of each user among the n users is within the preset range, forming a first vector with the asset amounts of the n users, where any element in the first vector is the asset amount of any user; forming a second vector with multiple different amounts within the preset range, and each element in the first vector exists in the second vector;

[0011] Determining a proof according to the first vector and the second vector; the proof includes multiple sub-proofs;

[0012] Sending the proof to the verification end; the verification end is used to determine whether the multiple sub-proofs meet a preset relationship. If they meet, it is determined that the asset amounts of the n users are within the preset range.

[0013] In the above technical solution, the verification end never knows the specific elements in the first vector and the second vector throughout the process, but obtains the proof constructed from the first vector and the second vector. By verifying the proof, the relationship between the first vector and the second vector is determined. There is no need to use logic gates to represent specific amounts and preset ranges, nor to directly compare specific amounts and preset ranges through logic gates. Instead, the first vector is determined according to the user's asset amount, the second vector is determined according to multiple amounts within the preset range, and the proof is determined according to the first vector and the second vector. When the verification end receives the proof, it verifies the proof to verify the relationship between the first vector and the second vector. Since the second vector determined by the providing end is determined according to each amount within the preset range, if the verification end verifies that each element in the first vector exists in the second vector, it can directly determine that each element in the first vector is within the preset range. In this way, by constructing the second vector for the preset range, the problem is transformed, and it is realized that the verification end proves that the assets of n users are within the preset range without knowing the specific amounts of the assets of n users. The method is simpler and more time-saving.

[0014] In some embodiments, determining the proof according to the first vector and the second vector includes:

[0015] Merging the first vector and the second vector to obtain a merged vector;

[0016] Determining a relationship polynomial according to the first vector, the second vector, and the merged vector, and using the relationship polynomial as the first sub-proof; the relationship polynomial is used to characterize the relationship between the first vector and the second vector;

[0017] Determining a value polynomial according to the merged vector, and using the value polynomial as the second sub-proof; the value polynomial is used to take values for each element in the merged vector;

[0018] Determining a value offset polynomial according to the merged vector, and using the value offset polynomial as the third sub-proof; the value polynomial is used to take offset values for each element in the merged vector.

[0019] Merging the first vector and the second vector to obtain a merged vector; constructing a relationship polynomial, a value polynomial, and a value offset polynomial, and describing the relationship between the first vector and the second vector through 3 polynomials. Using the value polynomial, the value offset polynomial, and the relationship polynomial as the proof can provide an effective and credible proof to the verification end without disclosing the specific amounts of the assets of n users, ensuring zero-knowledge.

[0020] In some embodiments, before determining the relationship polynomial according to the first vector, the second vector, and the combined vector, it further includes:

[0021] Receiving the key sent by the verification end;

[0022] Determining the relationship polynomial according to the first vector, the second vector, and the combined vector includes:

[0023] Determining the relationship polynomial according to the key, the first vector, the second vector, and the combined vector.

[0024] Determining the relationship polynomial by using the key provided by the verification end increases the credibility of the relationship polynomial, reduces the possibility of the relationship polynomial being tampered with, and ensures the security and effectiveness of the proof.

[0025] In some embodiments, determining the relationship polynomial according to the first vector, the second vector, and the combined vector includes:

[0026] For a first element among the n elements in the first vector, determining a first relationship between the position of the first element in the first vector and the position of the first element in the combined vector; the first element is any one of the n elements;

[0027] For a second element among the d elements in the second vector, determining a second relationship between the position of the second element in the second vector and the position of the second element in the combined vector; the second element is any one of the d elements;

[0028] Constructing the relationship polynomial according to the first relationship and the second relationship.

[0029] In some embodiments, the relationship polynomial Z(g i ) satisfies the following conditions: (1) When i = 1, Z(g i ) = 1;

[0030] (2) When 2 ≤ i < n + 1,

[0031] (3) When i = n + 1, Z(g i ) = 1;

[0032] Wherein, the g i is any element in the multiplicative subgroup H, H = {g, g 2 …, g n , g n+1 = 1}; the γ is the key; the f j is the first element, the f jis at the j-th position in the first vector; the t j is the second element, the t j is at the j-th position in the second vector; the s j is the j-th element in the merged vector; the s n+j is the (n + j)-th element in the merged vector; the is used to represent the first relationship; the is used to represent the second relationship.

[0033] In a second aspect, an embodiment of the present invention further provides an asset certification method, which is applied to a verification end and includes:

[0034] Sending an asset verification request for n users to a providing end, where the asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range;

[0035] Receiving the proof sent by the providing end; the proof is determined by the providing end according to a first vector and a second vector; the first vector is formed by the providing end using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; the second vector is formed by the providing end using multiple different amounts within the preset range; each element in the first vector exists in the second vector; the proof includes multiple sub-proofs;

[0036] Determining a verification formula according to the proof, and using the verification formula to determine whether the multiple sub-proofs meet a preset relationship; if they meet, it is determined that the asset amounts of the n users are within the preset range.

[0037] In some embodiments, the proof is determined by the following method, including:

[0038] Merging the first vector and the second vector to obtain a merged vector;

[0039] Determining a relationship polynomial according to the first vector, the second vector and the merged vector, and using the relationship polynomial as the first sub-proof; the relationship polynomial is used to represent the relationship between the first vector and the second vector;

[0040] Determining a value polynomial according to the merged vector, and using the value polynomial as the second sub-proof; the value polynomial is used to obtain values for each element in the merged vector;

[0041] Determining a value offset polynomial according to the merged vector, and using the value offset polynomial as the third sub-proof; the value polynomial is used to obtain offset values for each element in the merged vector.

[0042] In some embodiments, determining whether the multiple sub-proofs meet a preset relationship by using the verification formula includes:

[0043] Optionally select a random number, substitute the random number into the multiple sub-proofs, and determine whether the multiple sub-proofs after substituting the random number meet the verification formula; the random number is any element in the multiplicative subgroup H, and H = {g, g 2 …, g n , g n+1 = 1}.

[0044] In some embodiments, the verification formula includes a first sub-verification formula, a second sub-verification formula, a third sub-verification formula, and a fourth sub-verification formula; the first sub-verification formula is used to verify whether the value-taking polynomial and the value-taking offset polynomial take correct values; the second sub-verification formula, the third sub-verification formula, and the fourth sub-verification formula are used to verify whether the relationship polynomial is correctly constructed.

[0045] In some embodiments, the first sub-verification formula is: L n+1 (δ)(h1(δ) - h2(g·δ)) = 0;

[0046] The second sub-verification formula is: L1(δ)(Z(δ) - 1) = 0;

[0047] The third sub-verification formula is: Z(δ)(γ + f(δ))(γ + t(δ)) = Z(g·δ)(γ + h1(δ))(γ + h2(δ));

[0048] The fourth sub-verification formula is: L n+1 (δ)(Z(δ) - 1) = 0;

[0049] where δ is any random number taken from the multiplicative subgroup H, and H = {g, g 2 …, g n , g n+1 = 1}; L is a selection polynomial; the selection polynomial satisfies: L i (g i ) = 1 and L i (g j ) = 0, j ≠ i; h1 is the value-taking polynomial; h2 is the value-taking offset polynomial; Z(δ) is the relationship polynomial; γ is the key; f is the first vector; t is the second vector.

[0050] Thirdly, an asset proof device provided by an embodiment of the present invention further includes:

[0051] A first receiving unit, configured to receive an asset verification request from a verification end for n users, where the asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range;

[0052] A first processing unit, configured to:

[0053] Obtain the asset amounts of the n users, and after determining that the asset amount of each user among the n users is within the preset range, form a first vector using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; form a second vector using multiple different amounts within the preset range, and each element in the first vector exists in the second vector;

[0054] Determine a proof according to the first vector and the second vector; the proof includes multiple sub-proofs;

[0055] A first sending unit, configured to send the proof to the verification end; the verification end is configured to determine whether the multiple sub-proofs meet a preset relationship, and if so, determine that the asset amounts of the n users are within the preset range.

[0056] In some embodiments, the first processing unit is specifically configured to:

[0057] Merge the first vector and the second vector to obtain a merged vector;

[0058] Determine a relationship polynomial according to the first vector, the second vector, and the merged vector, and use the relationship polynomial as a first sub-proof; the relationship polynomial is used to characterize the relationship between the first vector and the second vector;

[0059] Determine a value polynomial according to the merged vector, and use the value polynomial as a second sub-proof; the value polynomial is used to take values for each element in the merged vector;

[0060] Determine a value offset polynomial according to the merged vector, and use the value offset polynomial as a third sub-proof; the value polynomial is used to perform offset value taking for each element in the merged vector.

[0061] In some embodiments, before determining the relationship polynomial according to the first vector, the second vector, and the merged vector, the first receiving unit is further configured to:

[0062] Receive a key sent by the verification end;

[0063] The first processing unit is specifically configured to:

[0064] Determine the relationship polynomial according to the secret key, the first vector, the second vector, and the combined vector.

[0065] In some embodiments, the first processing unit is specifically configured to:

[0066] For a first element among the n elements in the first vector, determine a first relationship between the position of the first element in the first vector and the position of the first element in the combined vector; the first element is any one of the n elements;

[0067] For a second element among the d elements in the second vector, determine a second relationship between the position of the second element in the second vector and the position of the second element in the combined vector; the second element is any one of the d elements;

[0068] Construct the relationship polynomial according to the first relationship and the second relationship.

[0069] In some embodiments, the relationship polynomial Z(g i ) satisfies the following conditions: (1) When i = 1, Z(g i ) = 1;

[0070] (2) When 2 ≤ i < n + 1,

[0071] (3) When i = n + 1, Z(g i ) = 1;

[0072] where, the g i is any element in the multiplicative subgroup H, H = {g, g 2 …, g n , g n+1 = 1}; the γ is the secret key; the f j is the first element, the position of the f j in the first vector is the j-th; the t j is the second element, the position of the t j in the second vector is the j-th; the s j is the j-th element in the combined vector; the s n+j is the (n + j)-th element in the combined vector; the is used to represent the first relationship; the is used to represent the second relationship.

[0073] Fourthly, an asset certification device provided by an embodiment of the present invention further includes:

[0074] A second sending unit, configured to send an asset verification request for n users to a providing end, where the asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range;

[0075] A second receiving unit, configured to receive the proof sent by the providing end; the proof is determined by the providing end according to a first vector and a second vector; the first vector is formed by the providing end using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; the second vector is formed by the providing end using multiple different amounts within the preset range; each element in the first vector exists in the second vector; the proof includes multiple sub-proofs;

[0076] A second processing unit, configured to determine a verification formula according to the proof, and use the verification formula to determine whether the multiple sub-proofs meet a preset relationship; if so, determine that the asset amounts of the n users are within the preset range.

[0077] In some embodiments, the proof is determined by the following method, including:

[0078] Merge the first vector and the second vector to obtain a merged vector;

[0079] Determine a relationship polynomial according to the first vector, the second vector, and the merged vector, and use the relationship polynomial as a first sub-proof; the relationship polynomial is used to represent the relationship between the first vector and the second vector;

[0080] Determine a value polynomial according to the merged vector, and use the value polynomial as a second sub-proof; the value polynomial is used to take values for each element in the merged vector;

[0081] Determine a value offset polynomial according to the merged vector, and use the value offset polynomial as a third sub-proof; the value polynomial is used to take offset values for each element in the merged vector.

[0082] In some embodiments, the second processing unit is specifically configured to:

[0083] Optionally select a random number, substitute the random number into the multiple sub-proofs, and determine whether the multiple sub-proofs after substituting the random number meet the verification formula; the random number is any element in the multiplicative subgroup H, H = {g, g 2 …, g n , g n+1 = 1}.

[0084] In some embodiments, the verification formula includes a first sub-verification formula, a second sub-verification formula, a third sub-verification formula, and a fourth sub-verification formula; the first sub-verification formula is used to verify whether the value-taking polynomial and the value-taking offset polynomial take correct values; the second sub-verification formula, the third sub-verification formula, and the fourth sub-verification formula are used to verify whether the relationship polynomial is correctly constructed.

[0085] In some embodiments, the first sub-verification formula is: L n+1 (δ)(h1(δ)-h2(g·δ)) = 0;

[0086] The second sub-verification formula is: L1(δ)(Z(δ)-1) = 0;

[0087] The third sub-verification formula is: Z(δ)(γ + f(δ))(γ + t(δ)) = Z(g·δ)(γ + h1(δ))(γ + h2(δ));

[0088] The fourth sub-verification formula is: L n+1 (δ)(Z(δ)-1) = 0;

[0089] Wherein, δ is any random number taken from the multiplicative subgroup H, H = {g, g 2 …, g n , g n+1 = 1}; L is a selection polynomial; the selection polynomial satisfies: L i (g i ) = 1 and L i (g j ) = 0, j ≠ i; h1 is the value-taking polynomial; h2 is the value-taking offset polynomial; Z(δ) is the relationship polynomial; γ is the key; f is the first vector; t is the second vector.

[0090] Fifthly, an embodiment of the present invention further provides a computing device, including:

[0091] A memory for storing a computer program;

[0092] A processor for calling the computer program stored in the memory and executing the asset certification method listed in any of the above manners according to the obtained program.

[0093] Sixthly, an embodiment of the present invention further provides a computer-readable storage medium, where the computer-readable storage medium stores a computer-executable program, and the computer-executable program is used to cause a computer to execute the asset certification method listed in any of the above manners. Description of the Drawings

[0094] To more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0095] Figure 1a Schematic diagram of a system architecture provided by an embodiment of the present invention;

[0096] Figure 1b Schematic diagram of the architecture of a providing end or a verifying end provided by an embodiment of the present invention;

[0097] Figure 2 Schematic diagram of the flow of a method for asset certification provided by an embodiment of the present invention;

[0098] Figure 3 Schematic diagram of the flow of a method for asset certification provided by an embodiment of the present invention;

[0099] Figure 4a Schematic diagram of the flow of a method for asset certification provided by an embodiment of the present invention;

[0100] Figure 4b Schematic diagram of the flow of a method for asset certification provided by an embodiment of the present invention;

[0101] Figure 5 Schematic diagram of the structure of an asset certification device provided by an embodiment of the present invention;

[0102] Figure 6 Schematic diagram of the structure of an asset certification device provided by an embodiment of the present invention;

[0103] Figure 7 Schematic diagram of the structure of a computer device provided by an embodiment of the present invention. Detailed implementation manners

[0104] To make the purpose, implementation manners and advantages of this application clearer, the following will clearly and completely describe the exemplary implementation manners of this application with reference to the drawings in the exemplary embodiments of this application. Obviously, the described exemplary embodiments are only a part of the embodiments of this application, rather than all the embodiments.

[0105] Based on the exemplary embodiments described in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope protected by the claims of this application. In addition, although the disclosed content in this application is introduced according to exemplary one or several examples, it should be understood that each aspect of these disclosed contents can also constitute a complete implementation manner alone.

[0106] It should be noted that the brief description of the terms in this application is only for facilitating the understanding of the following-described embodiments, rather than intending to limit the embodiments of this application. Unless otherwise specified, these terms should be understood in their ordinary and common meanings.

[0107] In this application, terms such as "first", "second", "third", etc. in the specification, claims and the above-mentioned drawings are used to distinguish similar or like objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise indicated. It should be understood that such terms can be interchanged under appropriate circumstances, for example, it is possible to implement in an order other than those given in the illustration or description of the embodiments of this application.

[0108] In addition, the terms "comprise" and "have" and any variations thereof are intended to cover but not exclude inclusion. For example, a product or device that comprises a series of components does not necessarily have to be limited to those components clearly listed, but may include other components not clearly listed or inherent to these products or devices.

[0109] Figure 1a An exemplary system architecture applicable to the embodiments of the present invention is shown. This system architecture includes a providing end 100 and a verifying end 200.

[0110] The verifying end 200 is used to send an asset verification request to the providing end 100. The asset verification request is used to request the providing end 100 to provide a proof that the asset amounts of n users are within a preset range, verify the proof provided by the providing end 100, and determine whether the asset amounts of the n users are indeed within the preset range according to the verification result.

[0111] The providing end 100 is used to receive the asset verification request sent by the verifying end 200 and provide the verifying end 200 with a proof that the asset amounts of n users are within a preset range.

[0112] The verifying end 200 and the providing end 100 are servers, which can be independent physical servers, or a server cluster or distributed system composed of multiple physical servers, or can also be cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.

[0113] Figure 1bAn exemplary schematic diagram of an architecture of a providing end or a verifying end applicable to an embodiment of the present invention is shown, including a processor 110, a communication interface 120, and a memory 130.

[0114] Among them, the communication interface 120 is used to communicate with a terminal device, transmit and receive information transmitted by the terminal device, and implement communication.

[0115] The processor 110 is the control center of the providing end or the verifying end, connects various parts of the entire providing end or verifying end through various interfaces and circuits, and executes various functions and processes data of the providing end or verifying end by running or executing software programs / modules stored in the memory 130 and calling data stored in the memory 130. In some embodiments, the processor 110 may include one or more processing units.

[0116] The memory 130 can be used to store software programs and modules. The processor 110 executes various function applications and data processing by running the software programs and modules stored in the memory 130. The memory 130 mainly includes a program storage area and a data storage area. Among them, the program storage area can store an operating system, application programs required for at least one function, etc.; the data storage area can store data created according to business processing, etc. In addition, the memory 130 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0117] It should be noted that the above Figure 1b shown structure is only an example, and the embodiments of the present invention are not limited thereto.

[0118] An embodiment of the present invention provides a possible asset certification method, as Figure 2 shown, including:

[0119] Step 201, the verifying end sends an asset verification request for n users to the providing end, and the asset verification request is used to request the providing end to provide a certificate that the asset amounts of the n users are within a preset range.

[0120] Step 202, the providing end receives the asset verification request for n users from the verifying end.

[0121] Step 203, the providing end obtains the asset amounts of the n users. After determining that the asset amount of each user among the n users is within the preset range, a first vector is formed using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; a second vector is formed using multiple different amounts within the preset range, and each element in the first vector exists in the second vector.

[0122] Step 204, the providing end determines a proof based on the first vector and the second vector; the proof includes a plurality of sub-proofs.

[0123] Step 205, the providing end sends the proof to the verifying end; the verifying end is used to determine whether the plurality of sub-proofs conform to a preset relationship, and if so, determines that the asset amounts of the n users are within the preset range.

[0124] Step 206, the verifying end receives the proof sent by the providing end.

[0125] Step 207, the verifying end determines a verification formula according to the proof, and uses the verification formula to determine whether the plurality of sub-proofs conform to a preset relationship; if so, determines that the asset amounts of the n users are within the preset range.

[0126] In step 201, the verifying end sends an asset verification request for n users to the providing end.

[0127] For example, the verifying end sends an asset verification request for user A and user B to the providing end, for verifying whether the asset amounts of user A and user B are within the preset range of [0, 10].

[0128] In step 203, the providing end obtains the asset amounts of n users, and determines whether the asset amount of each user among the n users is within the preset range. If it is, a proof is provided; if the asset amount of any one user is not within the preset range, a response message is sent to the verifying end, and the response message is used to notify the verifying end that the asset amounts of the n users are not all within the preset range.

[0129] Another possible implementation manner is that the providing end only provides a proof for the users within the preset range and does not provide a proof for the users not within the preset range. If the providing end determines that there are a users among the n users whose asset amounts are within the preset range and the remaining n - a users' asset amounts are not within the preset range, the providing end provides a proof according to the asset amounts of the a users within the preset range. For the remaining n - a users, the providing end sends a response message to the verifying end, which is used to notify the verifying end that there are n - a users whose asset amounts are not within the preset range and to notify the verifying end which users the n - a users are respectively.

[0130] Taking the example that all n users are within the preset range, the following introduces the generation process of the proof.

[0131] After determining that the asset amount of each of the n users is within the preset range, a first vector is formed using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; a second vector is formed using multiple different amounts within the preset range.

[0132] For example, if the asset amount of user A is 50,000 yuan and the asset amount of user B is 70,000 yuan, then the first vector f = [5, 7] is formed; d amounts within the preset range [0, 10] are obtained to form the second vector t. For example, d = 4, and the second vector t = [1, 5, 7, 9], or [1, 5, 6, 7], etc. In the embodiments of the present invention, d is not limited, and the second vector t is not limited. As long as each element in the second vector is within the preset range and each element in the first vector exists in the second vector. Among them, the elements in the first vector can be repeated, and the elements in the second vector cannot be repeated.

[0133] In the above example, the number of elements n in the first vector is 2, and the number of elements d in the second vector is 4.

[0134] In step 204, a proof is determined according to the first vector and the second vector, and the proof includes multiple sub-proofs.

[0135] A possible way to determine the proof is as Figure 3 shown, including the following steps:

[0136] Step 301, merge the first vector and the second vector to obtain a merged vector.

[0137] For example, merge the first vector f = [5, 7] and the second vector t = [1, 5, 7, 9] to obtain the merged vector s = [1, 5, 5, 7, 7, 9]. The same elements in the merged vector are adjacent, and the elements in the first vector, the elements in the second vector, and the elements in the merged vector are all arranged in ascending order.

[0138] Step 302, determine a relationship polynomial according to the first vector, the second vector, and the merged vector, and use the relationship polynomial as the first sub-proof; the relationship polynomial is used to characterize the relationship between the first vector and the second vector.

[0139] A possible method for determining the relationship polynomial is as Figure 4a shown, including:

[0140] Step 401, for the first element among the n elements in the first vector, determine a first relationship between the position of the first element in the first vector and the position of the first element in the merged vector; the first element is any one of the n elements.

[0141] Step 402: For the second element among the d elements in the second vector, determine a second relationship between the position of the second element in the second vector and the position of the second element in the merged vector; the second element is any one of the d elements.

[0142] Step 403: Construct the relationship polynomial according to the first relationship and the second relationship.

[0143] For example, the relationship polynomial Z(g i ) satisfies the following conditions: (1) When i = 1, Z(g i ) = 1;

[0144] (2) When 2 ≤ i < n + 1,

[0145] (3) When i = n + 1, Z(g i ) = 1;

[0146] where, the g i is any element in the multiplicative subgroup H, H = {g, g 2 …, g n , g n+1 = 1}; the γ is the secret key; the f j is the first element, the position of the f j in the first vector is the j-th; the t j is the second element, the position of the t j in the second vector is the j-th; the s j is the j-th element in the merged vector; the s n+j is the (n + j)-th element in the merged vector; the is used to represent the first relationship; the is used to represent the second relationship.

[0147] The reason for setting Z(g i ) = 1 when i = 1 is that when i = 1, j = 0, and there is no element at position 0 in each vector. Therefore, the relationship polynomial when i = 1 cannot be constructed. To make the relationship polynomial meaningful when i = 1, so Z(g i ) = 1 is set when i = 1.

[0148] The reason for setting Z(g i) = 1 because when \(i\) takes \(n + 1\), all elements in the first vector can participate in the operation. After all elements in the first vector participate in the operation, the first relationship and the second relationship are always 1, so the constructed relationship polynomial is always 1. In this relationship polynomial, the key \(\gamma\) can be 0 or a random number, which is generated by the providing end or sent to the providing end after being generated by the verifying end. Generating the key by the verifying end and providing it to the providing end can increase the credibility of the relationship polynomial, reduce the possibility of the relationship polynomial being tampered with, and ensure the security and effectiveness of the proof.

[0149] The relationship polynomial satisfies the above conditions. According to the above conditions satisfied by the relationship polynomial, the specific expression form of the relationship polynomial can be determined by using the Lagrange interpolation method.

[0150] In this example, \(n = 2\), so the relationship polynomial \(Z(g\) i ) satisfies the following conditions:

[0151] (1) When \(i = 1\), \(Z(g\) i ) = 1;

[0152] (2) When \(i = 2\), If \(\gamma = 0\), then

[0153] (3) When \(i = 3\), \(Z(g\) i ) = 1;

[0154] This relationship polynomial is the first sub-proof.

[0155] Step 303, determine the value-taking polynomial according to the combined vector, and use the value-taking polynomial as the second sub-proof; the value-taking polynomial is used to take values for each element in the combined vector;

[0156] For example, the value-taking polynomial \(h1\) satisfies: for each \(i\in[n + 1]\), \(h1(g\) i ) = \(s\) i . \(h1(g\) 1 ) means that the first number in \(h1\) is \(s1\) (the first number in the combined vector \(s\)), and \(h1(g\) 2 ) means that the second number in \(h1\) is \(s2\). In this example, \(n = 2\), for each \(i\in[3]\), \(h1(g\) i ) = \(s\) i . That is, \(h1(g\) 1 ) = \(s\) i = 1; \(h1(g\) 2 ) = \(s2 = 5\); \(h1(g\) 3 ) = \(s3 = 5\).

[0157] This value-taking polynomial is the second sub-proof.

[0158] Step 304: Determine the value offset polynomial according to the merging vector, and use the value offset polynomial as the third sub-proof; the value polynomial is used to perform offset value-taking on each element in the merging vector.

[0159] For example, the value offset polynomial h2 satisfies: for each i ∈ [n + 1], h2(g i ) = s n+i . h2(g 1 ) represents that the first number in h1 is s n+1 (the (n + 1)-th number in the merging vector s), and h2(g 2 ) represents that the second number in h2 is s n+2 . In this example, n = 2, and for each i ∈ [3], h2(g i ) = s n+i . That is, h2(g 1 ) = s3 = 5; h2(g 2 ) = s4 = 7; h2(g 3 ) = s5 = 7.

[0160] This value offset polynomial is the third sub-proof.

[0161] Merge the first vector and the second vector to obtain the merging vector; construct the relationship polynomial, the value polynomial, and the value offset polynomial. The relationship between the first vector and the second vector is described by these three polynomials. Using the value polynomial, the value offset polynomial, and the relationship polynomial as proofs can provide valid and credible proofs to the verification end without revealing the specific amounts of the assets of n users, ensuring zero-knowledge property.

[0162] In step 205, the providing end sends the proof to the verification end; the verification end is used to determine whether the multiple sub-proofs conform to the preset relationship. If they conform, it is determined that the asset amounts of the n users are within the preset range.

[0163] For example, the providing end sends the first sub-proof, the second sub-proof, and the third sub-proof to the verification end. The first sub-proof is: Z(g 1 ) = 1; Z(g 2 ) = 1; Z(g 3 ) = 1. The second sub-proof is: h1(g 1 ) = 1; h1(g 2 ) = 5; h1(g 3 ) = 5. The third sub-proof is: h2(g 1 ) = 5; h2(g 2 ) = 7; h2(g 3 ) = 7.

[0164] In step 207, the verification end determines a verification formula according to the proof, and uses the verification formula to determine whether the multiple sub-proofs meet a preset relationship; if they meet, it is determined that the asset amounts of the n users are within the preset range.

[0165] After receiving the proof, the verification end determines a verification formula according to the proof. The determined verification formula includes a first sub-verification formula, a second sub-verification formula, a third sub-verification formula, and a fourth sub-verification formula; the first sub-verification formula is used to verify whether the value polynomial and the value offset polynomial are correctly valued; the second sub-verification formula, the third sub-verification formula, and the fourth sub-verification formula are used to verify whether the relationship polynomial is correctly constructed.

[0166] The following shows a possible verification formula:

[0167] First sub-verification formula: L n+1 (δ)(h1(δ)-h2(g·δ)) = 0;

[0168] Second sub-verification formula: L1(δ)(Z(δ)-1) = 0;

[0169] Third sub-verification formula: Z(δ)(γ + f(δ))(γ + t(δ)) = Z(g·δ)(γ + h1(δ))(γ + h2(δ));

[0170] Fourth sub-verification formula: L n+1 (δ)(Z(δ)-1) = 0;

[0171] Among them, δ is any random number taken from the multiplicative subgroup H, H = {g, g 2 …, g n , g n+1 = 1}; L is a selection polynomial; the selection polynomial satisfies: L i (g i ) = 1 and L i (g j ) = 0, j ≠ i; h1 is the value polynomial; h2 is the value offset polynomial; Z(δ) is the relationship polynomial; γ is the key; f is the first vector; t is the second vector.

[0172] In this example, n = 2. For example, if the selected random number is g 3 , then the verification formula is:

[0173] First sub-verification formula: L3(g 3 )(h1(g 3 )-h2(g·g 3 )) = 0;

[0174] Second sub-verification formula: L1(g 3 )(Z(g 3 ) - 1) = 0;

[0175] Third sub-verification formula: Z(g 3 )(γ + f(g 3 ))(γ + t(g 3 )) = Z(g·g 3 )(γ + h1(g 3 ))(γ + h2(g 3 ));

[0176] Fourth sub-verification formula: L n+1 (g 3 )(Z(g 3 ) - 1) = 0;

[0177] Wherein, according to the definition of the selected polynomial, L3(g 3 ) = 1; L1(g 3 ) = 0. According to the definition of the multiplicative subgroup H, g 3 = 1.

[0178] In the above third verification formula, f(g 3 ) and t(g 3 ) also appear. Since f and t represent the first vector and the second vector respectively, and the elements in the first vector are not known to the verification side, the value of Z(g 3 )(γ + f(g 3 ))(γ + t(g 3 )) on the left side of the equal sign in the third verification formula is also provided by the providing side. The providing side provides Z(g 3 )(γ + f(g 3 ))(γ + t(g 3 )) to the verification side as the fourth sub-proof.

[0179] The verification side verifies whether the above first sub-proof, second sub-proof, third sub-proof and fourth sub-proof conform to the above first sub-verification formula, second sub-verification formula, third sub-verification formula and fourth sub-verification formula. If all conform, it indicates that the elements in the first vector exist in the second vector. Since the elements in the second vector are within the preset range, the elements in the first vector are also within the preset range, that is, the asset amounts of user A and user B are within the preset range.

[0180] In the above technical solution, the verification end does not know the specific elements in the first vector and the second vector from beginning to end, but obtains the proof constructed by the first vector and the second vector, and determines the relationship between the first vector and the second vector by verifying the proof. It is not necessary to use gate circuits to represent specific amounts and preset ranges, and the specific amounts and preset ranges are not directly compared through gate circuits. Instead, the first vector is determined according to the amount of the user's assets, the second vector is determined according to multiple amounts within the preset range, and the proof is determined according to the first vector and the second vector. When the verification end receives the proof, it verifies the proof to verify the relationship between the first vector and the second vector; since the second vector determined by the providing end is determined according to each amount within the preset range, if the verification end verifies that each element in the first vector exists in the second vector, it can directly determine that each element in the first vector is within the preset range. In this way, by constructing the second vector for the preset range, the problem is transformed, and the verification end proves that the assets of n users are within the preset range without knowing the specific amounts of the assets of n users, and the method is simpler and more time-saving.

[0181] In addition, in the above technical solution, no matter how many users' asset amounts are verified, only one first vector needs to be constructed at one time, which saves more time. If the gate circuit method is used for verification, each user's asset amount requires a gate circuit set. The construction is time-consuming, and the verification process is also very time-consuming. The efficiency of the proof is improved.

[0182] In some embodiments, before the providing end determines the relation polynomial according to the first vector, the second vector and the combined vector, it also includes: receiving the key γ sent by the verifying end.

[0183] In this way, the provider can determine the relation polynomial according to the key γ sent by the verifier, which increases the credibility of the relation polynomial, reduces the possibility of the relation polynomial being tampered with, and ensures the security and effectiveness of the proof.

[0184] In some embodiments, each element in the second vector is determined within a preset range in the following manner:

[0185] Determine each value within a preset range. For example, determine each value within a preset range [0, 10] as 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10.

[0186] Sampling is performed among the values within the preset range through a sampling function. For example, define a sampling function \(W(X) = 4(x - 1)+1\), and perform sampling among the values within the preset range. When \(x = 1\), \(W(X)=1\); when \(x = 2\), \(W(X)=5\); when \(x = 3\), \(W(X)=9\). Therefore, it is determined that 1, 5, and 9 should be in the second vector. Also, in combination with the elements in the first vector, since the elements in the first vector are 7 and 9, the elements in the first vector need to exist in the second vector. By comprehensive consideration, the second vector is \([1,5,7,9]\).

[0187] By performing sampling within the preset range, the second vector can be simplified, and the subsequent proof process can be simplified.

[0188] For a more intuitive understanding of the embodiments of the present invention, the following introduces this solution in a specific implementation scenario, as Figure 4b shown.

[0189] Step (1): The verification end sends an asset verification request for user A and user B to the providing end, for verifying whether the asset amounts of user A and user B are within the preset range of \([0,10]\).

[0190] Step (2): After determining that the asset amounts of user A and user B are within the preset range, the providing end obtains that the asset amount of user A is 50,000 yuan and the asset amount of user B is 70,000 yuan, and forms a first vector \(f=[5,7]\); obtains 4 amounts within the preset range \([0,10]\) to form a second vector \(t\), and the second vector \(t = [1,5,7,9]\). Among them, the elements in the first vector can be repeated, and the elements in the second vector cannot be repeated.

[0191] Step (3): The providing end merges the first vector \(f = [5,7]\) and the second vector \(t=[1,5,7,9]\) to obtain a merged vector \(s=[1,5,5,7,7,9]\).

[0192] Step (4): The providing end determines a relationship polynomial according to the first vector, the second vector, and the merged vector, and uses the relationship polynomial as the first sub-proof.

[0193] The relationship polynomial \(Z(g i ) satisfies the following conditions: (1) When \(i = 1\), \(Z(g i ) = 1\);

[0194] (2) When \(2\leq i\lt n + 1\),

[0195] (3) When \(i = n + 1\), \(Z(g i ) = 1\);

[0196] Among them, the \(g iis any element in the multiplicative subgroup H, where H = {g, g 2 …, g n , g n+1 = 1}; the γ is the secret key; the f j is the first element, and the position of the f j in the first vector is the j-th; the t j is the second element, and the position of the t j in the second vector is the j-th; the s j is the j-th element in the merged vector; the s n+j is the (n + j)-th element in the merged vector; the is used to represent the first relationship; the is used to represent the second relationship.

[0197] In step (5), the provider end determines the value polynomial based on the merged vector and uses the value polynomial as the second sub-proof; determines the value offset polynomial based on the merged vector and uses the value offset polynomial as the third sub-proof.

[0198] The value polynomial h1 satisfies: for each i ∈ [n + 1], h1(g i ) = s i . h1(g 1 ) means the first number in h1 is s1 (the first number in the merged vector s), and h1(g 2 ) means the second number in h1 is s2. In this example, n = 2, for each i ∈ [3], h1(g i ) = s i . That is, h1(g 1 ) = s1 = 1; h1(g 2 ) = s2 = 5; h1(g 3 ) = s3 = 5.

[0199] The value offset polynomial h2 satisfies: for each i ∈ [n + 1], h2(g i ) = s n+i . h2(g 1 ) means the first number in h1 is s n+1 (the (n + 1)-th number in the merged vector s), and h2(g 2 ) means the second number in h2 is s n+2 . In this example, n = 2, for each i ∈ [3], h2(g i ) = s n+i . That is, h2(g 1 ) = s3 = 5; h2(g 2 ) = s4 = 7; h2(g 3) = s5 = 7。

[0200] Step (6) The providing end sends the first sub-proof, the second sub-proof, and the third sub-proof to the verifying end. The providing end sends the first sub-proof, the second sub-proof, and the third sub-proof to the verifying end.

[0201] The first sub-proof is: Z(g 1 ) = 1; Z(g 2 ) = 1; Z(g 3 ) = 1. The second sub-proof is: h1(g 1 ) = 1; h1(g 2 ) = 5; h1(g 3 ) = 5. The third sub-proof is: h2(g 1 ) = 5; h2(g 2 ) = 7; h2(g 3 ) = 7.

[0202] Step (7) The verifying end determines verification formulas, including a first sub-verification formula, a second sub-verification formula, a third sub-verification formula, and a fourth sub-verification formula. The first sub-verification formula is used to verify whether the value polynomial and the value offset polynomial are correctly valued; the second sub-verification formula, the third sub-verification formula, and the fourth sub-verification formula are used to verify whether the relationship polynomial is correctly constructed.

[0203] For example, if the randomly selected number is g 3 , then the verification formulas are:

[0204] First sub-verification formula: L3(g 3 )(h1(g 3 ) - h2(g·g 3 )) = 0;

[0205] Second sub-verification formula: L1(g 3 )(Z(g 3 ) - 1) = 0;

[0206] Third sub-verification formula: Z(g 3 )(γ + f(g 3 ))(γ + t(g 3 )) = Z(g·g 3 )(γ + h1(g 3 ))(γ + h2(g 3 ));

[0207] Fourth sub-verification formula: L n+1 (g 3 )(Z(g 3 ) - 1) = 0;

[0208] If the randomly selected random number conforms to the above verification formula in step (8), it is determined that multiple sub-proofs conform to a preset relationship. It is determined that the asset amounts of user A and user B are within the range of [0, 10].

[0209] The following explains why the relational polynomial can reflect the relationship between the first vector and the second vector.

[0210] Construct the union of a set f and a set t, defined as s ∈ F n+d , {s i} i∈[n+d] , the number of elements in set s is the sum of the number of elements in set f (which has n elements) and set t (which has d elements), and is arranged according to the element order of set t. For example, the elements in set t are arranged from small to large, and the elements in set f are inserted into set t to obtain set s, and the elements in set s are also arranged from small to large. Given f ∈ F n , t ∈ F d , s ∈ F n+d , define two bivariate polynomials P and G as:

[0211]

[0212]

[0213] The necessary and sufficient condition for the polynomial P ≡ G is Set s is the union of set f and set t, and set s is arranged according to the element order of set t.

[0214] Next, it is proved that only when these two conditions are met, P can be identical to G.

[0215] For example, there is only one element 5 in f, n = 1; there are 3 elements [1, 5, 9] in t, d = 3, and there are 4 elements [1, 5, 5, 9] in s.

[0216] According to the definitions of the bivariate polynomials P and G, the following examples can be obtained:

[0217]

[0218]

[0219] Further transform it (essentially equal, but looks different):

[0220]

[0221]

[0222] Since the set s is arranged according to the element order of set t, for each j ∈ [d - 1], there exists a different position label i ∈ [n + d - 1] such that (t j , t j+1 ) = (s i , s i+1 ). Therefore, there is the following equation relationship for some parts of polynomials P and G:

[0223] (γ + (t j + βt j+1 ) / (1 + β)) ≡ (γ + (s i + βs i+1 ) / (1 + β))

[0224] Continuing with the above example to explain the above paragraph, for each j ∈ [2], there exists a different position label i ∈ [3] such that (t j , t j+1 ) = (s i , s i+1 ). That is, when j = 1, there exists i = 1 such that (t1, t2) = (s1, s2), satisfying (γ + (t1 + βt2) / (1 + β)) ≡ (γ + (s1 + βs2) / (1 + β)); when j = 2, there exists i = 3 such that (t2, t3) = (s3, s4), satisfying (γ + (t2 + βt3) / (1 + β)) ≡ (γ + (s3 + βs4) / (1 + β)).

[0225] Let be the set of position labels i that satisfy the above equation, with a total of d - 1, and be the set of the remaining position labels i, with a total of n. Therefore, for i ∈ M, s i = s i+1 , and {s i} i∈M = {f i} i∈[n] . Thus, there exists a one-to-one mapping j: M → [n], such that for i ∈ M, s i = f j(i) .

[0226] For the same example, M' is the set of position labels i that satisfy the above equation [1, 3], with a total of 2, and M is the set of the remaining position labels i [2], with a total of 1. Therefore, for i ∈ M, that is, when i = 2, s2 = s3, and s2 = f1.

[0227] So, for i ∈ M, there is the following equation relationship for the relevant terms in polynomial G:

[0228]

[0229] It can be deduced that:

[0230]

[0231] Combined with the previous equations, it can be inferred that f j = s i = s i+1 .

[0232] For the same example, the remainder of polynomial G, that is, when i = 2,

[0233]

[0234] That is, the remainder of G is also equal to the remainder of P.

[0235] Therefore, if two adjacent elements in set s are different, then these two elements are exactly the two adjacent elements in set t. If they are the same, one of them comes from set f. So it can be inferred that all elements in set f exist in set t, that is, it is proved that set f belongs to set t, and at the same time, the range of all elements in f is also proved.

[0236] Based on the same technical concept, Figure 5 Exemplarily, the structure of an asset certification device provided by an embodiment of the present invention is shown. This structure can execute the process of asset certification.

[0237] As Figure 5 shown, the device specifically includes:

[0238] A first receiving unit 501, configured to receive an asset verification request from a verification end for n users. The asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range;

[0239] A first processing unit 502, configured to:

[0240] Obtain the asset amounts of the n users. After determining that the asset amounts of each user among the n users are within the preset range, form a first vector using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; form a second vector using multiple different amounts within the preset range, and each element in the first vector exists in the second vector;

[0241] Determine a proof according to the first vector and the second vector; the proof includes multiple sub-proofs;

[0242] The first sending unit 503 is configured to send the proof to the verification end; the verification end is configured to determine whether the multiple sub-proofs meet a preset relationship, and if so, determine that the asset amounts of the n users are within the preset range.

[0243] In the above technical solution, the verification end never knows the specific elements in the first vector and the second vector, but obtains the proof constructed from the first vector and the second vector. By verifying the proof, the relationship between the first vector and the second vector is determined. There is no need to use a gate circuit to represent the specific amount and the preset range, and the specific amount and the preset range are not directly compared through the gate circuit. Instead, the first vector is determined according to the asset amounts of the users, the second vector is determined according to multiple amounts within the preset range, and the proof is determined according to the first vector and the second vector. When the verification end receives the proof, it verifies the proof to verify the relationship between the first vector and the second vector; since the second vector determined by the providing end is determined according to each amount within the preset range, if the verification end verifies that each element in the first vector exists in the second vector, it can directly determine that each element in the first vector is within the preset range. In this way, by constructing the second vector for the preset range, the problem is transformed, and the verification end can prove that the assets of the n users are within the preset range without knowing the specific amounts of the assets of the n users, and the method is simpler and more time-saving.

[0244] In some embodiments, the first processing unit 502 is specifically configured to:

[0245] Merge the first vector and the second vector to obtain a merged vector;

[0246] Determine a relationship polynomial according to the first vector, the second vector, and the merged vector, and use the relationship polynomial as the first sub-proof; the relationship polynomial is used to characterize the relationship between the first vector and the second vector;

[0247] Determine a value polynomial according to the merged vector, and use the value polynomial as the second sub-proof; the value polynomial is used to take values for each element in the merged vector;

[0248] Determine a value offset polynomial according to the merged vector, and use the value offset polynomial as the third sub-proof; the value polynomial is used to take offset values for each element in the merged vector.

[0249] In some embodiments, before determining the relationship polynomial according to the first vector, the second vector, and the merged vector, the first receiving unit 501 is further configured to:

[0250] Receive the key sent by the verification end;

[0251] The first processing unit 502 is specifically configured to:

[0252] Determine the relationship polynomial according to the secret key, the first vector, the second vector, and the combined vector.

[0253] The first processing unit 502 is specifically configured to:

[0254] For a first element among the n elements in the first vector, determine a first relationship between the position of the first element in the first vector and the position of the first element in the combined vector; the first element is any one of the n elements;

[0255] For a second element among the d elements in the second vector, determine a second relationship between the position of the second element in the second vector and the position of the second element in the combined vector; the second element is any one of the d elements;

[0256] Construct the relationship polynomial according to the first relationship and the second relationship.

[0257] In some embodiments, the relationship polynomial Z(g i ) satisfies the following conditions: (1) When i = 1, Z(g i ) = 1;

[0258] (2) When 2 ≤ i < n + 1,

[0259] (3) When i = n + 1, Z(g i ) = 1;

[0260] Wherein, the g i is any element in the multiplicative subgroup H, H = {g, g 2 …, g n , g n+1 = 1}; the γ is the secret key; the f j is the first element, the position of the f j in the first vector is the j-th; the t j is the second element, the position of the t j in the second vector is the j-th; the s j is the j-th element in the combined vector; the s n+j is the (n + j)-th element in the combined vector; the is used to represent the first relationship; the is used to represent the second relationship.

[0261] Based on the same technical concept, Figure 6Exemplarily, the structure of an asset certification device provided by an embodiment of the present invention is shown, and this structure can execute the process of asset certification.

[0262] As Figure 6 shown, the device specifically includes:

[0263] A second sending unit 601, configured to send an asset verification request for n users to a providing end, where the asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range;

[0264] A second receiving unit 602, configured to receive the proof sent by the providing end; the proof is determined by the providing end according to a first vector and a second vector; the first vector is formed by the providing end using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; the second vector is formed by the providing end using multiple different amounts within the preset range; each element in the first vector exists in the second vector; the proof includes multiple sub-proofs;

[0265] A second processing unit 603, configured to determine a verification formula according to the proof, and use the verification formula to determine whether the multiple sub-proofs meet a preset relationship; if they meet, it is determined that the asset amounts of the n users are within the preset range.

[0266] In some embodiments, the proof is determined in the following manner, including:

[0267] Merge the first vector and the second vector to obtain a merged vector;

[0268] Determine a relationship polynomial according to the first vector, the second vector, and the merged vector, and use the relationship polynomial as a first sub-proof; the relationship polynomial is used to characterize the relationship between the first vector and the second vector;

[0269] Determine a value polynomial according to the merged vector, and use the value polynomial as a second sub-proof; the value polynomial is used to take values for each element in the merged vector;

[0270] Determine a value offset polynomial according to the merged vector, and use the value offset polynomial as a third sub-proof; the value polynomial is used to take offset values for each element in the merged vector.

[0271] In some embodiments, the second processing unit 603 is specifically configured to:

[0272] Optionally select a random number, substitute the random number into the multiple sub-proofs, and determine whether the multiple sub-proofs after substituting the random number conform to the verification formula; the random number is any element in the multiplicative subgroup H, and H = {g, g 2 …, g n , g n+1 = 1}.

[0273] In some embodiments, the verification formula includes a first sub-verification formula, a second sub-verification formula, a third sub-verification formula, and a fourth sub-verification formula; the first sub-verification formula is used to verify whether the value-taking polynomial and the value-taking offset polynomial take correct values; the second sub-verification formula, the third sub-verification formula, and the fourth sub-verification formula are used to verify whether the relationship polynomial is correctly constructed.

[0274] In some embodiments, the first sub-verification formula is: L n+1 (δ)(h1(δ) - h2(g·δ)) = 0;

[0275] The second sub-verification formula is: L1(δ)(Z(δ) - 1) = 0;

[0276] The third sub-verification formula is: Z(δ)(γ + f(δ))(γ + t(δ)) = Z(g·δ)(γ + h1(δ))(γ + h2(δ));

[0277] The fourth sub-verification formula is: L n+1 (δ)(Z(δ) - 1) = 0;

[0278] Wherein, δ is any random number taken from the multiplicative subgroup H, and H = {g, g 2 …, g n , g n+1 = 1}; L is a selection polynomial; the selection polynomial satisfies: L i (g i ) = 1 and L i (g j ) = 0, j ≠ i; h1 is the value-taking polynomial; h2 is the value-taking offset polynomial; Z(δ) is the relationship polynomial; γ is the key; f is the first vector; t is the second vector.

[0279] Based on the same technical concept, an embodiment of the present application provides a computer device, as Figure 7 shown, including at least one processor 701, and a memory 702 connected to at least one processor. In the embodiment of the present application, the specific connection medium between the processor 701 and the memory 702 is not limited, Figure 7Take the example where the central processor 701 and the memory 702 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0280] In the embodiments of the present application, the memory 702 stores instructions executable by at least one processor 701. By executing the instructions stored in the memory 702, the at least one processor 701 can perform the steps of the above-mentioned asset certification method.

[0281] Among them, the processor 701 is the control center of the computer device. It can use various interfaces and lines to connect all parts of the computer device. By running or executing the instructions stored in the memory 702 and calling the data stored in the memory 702, asset certification can be carried out. In some embodiments, the processor 701 may include one or more processing units. The processor 701 may integrate an application processor and a modem processor. Among them, the application processor mainly processes the operating system, user interface, application programs, etc., and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 can be implemented on the same chip. In some embodiments, they can also be separately implemented on independent chips.

[0282] The processor 701 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, which can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

[0283] The memory 702, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The memory 702 may include at least one type of storage medium. For example, it may include flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read only memory (PROM), read only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disc, and so on. The memory 702 is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 702 in the embodiments of the present application may also be a circuit or any other device capable of implementing a storage function, for storing program instructions and / or data.

[0284] Based on the same technical concept, an embodiment of the present invention further provides a computer-readable storage medium. The computer-readable storage medium stores a computer-executable program, and the computer-executable program is used to cause a computer to execute the method for asset certification listed in any of the above manners.

[0285] Those skilled in the art should understand that the embodiments of the present application may be provided as a method, a system, or a computer program product. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) that contain computer-usable program code.

[0286] This application is described with reference to the flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to the application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processors of general-purpose computers, special-purpose computers, embedded processors, or other programmable data processing devices to generate a machine, such that the instructions executed by the processors of the computer or other programmable data processing devices generate means for implementing the functions specified in one or more flows of the flowchart and / or one or more blocks of the block diagram.

[0287] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufacture including instruction means that implement the functions specified in one or more flows of the flowchart and / or one or more blocks of the block diagram.

[0288] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more flows of the flowchart and / or one or more blocks of the block diagram.

[0289] Obviously, those skilled in the art can make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, this application is also intended to include these changes and modifications.

Claims

1. An asset certification method, characterized in that, The method is applied to the providing end and includes: Receiving an asset verification request for n users from the verification end, where the asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range; Obtaining the asset amounts of the n users. After determining that the asset amount of each user among the n users is within the preset range, forming a first vector with the asset amounts of the n users, where any element in the first vector is the asset amount of any user; forming a second vector with multiple different amounts within the preset range, and each element in the first vector exists in the second vector; Determining a proof based on the first vector and the second vector; the proof includes multiple sub-proofs; Sending the proof to the verification end; the verification end is used to determine whether the multiple sub-proofs conform to a preset relationship. If they conform, it is determined that the asset amounts of the n users are within the preset range; Among them, determining the proof based on the first vector and the second vector includes: Merging the first vector and the second vector to obtain a merged vector; For a first element among the n elements in the first vector, determining a first relationship between the position of the first element in the first vector and the position of the first element in the merged vector; the first element is any one of the n elements; For a second element among the d elements in the second vector, determining a second relationship between the position of the second element in the second vector and the position of the second element in the merged vector; the second element is any one of the d elements; Constructing a relationship polynomial based on the first relationship and the second relationship, and using the relationship polynomial as a first sub-proof; the relationship polynomial is used to characterize the relationship between the elements in the first vector and the elements in the second vector; Determining a value polynomial based on the merged vector, and using the value polynomial as a second sub-proof; the value polynomial is used to obtain values for the elements in the merged vector; Determining a value offset polynomial based on the merged vector, and using the value offset polynomial as a third sub-proof; the value polynomial is used to obtain offset values for the elements in the merged vector.

2. The method according to claim 1, wherein Before determining the relationship polynomial based on the first vector, the second vector, and the merged vector, it further includes: Receiving a key sent by the verification end; Determining the relationship polynomial based on the first vector, the second vector, and the merged vector includes: Determining the relationship polynomial based on the key, the first vector, the second vector, and the merged vector.

3. The method according to claim 1 or 2, characterized in that, The relational polynomial Z(g i ) satisfies the following conditions: (1)When i = 1, Z(g i ) = 1; When \(2\leq i\lt n + 1\), (3) When i = n + 1, Z(g i ) = 1; wherein, the g i is any element in the multiplicative subgroup H, and H = {g, g 2 …, g n , g n+1 = 1}; the γ is the key; the f j is the first element, and the position of the f j in the first vector is the j-th; the t j is the second element, and the position of the t j in the second vector is the j-th; the s j is the j-th element in the merged vector; the s n+j is the (n + j)-th element in the merged vector; the is used to represent the first relationship; the is used to represent the second relationship.

4. A method for asset certification, characterized in that, The method is applied to the verification end and includes: Sending an asset verification request for n users to the providing end, where the asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range; Receive the proof sent by the providing end; the proof is determined by the providing end according to a first vector and a second vector; the first vector is formed by the providing end using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; the second vector is formed by the providing end using multiple different amounts within a preset range; each element in the first vector exists in the second vector; the proof includes multiple sub-proofs; Determine a verification formula according to the proof, and use the verification formula to determine whether the multiple sub-proofs meet a preset relationship; if they meet, determine that the asset amounts of the n users are within the preset range; Wherein, the proof is determined by the following method, including: Merge the first vector and the second vector to obtain a merged vector; Determine a relationship polynomial according to the first vector, the second vector and the merged vector, and use the relationship polynomial as a first sub-proof; the relationship polynomial is used to characterize the relationship between the first vector and the second vector; Determine a value-taking polynomial according to the merged vector, and use the value-taking polynomial as a second sub-proof; the value-taking polynomial is used to take values for each element in the merged vector; Determine a value-taking offset polynomial according to the merged vector, and use the value-taking offset polynomial as a third sub-proof; the value-taking polynomial is used to take offset values for each element in the merged vector; The verification formula includes a first sub-verification formula, a second sub-verification formula, a third sub-verification formula and a fourth sub-verification formula; the first sub-verification formula is used to verify whether the value-taking polynomial and the value-taking offset polynomial take values correctly; the second sub-verification formula, the third sub-verification formula and the fourth sub-verification formula are used to verify whether the relationship polynomial is constructed correctly.

5. The method according to claim 4, characterized in that, Using the verification formula to determine whether the multiple sub-proofs meet a preset relationship includes: Optionally select a random number, substitute the random number into the multiple sub-proofs, and determine whether the multiple sub-proofs after substituting the random number conform to the verification formula; the random number is any element in the multiplicative subgroup H, and H = {g, g 2 …, g n , g n+1 = 1}.

6. An asset certification device, characterized in that, Including: A first receiving unit, configured to receive an asset verification request from a verification end for the n users, where the asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range; A first processing unit, configured to: Obtain the asset amounts of the n users, and after determining that the asset amount of each user among the n users is within the preset range, form a first vector using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; form a second vector using multiple different amounts within a preset range, and each element in the first vector exists in the second vector; Determine a proof according to the first vector and the second vector; the proof includes multiple sub-proofs; A first sending unit, configured to send the proof to the verification end; The verification end is configured to determine whether the multiple sub-proofs meet a preset relationship, and if they meet, determine that the asset amounts of the n users are within the preset range; Wherein, the processing unit determines a proof according to the first vector and the second vector, including: Merge the first vector and the second vector to obtain a merged vector; For a first element among the n elements in the first vector, determine a first relationship between the position of the first element in the first vector and the position of the first element in the merged vector; the first element is any one of the n elements; For a second element among the d elements in the second vector, determine a second relationship between the position of the second element in the second vector and the position of the second element in the merged vector; the second element is any one of the d elements; Construct a relationship polynomial according to the first relationship and the second relationship, and use the relationship polynomial as a first sub-proof; the relationship polynomial is used to characterize the relationship between the elements in the first vector and the elements in the second vector; Determine a value polynomial according to the merged vector, and use the value polynomial as a second sub-proof; the value polynomial is used to obtain values for the elements in the merged vector; Determine a value offset polynomial according to the merged vector, and use the value offset polynomial as a third sub-proof; the value polynomial is used to obtain offset values for the elements in the merged vector.

7. An asset certification device, characterized in that, Including: A second sending unit, configured to send an asset verification request for n users to a providing end, where the asset verification request is used to request the providing end to provide a proof that the asset amounts of the n users are within a preset range; A second receiving unit, configured to receive the proof sent by the providing end; The proof is determined by the providing end according to a first vector and a second vector; the first vector is formed by the providing end using the asset amounts of the n users, where any element in the first vector is the asset amount of any user; The second vector is formed by the providing end using multiple different amounts within the preset range; each element in the first vector exists in the second vector; the proof includes multiple sub-proofs; A second processing unit, configured to determine a verification formula according to the proof, and use the verification formula to determine whether the multiple sub-proofs meet a preset relationship; if they meet, determine that the asset amounts of the n users are within the preset range; Wherein, the proof is determined by the following method: Merge the first vector and the second vector to obtain a merged vector; Determine a relationship polynomial according to the first vector, the second vector, and the merged vector, and use the relationship polynomial as a first sub-proof; the relationship polynomial is used to characterize the relationship between the first vector and the second vector; Determine a value polynomial according to the merged vector, and use the value polynomial as a second sub-proof; the value polynomial is used to obtain values for the elements in the merged vector; Determine a value offset polynomial according to the merged vector, and use the value offset polynomial as a third sub-proof; the value polynomial is used to obtain offset values for the elements in the merged vector; The verification formula includes a first sub-verification formula, a second sub-verification formula, a third sub-verification formula, and a fourth sub-verification formula; the first sub-verification formula is used to verify whether the value polynomial and the value offset polynomial are correctly valued; the second sub-verification formula, the third sub-verification formula, and the fourth sub-verification formula are used to verify whether the relationship polynomial is correctly constructed.

8. A computing device, characterized in that, Comprising: a memory for storing a computer program; a processor for calling the computer program stored in the memory and executing the method according to any one of claims 1 to 3 according to the obtained program.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer-executable program, and the computer-executable program is used to cause a computer to execute the method according to any one of claims 1 to 3.

Images