A consensus method and device for blockchain nodes

Abstract

This invention relates to a consensus method and apparatus for blockchain nodes. The method includes: receiving user asset data acquisition requests from target users sent by light nodes in the blockchain network; after determining that it stores the asset data of each target user, generating proof information based on the asset data and scope asset data of each target user; sending the asset data and proof information of each target user to the light node, whereby the light node verifies the proof information. If the verification passes, the light node verifies the legality of each transaction in the block based on the asset data of each target user. The light node can also verify the legality of each transaction in the block based on the asset data of each target user, improving the accuracy of transaction legality verification.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of blockchain technology, and in particular to a consensus method, apparatus, computing device and computer-readable storage medium for blockchain nodes. Background Technology

[0002] With the development of computer technology, more and more technologies are being applied in the financial field. The traditional financial industry is gradually transforming into financial technology (Fintech). However, due to the security and real-time requirements of the financial industry, higher demands are being placed on technology.

[0003] Generally, each node on a blockchain stores all the data in its ledger, allowing each node to participate in monitoring the legality of transactions and ensuring their security. Figure 1 A system architecture diagram is shown, including a blockchain network 100 and at least one user terminal (user terminal 201 and user terminal 202 as shown in the figure); wherein the blockchain network 100 is equipped with at least one full node (full node 1001, full node 1002, full node 1003 and full node 1004 as shown in the figure). A full node is a blockchain node that stores all the data in its own blockchain ledger, and each full node verifies transactions based on the stored full data. For example, user A uses client 201 to make multiple transfer transactions to user B. These transactions are all sent from client 201 to full node 1001. Full node 1001 forms these transactions into a block and sends the block to the other full nodes for consensus. Each full node verifies each transaction in the block based on the asset data of each user stored in its own blockchain ledger. If a majority of full nodes verify the transactions in the block, the consensus result is that the block is valid. Full node 1001 executes these transactions, and each full node performs an on-chain operation on the block, i.e., stores the block. At the same time, each full node updates the asset data of each user stored in its own blockchain ledger based on the transactions in the block.

[0004] For example, a block contains two transactions: Transaction 1: At 7:00, user A transfers 20 yuan to user B; Transaction 2: At 8:00, user A transfers 20 yuan to user B. Each full node stores the asset data of each user; for example, user A's asset data is 50 yuan, and user B's asset data is 100 yuan. Each full node performs verification as follows: It retrieves user A's asset data before 7:00, which is 50 yuan. Determining that 50 yuan is greater than 20 yuan, transaction 1 is verified, and user A's temporary asset status is set to 30 yuan, while user B's temporary asset status is set to 120 yuan. It retrieves user A's asset data before 8:00, which is 30 yuan. Determining that 30 yuan is greater than 20 yuan, transaction 2 is verified, and user A's temporary asset status is set to 10 yuan, while user B's temporary asset status is set to 140 yuan. If all full nodes verify the two transactions in the block, then full node 1001 executes these transactions, and each full node stores the block; at the same time, each full node updates the asset data of user a to 10 yuan and the asset data of user b to 140 yuan stored in its own blockchain ledger.

[0005] However, in certain application scenarios, storing all data on the blockchain would undoubtedly consume a significant amount of resources, including computing, communication, and storage resources. For example, ordinary individual users' devices cannot handle such a huge resource burden, and their technical capabilities are insufficient to maintain a full node storing all the data; they require a sufficiently convenient user experience. Therefore, researchers designed lightweight nodes, which do not store all the data. This significantly saves resources and ensures the stable and efficient operation of the device hosting the node.

[0006] However, because light nodes do not store all the data, they cannot verify the transactions in a block. Instead, they rely solely on the full nodes on the blockchain network to verify the transactions, and the consensus result for the block is determined based on the verification results of each full node. In this method, light nodes cannot participate in supervising the legality of transactions, leading to inaccurate verification of transaction legality. Summary of the Invention

[0007] This invention provides a consensus method for blockchain nodes to improve the accuracy of transaction legitimacy verification.

[0008] In a first aspect, embodiments of the present invention provide a consensus method for blockchain nodes, the method being applied to a second full node in a blockchain network, comprising:

[0009] The system receives user asset data acquisition requests from light nodes in the blockchain network for each target user; the target user is the transaction initiator of any transaction in the block; the block is sent to the light node by the first full node in the blockchain network.

[0010] After confirming that it stores the asset data of each target user, it generates proof information based on the asset data of each target user and the scope asset data; the scope asset data is generated based on the asset data of multiple users stored in the second full node; the multiple users include each target user; the proof information is used to prove that the second full node stores the asset data of each target user;

[0011] The asset data of each target user and the proof information are sent to the light node. The light node is used to verify the proof information. If the verification is successful, the legality of each transaction in the block is verified based on the asset data of each target user.

[0012] Since the proof information is generated based on the asset data of each target user and the range asset data (which includes the target user's asset data), it can be used to prove that the second full node stores the target user's asset data. When the light node receives the proof information, it verifies it. If the verification passes, it means that the second full node does indeed store the target user's asset data, and therefore the asset data sent by the second full node is credible. In this way, the light node can also verify the legality of each transaction in the block based on the target user's asset data, improving the accuracy of transaction legality verification.

[0013] In some embodiments, proof information is generated based on the asset data and scope asset data of each target user, including:

[0014] A first permutation vector is constructed based on a first vector formed from the asset data of each target user; in the first permutation vector, identical elements are adjacent to each other.

[0015] A second permutation vector is constructed based on a second vector formed from the range of asset data; identical elements in the first permutation vector are adjacent to each other; the position of the element identical to the first element in the second permutation vector is determined based on the position of the first element of the identical elements in the first permutation vector;

[0016] Based on any one of the first vector, the first permutation vector, the second vector, and the second permutation vector, construct the first value polynomial, the second value polynomial, the third value polynomial, and the fourth value polynomial, respectively, for the vector.

[0017] Based on the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector, construct a permutation relationship polynomial;

[0018] The first value polynomial, the second value polynomial, the third value polynomial, and the fourth value polynomial construct a permutation relation polynomial; the permutation relation polynomial is used to represent the permutation relation between the first value polynomial and the third value polynomial, and the permutation relation between the second value polynomial and the fourth value polynomial;

[0019] Construct a first commitment opening proof polynomial, a second commitment opening proof polynomial, a third commitment opening proof polynomial, and a fourth commitment opening proof polynomial according to the first value polynomial, the second value polynomial, the third value polynomial, and the fourth value polynomial respectively;

[0020] For any random number, substitute the random number into the permutation relation polynomial, the value polynomial corresponding to any vector, and the commitment opening proof polynomial to obtain multiple first sub-proof information respectively.

[0021] In some embodiments, before constructing the value polynomial and the commitment opening proof polynomial of any vector among the first vector, the first permutation vector, the second vector, and the second permutation vector, it further includes:

[0022] Expand the vector lengths of the first vector, the first permutation vector, the second vector, and the second permutation vector to 2 k -1; where 2 k-1 <u<2 k , where u is the vector length of the second vector formed by the range asset data;

[0023] Before obtaining the proof information, it further includes:

[0024] Construct a first selection sub-polynomial Q blind (x) and a second selection sub-polynomial Q last (x); where the first selection sub-polynomial Q blind (x) satisfies: when u≤x<2 k , Q blind (x) = 1, when 0<x<u, Q blind (x) = 0; the second selection sub-polynomial Q last (x) satisfies: when x = u, Q last (x) = 1, when x≠u, Q last (x) = 0;

[0025] The method further includes:

[0026] Substitute the random number into the first selection sub-polynomial Q blind (x) and the second selection sub-polynomial Qlast (x) yields multiple second sub-proof information.

[0027] By expanding the first vector, the first permutation vector, the second vector, and the second permutation vector, a first choice polynomial Q is constructed. blind (x) and the second choice polynomial Q last (x) can mask the actual length of the vector, increasing the zero-knowledge nature of the proof.

[0028] In some embodiments, after constructing the value polynomial of the vector for any one of the first vector, the first permutation vector, the second vector, and the second permutation vector, the method further includes:

[0029] Make a commitment to the polynomial that takes the value corresponding to the vector to obtain the commitment value corresponding to the vector;

[0030] Based on the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector, a permutation polynomial is constructed, including:

[0031] The permutation polynomial is constructed based on the key, the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector; the key is obtained based on the commitment value corresponding to each vector.

[0032] By making a commitment to the polynomial corresponding to the vector, the commitment value corresponding to the vector is obtained, and the key is obtained based on the commitment value corresponding to each vector. In this way, it can be ensured that after the light node obtains the proof information, it cannot deduce what the specific range of asset data is, thus ensuring the security of the asset data of each user stored in the second full node.

[0033] In some embodiments, the random number and / or the key are provided by the light node.

[0034] By having a light node provide the random number and / or key, the credibility of the proof information is increased, and the possibility of a second full node providing false information is reduced.

[0035] The formula does not change with the dynamic changes in the scope of asset data, making it more applicable.

[0036] Secondly, embodiments of the present invention also provide a consensus method for blockchain nodes, the method being applied to light nodes in a blockchain network, comprising:

[0037] After receiving a block sent by the first full node in the blockchain network, a request to obtain user asset data of each target user is sent to the second full node in the blockchain network; the target user is the transaction initiator of any transaction in the block;

[0038] Receive the asset data and proof information of each target user sent by the second full node;

[0039] The proof information is substituted into the verification formula for verification. If the verification passes, the legality of each transaction in the block is verified based on the asset data of each target user. The verification formula is used to verify whether the asset data of each target user exists in the range asset data according to the proof information, thereby determining whether the asset data of each target user is stored in the second full node. The range asset data is generated by the second full node based on the asset data of multiple users stored in the second full node. The multiple users include each target user.

[0040] Since the proof information is generated based on the asset data of each target user and the range asset data (which includes the asset data of each target user), the proof information can be used to prove that the second full node stores the asset data of each target user. When the light node receives the proof information, it verifies it. If the verification passes, it means that the second full node does indeed store the asset data of each target user, and therefore the asset data sent by the second full node is credible. In this way, the light node can also verify the legality of each transaction in the block based on the asset data of each target user, improving the accuracy of transaction legality verification. Furthermore, the second full node does not need to send the range asset data to the light node, ensuring the security of the asset data of each user stored in the second full node.

[0041] In some embodiments, the proof information includes multiple first sub-proof information; the multiple first sub-proof information includes the value of the permutation relation polynomial after substituting random numbers, the value of the value polynomial corresponding to each vector after substituting the random numbers, and the value of the commitment opening proof polynomial corresponding to each vector after substituting the random numbers; the vector includes a first vector, a second vector, a first permutation vector, and a second permutation vector; the first vector is formed by the second full node based on the asset data of each target user; the second vector is formed by the second full node based on the range asset data;

[0042] The verification process involves substituting the proof information into the verification formula, including:

[0043] Substitute the value of the commitment open proof polynomial corresponding to each vector into the first sub-verification formula. The first sub-verification formula is used to verify whether the value polynomial of each vector is constructed according to its corresponding vector.

[0044] Substitute the values ​​of the polynomials corresponding to each vector and the values ​​of the permutation polynomials into the second sub-verification formula. The second sub-verification formula is used to verify whether the permutation polynomials are used to characterize the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector; it is also used to verify whether each element in the first vector exists in the second vector.

[0045] By substituting the proof information into the verification formula and verifying it through the first and second sub-verification formulas, the accuracy of the proof information verification is improved. Since the asset data of each user stored in the second full node is dynamically changing, the range asset data is also dynamically changing. However, the above proof method does not change with the dynamic changes in the range asset data, making it more applicable.

[0046] Thirdly, embodiments of the present invention also provide a consensus device for a blockchain node, comprising:

[0047] The first sending unit is used to send a request to the second full node of the blockchain network to obtain user asset data of each target user after receiving a block sent by the first full node in the blockchain network; the target user is the transaction initiator of any transaction in the block;

[0048] The first receiving unit is used to receive the asset data and proof information of each target user sent by the second full node;

[0049] The first processing unit is used to substitute the proof information into the verification formula for verification. If the verification passes, the unit performs transaction legality verification on each transaction in the block based on the asset data of each target user. The verification formula is used to verify whether the asset data of each target user exists in the range asset data according to the proof information, thereby determining whether the asset data of each target user is stored in the second full node. The range asset data is generated by the second full node based on the asset data of multiple users stored in the second full node. The multiple users include each target user.

[0050] In some embodiments, the proof information includes multiple first sub-proof information; the multiple first sub-proof information includes the value of the permutation relation polynomial after substituting random numbers, the value of the value polynomial corresponding to each vector after substituting the random numbers, and the value of the commitment opening proof polynomial corresponding to each vector after substituting the random numbers; the vector includes a first vector, a second vector, a first permutation vector, and a second permutation vector; the first vector is formed by the second full node based on the asset data of each target user; the second vector is formed by the second full node based on the range asset data;

[0051] The first processing unit is specifically used for:

[0052] Substitute the value of the commitment open proof polynomial corresponding to each vector into the first sub-verification formula. The first sub-verification formula is used to verify whether the value polynomial of each vector is constructed according to its corresponding vector.

[0053] Substitute the values ​​of the polynomials corresponding to each vector and the values ​​of the permutation polynomials into the second sub-verification formula. The second sub-verification formula is used to verify whether the permutation polynomials are used to characterize the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector; it is also used to verify whether each element in the first vector exists in the second vector.

[0054] Fourthly, embodiments of the present invention also provide a consensus device for a blockchain node, comprising:

[0055] The second receiving unit is used to receive user asset data acquisition requests from target users sent by light nodes in the blockchain network; the target user is the transaction initiator of any transaction in the block; the block is sent to the light node by the first full node in the blockchain network.

[0056] The second processing unit is used to generate proof information based on the asset data of each target user and the scope asset data after determining that it stores the asset data of each target user; the scope asset data is generated based on the asset data of multiple users stored in the second full node; the multiple users include each target user; the proof information is used to prove that the asset data of each target user is stored in the second full node;

[0057] The second sending unit is used to send the asset data of each target user and the proof information to the light node. The light node is used to verify the proof information. If the verification is successful, the legality of each transaction in the block is verified based on the asset data of each target user.

[0058] In some embodiments, the second processing unit is specifically configured to:

[0059] Construct a first permutation vector according to the first vector formed by the asset data of each target user; the same elements in the first permutation vector are adjacent to each other;

[0060] Construct a second permutation vector according to the second vector formed by the range asset data; determine the positions of the elements in the second permutation vector that are the same as the first element according to the positions of the first elements of the same elements in the first permutation vector;

[0061] For any one of the first vector, the first permutation vector, the second vector, and the second permutation vector, construct a value polynomial and a commitment opening proof polynomial of the vector;

[0062] Construct a permutation relation polynomial according to the permutation relation between the first vector and the first permutation vector and the permutation relation between the second vector and the second permutation vector;

[0063] For any random number, substitute the random number into the permutation relation polynomial, the value polynomial corresponding to any vector, and the commitment opening proof polynomial, and respectively obtain a plurality of first sub-proof information.

[0064] In some embodiments, the second processing unit is further configured to:

[0065] Expand the vector lengths of the first vector, the first permutation vector, the second vector, and the second permutation vector to 2 k -1; where 2 k-1 <u<2 k , u is the vector length of the second vector formed by the range asset data;

[0066] Construct a first selector polynomial Q blind (x) and a second selector polynomial Q last (x); where the first selector polynomial Q blind (x) satisfies: when u≤x<2 k , Q blind (x) = 1, when 0<x<u, Q blind (x) = 0; the second selector polynomial Q last (x) satisfies: when x = u, Q last (x) = 1, when x≠u, Q last (x) = 0;

[0067] Substitute the random number into the first selector polynomial Q blind (x) and the second selector polynomial Q last(x) yields multiple second sub-proof information.

[0068] In some embodiments, the second processing unit is further configured to:

[0069] Make a commitment to the polynomial that takes the value corresponding to the vector to obtain the commitment value corresponding to the vector;

[0070] The second processing unit is specifically used for:

[0071] The permutation polynomial is constructed based on the key, the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector; the key is obtained based on the commitment value corresponding to each vector.

[0072] In some embodiments, the random number and / or the key are provided by the light node.

[0073] Fifthly, embodiments of the present invention also provide a computing device, comprising:

[0074] Memory, used to store computer programs;

[0075] The processor is used to invoke the computer program stored in the memory and execute the consensus method of the blockchain node listed in any of the above methods according to the obtained program.

[0076] In a sixth aspect, embodiments of the present invention also provide a computer-readable storage medium storing a computer-executable program for causing a computer to execute the consensus method of a blockchain node listed in any of the above methods. Attached Figure Description

[0077] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0078] Figure 1 A schematic diagram of a system architecture provided for an embodiment of the present invention;

[0079] Figure 2 A flowchart illustrating a consensus method for blockchain nodes provided in an embodiment of the present invention;

[0080] Figure 3 A flowchart illustrating a consensus method for blockchain nodes provided in an embodiment of the present invention;

[0081] Figure 4A flowchart illustrating a consensus method for blockchain nodes provided in an embodiment of the present invention;

[0082] Figure 5 A flowchart illustrating a consensus method for blockchain nodes provided in an embodiment of the present invention;

[0083] Figure 6 A schematic diagram of the structure of a consensus device for a blockchain node provided in an embodiment of the present invention;

[0084] Figure 7 A schematic diagram of the structure of a consensus device for a blockchain node provided in an embodiment of the present invention;

[0085] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0086] To make the objectives, implementation methods and advantages of this application clearer, the exemplary implementation methods of this application will be clearly and completely described below with reference to the accompanying drawings of the exemplary embodiments of this application. Obviously, the described exemplary embodiments are only some embodiments of this application, and not all embodiments.

[0087] Based on the exemplary embodiments described in this application, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the appended claims. Furthermore, although the disclosures in this application are presented by way of one or more exemplary examples, it should be understood that each aspect of these disclosures can also constitute a complete implementation on its own.

[0088] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0089] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities and do not necessarily imply a specific order or sequence, unless otherwise indicated. It should be understood that such terms can be used interchangeably where appropriate, for example, to implement the application in a sequence other than those given in the embodiments illustrated or described herein.

[0090] Furthermore, the terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclusively include, for example, a product or device that includes a series of components is not necessarily limited to those that are explicitly listed, but may include other components that are not explicitly listed or that are inherent to such product or device.

[0091] To better explain the embodiments of the present invention, the concepts involved in the embodiments of the present invention are explained below.

[0092] (1) Find the proof

[0093] The search proof described in the embodiments of the present invention is narrowly defined as, given a vector (called the first vector), proving that all elements in the first vector can be found in another vector (called the second vector).

[0094] Define the first vector T∈F n , <T i > i∈[n] Let represent that for any integer n, the set has n elements, each of which is in the field F. The second vector S∈F d , i > i∈[d] Let F represent a set with d elements for any integer d, where each element is in the field F. Let T(x) be the representative polynomial of the first vector T, representing the relationship between the elements and their positions in T. Similarly, let S(x) be the representative polynomial of the second vector S, representing the relationship between the elements and their positions in S.

[0095] (2) Selection of subpolynomials

[0096] Define H = {g, ..., g} k Let L = 1 be a multiplicative subgroup of order k over the field F. For i ∈ [k], define L... i ∈F <N [X] represents the i-th Lagrange polynomial of H, called the selection subpolynomial, which satisfies L i (g i ) = 1 and L i (g j )=1,j≠i. Based on this polynomial, if we want to find L... i (x)T(x)=0, x∈H, which is equivalent to requiring T(g) i ) = 0.

[0097] (3) Multinomial commitment

[0098] ​In a polynomial commitment scheme, the prover computes a commitment to a polynomial and can open it at any point on the polynomial: the commitment opens the proof scheme to prove that the value of the polynomial at that specific point matches a specified value. It is called a commitment because once a commitment value (a point on an elliptic curve) is sent to the verifier, the prover cannot change the currently computed polynomial. The prover can only provide a valid proof for a single polynomial; when attempting to cheat, the prover either cannot provide a proof or the proof is rejected by the verifier.

[0099] Figure 1 The blockchain nodes in the illustrated blockchain network 100 can have various functions, such as routing, transaction, blockchain, and consensus functions. Routing refers to the ability of a blockchain node to transmit transaction information from a client to other blockchain nodes in the blockchain network 100, enabling communication between them. Transaction and consensus functions allow a blockchain node to support transactions with users or other blockchain nodes through consensus, and also record all transactions executed within that blockchain node (or blockchain network 100). Blockchain functions allow a blockchain node to generate new blocks in the blockchain network 100 based on transaction execution. The routing function is a mandatory feature for every blockchain node in the blockchain network 100, while other functions can be configured by those skilled in the art according to actual needs.

[0100] It should be noted that a blockchain node in the blockchain network 100 can reside on a single physical machine (server), and a blockchain node can specifically refer to a process or a series of processes running on the server. For example, blockchain node 1001 can be a process running on the server, or it can refer to the server itself; the specific definition is not limited.

[0101] To address the technical problem that light nodes cannot participate in supervising the legality of transactions, leading to inaccurate verification of transaction legality, embodiments of this invention provide a proof method, such as... Figure 2 As shown.

[0102] Step 201: After receiving the block sent by the first full node in the blockchain network, the light node sends a request to the second full node in the blockchain network to obtain the user asset data of each target user.

[0103] For example, a light node requests user assets from a second full node to obtain asset data for user a and user b.

[0104] Step 202: After the second full node determines that it stores the asset data of each target user, it acquires the asset data of each target user and constructs a first vector based on the asset data of each target user. A second vector is then constructed based on the asset data of each user stored in the second full node, with each element of the first vector present in the second vector. Finally, a merged vector is constructed based on the first and second vectors.

[0105] For example, the second full node retrieves user a's asset data as 50,000 and user b's asset data as 70,000 from the blockchain ledger, thus constructing the first vector f = [5, 7]. The second full node retrieves the asset data of each user stored in its own blockchain ledger, for example, user a's asset data as 50,000, user b's asset data as 70,000, user c's asset data as 10,000, and user d's asset data as 90,000. It then constructs a second vector by arranging the asset data of these users in descending order, for example, the constructed second vector as t = [1, 5, 7, 9]. Based on the first and second vectors, it constructs a merged vector s = [1, 5, 5, 7, 7, 9]. Specifically, the construction method involves inserting each element of the first vector f into the second vector, with identical elements adjacent.

[0106] Step 203: The second full node constructs a value polynomial for the merged vector; constructs a relation polynomial based on each element in the merged vector; and sends the second vector, the value polynomial, and the relation polynomial to the light node.

[0107] For example, the first value polynomial h1 is constructed as follows: for each i∈[n+1], h1(g i ) = s i Where n is the number of elements in vector f, in this example, n = 2; g i Let g be any element in the multiplicative subgroup of H. Define H = {g, ..., g} n+1 =1} is a multiplicative subgroup of order n+1 over the field F. The constructed second value polynomial h2: for each i∈[n+1], h2(g i ) = s n+i The second-valued polynomial is a polynomial with an offset of n.

[0108] Construct a relational polynomial Z based on the elements of the second vector:

[0109] AZ(g i ) = 1;

[0110] B. For 2≤i <n+1,

[0111] Ci≥n+1,Z(g i ) = 1;

[0112] Step 204: The light node randomly selects a random number from H; where n is the number of elements in the first vector.

[0113] For example, the selected random number could be g. 2 .

[0114] Step 205: The light node substitutes the random number into the value polynomial and relational polynomial, and then substitutes the resulting value polynomial and relational polynomial into the verification formula. The verification formula is constructed based on the elements in the second vector. If the verification passes, it means that the elements in the first vector exist in the second vector, which means that the second full node does indeed store the asset data of each target user.

[0115] For example, the verification formula is as follows:

[0116] AL n+1 (δ)(h1(δ)-h2(g·δ))=0

[0117] B.L1(δ)(Z(δ)-1)=0

[0118] CZ(δ)(γ+f(δ))(γ+t(δ))=Z(g·δ)(γ+h1(δ))(γ+h2(δ))

[0119] DL n+1 (δ)(Z(δ)-1)=0

[0120] If the above verification formula is met, it means that each element in vector f exists in vector t. Since vector t is obtained from the asset data of each user in the second full node, it proves that the asset data of user a and user b are indeed stored in the second full node.

[0121] In the above scheme, both the relational polynomial and the verification formula are constructed based on the elements of the second vector. These elements can be sent from the second full node to the light node, or they can be sent to the light node in advance by a trusted third party. If any element in the second vector changes, both the relational polynomial and the verification formula must change synchronously. In other words, both the second full node and the light node need to know the elements of the second vector to perform the proof and verification.

[0122] In this embodiment of the invention, the second vector is constructed based on the asset data of each user in the second full node. The second vector includes not only the asset data of user a and user b, but also the asset data of other users. Sending the asset data of other users to the light node would undoubtedly lead to unnecessary leakage of user privacy data. Furthermore, when the elements in the second vector change, the relational polynomial and verification formula must also be redesigned, significantly increasing the time consumption of the proof and verification process and making it inconvenient to use. Moreover, the need to construct a merged vector from the first and second vectors increases the resource consumption of the proof computation process.

[0123] To address the aforementioned problems, embodiments of the present invention also provide another possible consensus method for blockchain nodes, such as... Figure 3 As shown, it includes:

[0124] Step 301: After receiving the block sent by the first full node in the blockchain network, the light node sends a request to the second full node in the blockchain network to obtain the user asset data of each target user; the target user is the transaction initiator of any transaction in the block.

[0125] Step 302: The second full node receives user asset data acquisition requests from the light nodes in the blockchain network for each target user.

[0126] Step 303: After the second full node determines that it stores the asset data of each target user, it generates proof information based on the asset data of each target user and the scope asset data; the scope asset data is generated based on the asset data of multiple users stored in the second full node; the multiple users include each target user; the proof information is used to prove that the second full node stores the asset data of each target user.

[0127] Step 304: The second full node sends the asset data of each target user and the proof information to the light node.

[0128] Step 305: The light node receives the asset data and proof information of each target user sent by the second full node.

[0129] Step 306: The light node substitutes the proof information into the verification formula for verification. If the verification passes, the legality of each transaction in the block is verified based on the asset data of each target user. The verification formula is used to verify whether the asset data of each target user exists in the range asset data according to the proof information, thereby determining whether the asset data of each target user is stored in the second full node. The range asset data is generated by the second full node based on the asset data of multiple users stored in the second full node. The multiple users include each target user.

[0130] In step 301, the first full node sends the block to all nodes, including other full nodes and light nodes. The other full nodes and light nodes then reach a consensus on the transactions within the block. Each block contains a transaction, and each transaction has a transaction initiator. For example, if user A transfers 20 yuan to user B, the transaction initiator is user A, and user A is the target user. Full nodes can reach a consensus on each transaction based on the target user's stored asset data. The consensus method has been introduced in the background technology section and will not be repeated here.

[0131] Since the light node does not store any user asset data, it sends a user asset data retrieval request to the second full node. The second full node can be any full node in the blockchain network, or it could be the first full node. The user asset retrieval request is used to obtain the asset data of the target user. For example, if the transaction initiators of five transactions are user a, user b, user c, user d, and user e, then these five users are the target users, and the user asset retrieval request is used to obtain their asset data.

[0132] In step 303, after the second full node determines that it stores the asset data of each target user, it generates proof information based on the asset data and scope asset data of each target user.

[0133] If the second full node determines that it does not store asset data for any target user, it will not make a proof and will send a response message to the light node. This response message is used to notify the light node that the second full node does not store asset data for all target users.

[0134] Alternatively, if the second full node determines that it does not store the asset data of a portion of the target users, it will only provide proof for the asset data of the target users that it has stored, and will not be able to provide proof for the asset data of the target users that it has not stored. It will then send a response message to the light node, which will notify the light node that the second full node does not store the asset data of a portion of the target users, and will also notify the light node which target users are not stored.

[0135] The following describes the method by which the second full node generates proof information based on the asset data and scope asset data of each target user, such as... Figure 4 As shown, it includes:

[0136] Step 401: Construct a first permutation vector based on the first vector formed by the asset data of each target user; construct a second permutation vector based on the second vector formed by the range asset data. Identical elements in the first permutation vector are adjacent to each other; determine the position of the element in the second permutation vector that is identical to the first element based on the position of the first element of the identical elements in the first permutation vector.

[0137] For example, the asset data of each target user obtained from its own blockchain ledger are 10,000, 30,000, 30,000, 60,000, and 60,000 respectively, so the first vector formed is T = [1, 3, 3, 6, 6].

[0138] One possible approach is to use the asset data of all users stored in the second full node as the range asset data, and construct the second vector using the range asset data. Another possible approach is to select a portion of the asset data from all users stored in the second full node as the range asset data to construct the second vector. For example, the determined second vector is S = [1, 2, 3, 4, 5, 6], and the second vector contains all the elements of the first vector.

[0139] Before constructing the first and second permutation vectors, the lengths of the first and second vectors are extended to make them the same. d (d≤um) elements are selected from the shorter vector and placed at the end of the shorter vector. In this example, the first vector T is shorter, so 3 is selected from vector T and placed at the end of the first vector T, resulting in the new first vector T = [1, 3, 3, 6, 6, 3].

[0140] The permutation rules are as follows: In the first permutation vector, identical elements are adjacent to each other; the position of the element in the second permutation vector that is identical to the first element of the identical elements in the first permutation vector is determined based on the position of the first element of the identical elements in the first permutation vector. For example, if the first permutation vector obtained according to the above permutation rules is T′=[3,3,3,6,6,1], and the identical elements are 3, 3, 3, and the position of the first element of the identical elements is 1, then the position of 3 in the second permutation vector is also 1; the identical elements are 6, 6, and the position of the first element of the identical elements is 4, then the position of 6 in the second permutation vector is also 4; the identical element is 1, and the position of the first element of the identical elements is 6, then the position of 1 in the second permutation vector is also 6. The remaining elements are placed arbitrarily without restriction.

[0141] The resulting second permutation vector is S′ = [3, 2, 4, 6, 5, 1], where the element at position 1 is 3, the element at position 4 is 6, the element at position 6 is 1, and the positions of the remaining elements 2, 4, and 5 are not restricted.

[0142] Step 402: For any one of the first vector, the first permutation vector, the second vector, and the second permutation vector, construct a value polynomial for the vector.

[0143] Construct a first value polynomial, a second value polynomial, a third value polynomial, and a fourth value polynomial based on the first vector, the first permutation vector, the second vector, and the second permutation vector, respectively.

[0144] The first, second, third, and fourth value polynomials are constructed as T(x), S(x), T′(x), and S′(x), respectively. This construction is to express each vector using polynomials. For example, for the second permutation vector S′, the fourth value polynomial S′(x) satisfies S′(1) = 3, S′(2) = 2, S′(3) = 4, S′(4) = 6, S′(5) = 5, S′(6) = 1, and S′(7) = 9.

[0145] Step 403: Construct a permutation polynomial based on the permutation relationship between the first vector and the first permutation vector and the permutation relationship between the second vector and the second permutation vector.

[0146] Specifically, a permutation polynomial is constructed based on the first, second, third, and fourth value polynomials. This permutation polynomial characterizes the permutation relationship between the first and third value polynomials, as well as the permutation relationship between the second and fourth value polynomials.

[0147] For example, the constructed permutation relation polynomial Z(x) can be:

[0148] 1)Z(2 k Z(0) = 1;

[0149] 2) For all i∈[0,2] k ),

[0150] When k = 3, Z(8) = Z(0) = 1. For all i ∈ [0, 8), T(i+1) is the dependent variable obtained when the independent variable of the first value polynomial is i+1, which is the (i+1)th element of the first vector; S(i+1) is the dependent variable obtained when the independent variable of the second value polynomial is i+1, which is the (i+1)th element of the second vector; T′(i+1) is the dependent variable obtained when the independent variable of the third value polynomial is i+1, which is the (i+1)th element of the first permutation vector; S′(i+1) is the dependent variable obtained when the independent variable of the fourth value polynomial is i+1, which is the (i+1)th element of the second permutation vector.

[0151] Step 404: For any one of the first vector, the first permutation vector, the second vector, and the second permutation vector, construct the commitment opening proof polynomial of the vector.

[0152] Specifically, a first commitment opening proof polynomial, a second commitment opening proof polynomial, a third commitment opening proof polynomial, and a fourth commitment opening proof polynomial are constructed based on the first value polynomial, the second value polynomial, the third value polynomial, and the fourth value polynomial, respectively.

[0153] Open at any position, and construct the corresponding commitment opening proof polynomial Q for the value polynomials T(x), S(x), T′(x), and S′(x). T Q S Q T′ and Q S′ Taking the first value polynomial T(x) as an example, we open it at the position x = 1. Of course, other values ​​can be chosen, but they cannot exceed the original length of the first vector T. In this example, the original length of the first vector T is 5. When x = 1, T(x) = 1, thus obtaining the first commitment opening proof polynomial. (The 1 in the denominator represents x = 1 in the chosen T(x), and the 1 in the numerator represents the value T(1) of the corresponding first-valued polynomial). The other valued polynomials are also opened at x = 1, resulting in S(1) = 1, T′(1) = 3, S′(1) = 3, and thus...

[0154] Step 405: For any random number, substitute the random number into the permutation relation polynomial, the value polynomial corresponding to any vector, and the commitment opening proof polynomial.

[0155] Specifically, for any random number, the random number is substituted into the first value polynomial, the second value polynomial, the third value polynomial, the fourth value polynomial, the first commitment opening proof polynomial, the second commitment opening proof polynomial, the third commitment opening proof polynomial, the fourth commitment opening proof polynomial, and the permutation relation polynomial.

[0156] The random number here can be generated by the second full node, or it can be generated by the light node and then sent to the second full node. Having the light node generate the random number itself increases the credibility of the proof.

[0157] Step 406 yields multiple first sub-proof information.

[0158] Specifically, multiple first sub-proof information is obtained based on the first value polynomial, the second value polynomial, the third value polynomial, the fourth value polynomial, the first commitment opening proof polynomial, the second commitment opening proof polynomial, the third commitment opening proof polynomial, the fourth commitment opening proof polynomial, and the permutation relation polynomial after substituting the random number.

[0159] In this example, after substituting the random number δ, the resulting first sub-proof information is: T(δ), S(δ), T′(δ), S′(δ), Q. T (δ), Q S (δ), Q T′ (δ), Q S′ (δ), Z(δ+1), Z(δ).

[0160] In step 304, the second full node sends the asset data of each target user and the proof information to the light node.

[0161] For example, the second full node will send the asset data of five target users—user a, user b, user c, user d, and user e—to the light node, with values ​​of 10,000, 30,000, 30,000, 60,000, and 60,000 respectively. Simultaneously, it will send proof information to the light node. In this embodiment, the proof information consists of multiple first sub-proof information.

[0162] In step 306, the light node substitutes the proof information into the verification formula for verification. If the verification passes, the legality of each transaction in the block is verified based on the asset data of each target user. The verification formula is used to verify whether the asset data of each target user exists in the range asset data according to the proof information, thereby determining whether the asset data of each target user is stored in the second full node. The range asset data is generated by the second full node based on the asset data of multiple users stored in the second full node. The multiple users include each target user.

[0163] If the verification passes, the light node confirms that the second full node does indeed store the asset data of each target user, and that the second full node is a benevolent node. Therefore, the legality of each transaction in the block can be verified based on the asset data of each target user.

[0164] Specifically, verification can be performed as follows: Substitute the value of the commitment open proof polynomial corresponding to each vector into the first sub-verification formula. The first sub-verification formula is used to verify whether the value polynomial of each vector is constructed based on its corresponding vector. Substitute the value of the value polynomial corresponding to each vector and the value of the permutation relation polynomial into the second sub-verification formula. The second sub-verification formula is used to verify whether the permutation relation polynomial is used to characterize the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector; it is also used to verify whether each element in the first vector exists in the second vector.

[0165] In some embodiments, zero-knowledge proofs are added to ensure the actual length of each vector. Before constructing the value polynomial and commitment-opening proof polynomial for any of the first vector, first permutation vector, second vector, and second permutation vector, the lengths of the first vector, first permutation vector, second vector, and second permutation vector are all extended to 2. k -1; where 2 k-1 <u<2 k , where u is the vector length of the second vector formed from the range of asset data.

[0166] Since the length of each vector is now u, by randomly selecting 2 k Inserting -1-u elements at the end of these four vectors yields the length-extended first vector, first permutation vector, second vector, and second permutation vector. This length extension masks the actual length of each vector, increasing the zero-knowledge nature of the proof.

[0167] In this example, u = 6, so according to 2 k-1 <u<2 k Solving for k, we get k = 3, therefore 2 k -u-1=1, so we randomly select an element, say 9, and get the expanded T=[1,3,3,6,6,3,9], the expanded S=[1,2,3,4,5,6,9], the expanded T′=[3,3,3,6,6,1,9], and the expanded S′=[3,2,4,6,5,1,9].

[0168] Then, based on the length-extended first vector, first permutation vector, second vector, and second permutation vector, the first value polynomial, the second value polynomial, the third value polynomial, and the fourth value polynomial are constructed respectively.

[0169] The method further includes: constructing a first selection subpolynomial Q. blind (x) and the second choice polynomial Q last (x); wherein the first selector polynomial Qblind (x) satisfies: when u ≤ x < 2 k , Q blind (x) = 1, and when 0 < x < u, Q blind (x) = 0; the second selection polynomial Q last (x) satisfies: when x = u, Q last (x) = 1, and when x ≠ u, Q last (x) = 0; substituting the random number into the first selection polynomial Q blind (x) and the second selection polynomial Q last (x), a plurality of second sub-proof messages are obtained.

[0170] Thus, the proof message not only includes the first sub-proof messages such as the first value polynomial, the second value polynomial, the third value polynomial, the fourth value polynomial, the first commitment opening proof polynomial, the second commitment opening proof polynomial, the third commitment opening proof polynomial, the fourth commitment opening proof polynomial, and the permutation relation polynomial after substituting the random number, but also includes the second sub-proof messages such as the first selection polynomial and the second selection polynomial after substituting the random number.

[0171] That is, the proof message is T(δ), S(δ), T′(δ), S′(δ), Q T (δ), Q S (δ), Q T′ (δ), Q S′ (δ), Q last (δ), Q blind (δ), Z(δ + 1), Z(δ). Among them, T(δ), S(δ), T′(δ), S′(δ), Q T (δ), Q S (δ), Q T′ (δ), Q S′ (δ), Z(δ + 1), Z(δ) are the first sub-proof messages; Q last (δ), Q blind (δ) is the second sub-proof message.

[0172] To better explain the embodiments of the present invention, the following will describe the consensus process of the above blockchain nodes in a specific implementation scenario, as Figure 5 shown.

[0173] Step 501, after the light node receives the block sent by the first full node in the blockchain network, it sends a user asset data acquisition request for each target user to the second full node in the blockchain network.

[0174] For example, a block may contain 5 transactions, each involving a different user who initiated the transaction.

[0175] Step 502: After the second full node determines that it has stored the asset data of each target user, it obtains the asset data of the target user in the blockchain ledger and generates a first vector; based on the asset data of multiple users stored in the blockchain ledger, it generates a second vector.

[0176] The second vector can be generated based on the asset data of all users in the blockchain ledger, or it can be generated by selecting the asset data of a subset of users. The second vector contains all the elements of the first vector. No two elements in the second vector are repeated.

[0177] For example, the first vector is T = [1, 3, 3, 6, 6], representing the asset data of 5 target users, with a length m = 5. The second vector is S = [1, 2, 3, 4, 5, 6], representing the asset data of 6 users in the blockchain ledger, with a length u = 6.

[0178] Step 503: The second full node expands the first vector and the second vector to the same length.

[0179] For the sake of the proof, we will extend the first and second vectors to the same length. We will select d (d≤um) elements from the shorter vector and place them at the end of the shorter vector. In this example, vector T is shorter, so we select 3 from vector T and place it at the end of vector T, resulting in the new vector T = [1, 3, 3, 6, 6, 3].

[0180] Step 504: The second full node constructs a first permutation vector for the first vector and a second permutation vector for the second vector. The permutation principle is that identical elements in the first permutation vector are adjacent to each other; the position of the first element of the identical elements in the first permutation vector determines the position of the element in the second permutation vector that is identical to the first element.

[0181] For example, if the first permutation vector is T′ = [3, 3, 3, 6, 6, 1], and the identical elements are 3, 3, 3, and the first element among these identical elements is 1, then the position of 3 in the second permutation vector is also 1; if the identical elements are 6, 6, and the first element among these identical elements is 4, then the position of 6 in the second permutation vector is also 4; if the identical element is 1, and the first element among these identical elements is 6, then the position of 1 in the second permutation vector is also 6. The remaining elements can be placed arbitrarily without restriction.

[0182] The resulting second permutation vector is S′ = [3, 2, 4, 6, 5, 1], where the element at position 1 is 3, the element at position 4 is 6, the element at position 6 is 1, and the positions of the remaining elements 2, 4, and 5 are not restricted.

[0183] Step 505: The second full node expands the vector lengths of the first vector, the first permutation vector, the second vector, and the second permutation vector to 2. k -1 is the length.

[0184] Among them, 2 k-1 <u<2 k Since the length of each vector is now u, by randomly selecting 2... k Inserting -1-u elements at the end of these four vectors yields the length-extended first vector, first permutation vector, second vector, and second permutation vector. This length extension masks the actual length of each vector, increasing the zero-knowledge nature of the proof.

[0185] In this example, u = 6, so according to 2 k-1 <u<2 k Solving for k, we get k = 3, therefore 2 k -u-1=1, so we randomly select an element, say 9, and get the expanded T=[1,3,3,6,6,3,9], the expanded S=[1,2,3,4,5,6,9], the expanded T′=[3,3,3,6,6,1,9], and the expanded S′=[3,2,4,6,5,1,9].

[0186] For the sake of simplicity, the first vector mentioned in the following schemes refers to the first vector after length expansion, the second vector refers to the second vector after length expansion, the first permutation vector refers to the first permutation vector after length expansion, and the second permutation vector refers to the second permutation vector after length expansion.

[0187] Step 506: The second full node constructs a first value polynomial, a second value polynomial, a third value polynomial, and a fourth value polynomial for the first vector, the second vector, the first permutation vector, and the second permutation vector, respectively.

[0188] The first, second, third, and fourth value polynomials are constructed as T(x), S(x), T′(x), and S′(x), respectively. This construction is to express each vector using polynomials. For example, for the second permutation vector S′, the fourth value polynomial S′(x) satisfies S′(1) = 3, S′(2) = 2, S′(3) = 4, S′(4) = 6, S′(5) = 5, S′(6) = 1, and S′(7) = 9.

[0189] Step 507, construct the first choice polynomial Q from the second full node. blind (x) and the second choice polynomial Q last (x); wherein the first selector polynomial Q blind(x) satisfies: when u ≤ x < 2 k Q blind (x) = 1, and when 0 < x < u, Q blind (x) = 0; the second selector polynomial Q last (x) satisfies: when x = u, Q last (x) = 1, and when x ≠ u, Q last (x) = 0.

[0190] In this example, the first selector polynomial Q blind (x) satisfies: when 6 ≤ x < 8, Q blind (x) = 1, and when 0 < x < 6, Q blind (x) = 0; the second selector polynomial Q last (x) satisfies: when x = 6, Q last (x) = 1, and when x ≠ 6, Q last (x) = 0.

[0191] Optionally, if step 505 is not included in the embodiments of the present invention, that is, if the lengths of these 4 vectors are not extended, there is no need to construct the first selector polynomial and the second selector polynomial. The purpose of doing this is to conceal the actual lengths of the vectors and increase the zero-knowledge property of the proof.

[0192] Step 508, the second full node makes commitments to the first value polynomial, the second value polynomial, the third value polynomial, and the fourth value polynomial, and sends the corresponding commitment values to the light node.

[0193] The embodiments of the present invention do not limit the commitment algorithm.

[0194] The 4 polynomials respectively obtain 4 commitment values, namely the first commitment value, the second commitment value, the third commitment value, and the fourth commitment value. The role of making commitments is to enable the light node to generate keys and prevent the light node from obtaining the specific expressions of the 4 polynomials. Because the light node cannot reverse the specific expression of a polynomial based only on the commitment of that polynomial.

[0195] In this example, the first value polynomial T(x), the second value polynomial S(x), the third value polynomial T'(x), and the fourth value polynomial S'(x) are committed using the polynomial commitment algorithm (such as the kate polynomial commitment), and the first commitment value C T , the second commitment value C S , the third commitment value C T′ , and the fourth commitment value C S′ are obtained respectively. Among them, C T = [T(x)]1, C S = [S(x)]1, C T′=[T′(x)]1 and C S′ = [S′(x)]1.

[0196] The second full node sends the four commitment values ​​to the light node.

[0197] Step 509: The light node generates a key based on the first commitment value, the second commitment value, the third commitment value, and the fourth commitment value. The key is then sent to the second full node.

[0198] In this example, for the first commitment value C T Second commitment value C S Hash the first key β; hash the third and fourth commitment values ​​to obtain the second key γ. Sending the generated key to the second full node allows the second full node to construct the permutation polynomial Z(x) based on the key. This ensures the security and zero-knowledge nature of the permutation polynomial Z(x).

[0199] In another possible implementation, the second full node does not send the four commitment values ​​to the light node, but instead generates the key itself based on the four commitment values. This approach, lacking the participation of the light node, is prone to causing distrust from the light node.

[0200] Generating keys by light nodes can increase the participation of light nodes and increase the trustworthiness of the keys.

[0201] Step 510: The second full node uses the key pair to construct a permutation relation polynomial using the first value polynomial, the second value polynomial, the third value polynomial, and the fourth value polynomial.

[0202] In this example, the constructed permutation relation polynomial Z(x) can be:

[0203] 3)Z(2 k )=Z(0)=1, that is, Z(8)=Z(0)=1;

[0204] 4) For all i∈[0,2] k ), for example

[0205]

[0206] Using the permutation relation polynomial Z(x) and the first choice polynomial Q blind (x), the second choice polynomial Q last (x) can express the mapping relationship between each element of the first vector T and the second vector S and the first permutation vectors T′ and S′ after the element positions are changed. It is used to prove that vectors T′ and S′ will not change (add or reduce) the elements of the original vectors T and S, but only the positions of the elements change.

[0207] Step 511: The second full node constructs a first commitment opening proof polynomial, a second commitment opening proof polynomial, a third commitment opening proof polynomial, and a fourth commitment opening proof polynomial based on the first value polynomial, the second value polynomial, the third value polynomial, and the fourth value polynomial, respectively.

[0208] Open at any position, and construct the corresponding commitment opening proof polynomial Q for the value polynomials T(x), S(x), T′(x), and S′(x). T Q S Q T′ and Q S′ Taking the first value polynomial T(x) as an example, we open it at the position x = 1. Of course, other values ​​can be chosen, but they cannot exceed the original length of the first vector T. In this example, the original length of the first vector T is 5. When x = 1, T(x) = 1, thus obtaining the first commitment opening proof polynomial. (The 1 in the denominator represents x = 1 in the chosen T(x), and the 1 in the numerator represents the value T(1) of the corresponding first-valued polynomial). The other valued polynomials are also opened at x = 1, resulting in S(1) = 1, T′(1) = 3, S′(1) = 3, and thus...

[0209] Step 512: The light node randomly selects a random number δ, which is less than the original length of the first vector T, and sends the random number δ to the second full node.

[0210] Since the light node does not know the original length of the first vector T, it can generate random numbers at will. The second full node then determines whether the random number is less than the original length of the first vector T. If it is less, the subsequent steps are performed. If it is not less, the light node is prompted to resend the random number.

[0211] Random numbers can also be generated by the second full node itself, but the reliability will be reduced if they are generated by the second full node itself.

[0212] Step 513: The second full node substitutes a random number into the first value polynomial, the second value polynomial, the third value polynomial, the fourth value polynomial, the first commitment open proof polynomial, the second commitment open proof polynomial, the third commitment open proof polynomial, the fourth commitment open proof polynomial, the permutation relation polynomial, the first selection sub-polynomial, and the second selection sub-polynomial. The value of the above expressions after substituting the random number is sent to the light nodes, namely the first sub-proof information and the second sub-proof information.

[0213] In this example, substituting the random number δ yields the first sub-proof information T(δ), S(δ), T′(δ), S′(δ), and Q. T (δ), Q S (δ), Q T′ (δ), Q S′ (δ), Q last (δ), Q blind (δ), Z(δ+1), Z(δ).

[0214] Step 514, calculate T(δ), S(δ), T′(δ), S′(δ), and Q for the second full node respectively. T (δ), Q S (δ), Q T′ (δ), Q S′ The first specific value of (δ) and the second specific value of δ-1.

[0215] The calculation methods for the first and second specific values ​​are defined below:

[0216] Assumption and There are two that satisfy e: The paired elliptic group, p is and The order of G, and G is The generator, H is The generator.

[0217] Define the first shorthand notation for any w∈F p , [w]1 is the first specific value of w;

[0218] Define the second shorthand notation for any w∈F p , [w]2 is the second specific value of w.

[0219] Thus, the calculated T(δ), S(δ), T′(δ), S′(δ), Q T (δ), Q S (δ), Q T′ (δ), Q S′ The first specific values ​​of (δ) are: [T(δ)]1, [S(δ)]1, [T′(δ)]1, [S′(δ)]1, [Q T (δ)]1,[Q S (δ)]1,[Q T′ (δ)]1,[Q S′ (δ)]1; The second specific value of the calculated δ-1 is [δ-1]2.

[0220] Step 515: The second full node finds the corresponding [T(δ)]1, [S(δ)]1, [T′(δ)]1, [S′(δ)]1, [Q]1 among all elements of the two multiplicative subgroups generated by the trusted third party initialization. T (δ)]1,[Q S (δ)]1,[Q T′ (δ)]1,[Q S′ The values ​​of (δ)]1 and [δ-1]2 are sent to the light node.

[0221] Trusted third party initializes and generates two multiplicative subgroups and All elements in the second full node are used for lookup.

[0222] By searching for these values ​​in trusted third parties, the credibility of these values ​​is increased, and the calculation process is simplified.

[0223] Step 516: The light node receives the values ​​sent in steps 513 and 515 and substitutes these values ​​into the first sub-verification formula and the second sub-verification formula.

[0224] The first sub-verification formula is used to verify that the first, second, third, and fourth value polynomials are obtained from the elements of the first vector, the elements of the first permutation vector, the elements of the second vector, and the elements of the third vector, respectively. The first sub-verification formula is as follows:

[0225] e([Q T (δ)]1,[δ-1]2)=e([T(δ)]1-[1]1,H)

[0226] e([Q S (δ)]1,[δ-1]2)=e([S(δ)]1-[1]1,H)

[0227] e([Q T′ (δ)]1,[δ-1]2)=e([T′(δ)]1-[3]1,H)

[0228] e([Q S′ (δ)]1,[δ-1]2)=e([S′(δ)]1-[3]1,H)

[0229] The second sub-verification formula is used to verify whether the permutation polynomial is used to characterize the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector; it is also used to verify whether each element in the first vector exists in the second vector. The second sub-verification formula is as follows:

[0230] (1-(Q last (δ)+Q blind (δ)))·Z(δ+1)·(T′(δ)+β)·(S′(δ)+γ)-Z(δ)·(T(δ)+β)·(S(δ)+γ)=0

[0231] (1-(Q last (δ)+Q blind (δ)))·(T′(δ)-S′(δ))·(T′(δ)-T′(δ-1))=0

[0232] (T′(1)-S′(1))=0

[0233] Q last (δ)·(Z(δ) 2 -Z(δ))=0

[0234] Step 517: If the above verification formula is met, it means that each element in the first vector exists in the second vector, and the second full node stores the asset data of each target user.

[0235] Step 518: Verify the legality of each transaction in the block based on the asset data of each target user.

[0236] The second full node can send the asset data and proof information of each target user together, or it can send them to the light node after the light node has verified the proof information. This embodiment of the invention does not limit this.

[0237] The technical solution provided by this invention constructs a permutation vector from a first vector and a second vector, and then constructs a commitment opening proof from the first vector, the second vector, the first permutation vector, and the second permutation vector, respectively. This achieves the construction of proof information, which proves that the second full node stores the asset data of each target user. Substituting the proof information into the verification formula, and verifying the proof information through the first and second sub-verification formulas, improves the accuracy of the proof information verification. The verification formula involved in this invention does not change with the elements in the second vector; therefore, the light node does not need to know each element in the second vector in advance, ensuring the security of the asset data of other users stored in the second full node. Furthermore, the verification formula does not need to be redesigned based on changes in the elements in the second vector, reducing computational complexity.

[0238] Based on the same technological concept Figure 6 An exemplary embodiment of the present invention illustrates the structure of a consensus device for a blockchain node, which can execute the consensus process of a blockchain node.

[0239] like Figure 6As shown, the device specifically includes:

[0240] Thirdly, embodiments of the present invention also provide a consensus device for a blockchain node, comprising:

[0241] The first sending unit 601 is used to send a request to the second full node of the blockchain network to obtain user asset data of each target user after receiving a block sent by the first full node in the blockchain network; the target user is the transaction initiator of any transaction in the block.

[0242] The first receiving unit 602 is used to receive the asset data and proof information of each target user sent by the second full node;

[0243] The first processing unit 603 is used to substitute the proof information into the verification formula for verification. If the verification is successful, the legality of each transaction in the block is verified based on the asset data of each target user. The verification formula is used to verify whether the asset data of each target user exists in the range asset data according to the proof information, thereby determining whether the asset data of each target user is stored in the second full node. The range asset data is generated by the second full node based on the asset data of multiple users stored in the second full node. The multiple users include each target user.

[0244] In some embodiments, the proof information includes multiple first sub-proof information; the multiple first sub-proof information includes the value of the permutation relation polynomial after substituting random numbers, the value of the value polynomial corresponding to each vector after substituting the random numbers, and the value of the commitment opening proof polynomial corresponding to each vector after substituting the random numbers; the vector includes a first vector, a second vector, a first permutation vector, and a second permutation vector; the first vector is formed by the second full node based on the asset data of each target user; the second vector is formed by the second full node based on the range asset data;

[0245] The first processing unit 603 is specifically used for:

[0246] Substitute the value of the commitment open proof polynomial corresponding to each vector into the first sub-verification formula. The first sub-verification formula is used to verify whether the value polynomial of each vector is constructed according to its corresponding vector.

[0247] Substitute the values ​​of the polynomials corresponding to each vector and the values ​​of the permutation polynomials into the second sub-verification formula. The second sub-verification formula is used to verify whether the permutation polynomials are used to characterize the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector; it is also used to verify whether each element in the first vector exists in the second vector.

[0248] Based on the same technological concept Figure 7 An exemplary embodiment of the present invention illustrates the structure of a consensus device for a blockchain node, which can execute the consensus process of a blockchain node.

[0249] like Figure 7 As shown, the device specifically includes:

[0250] The second receiving unit 701 is used to receive user asset data acquisition requests from target users sent by light nodes in the blockchain network; the target user is the transaction initiator of any transaction in the block; the block is sent to the light node by the first full node in the blockchain network.

[0251] The second processing unit 702 is used to generate proof information based on the asset data of each target user and the scope asset data after determining that it stores the asset data of each target user; the scope asset data is generated based on the asset data of multiple users stored in the second full node; the multiple users include each target user; the proof information is used to prove that the asset data of each target user is stored in the second full node;

[0252] The second sending unit 703 is used to send the asset data of each target user and the proof information to the light node. The light node is used to verify the proof information. If the verification is successful, the legality of each transaction in the block is verified based on the asset data of each target user.

[0253] In some embodiments, the second processing unit 702 is specifically used for:

[0254] A first permutation vector is constructed based on a first vector formed from the asset data of each target user; in the first permutation vector, identical elements are adjacent to each other.

[0255] A second permutation vector is constructed based on a second vector formed from the range asset data; the position of the element in the second permutation vector that is the same as the first element in the first permutation vector is determined based on the position of the first element of the same element in the first permutation vector.

[0256] For any one of the first vector, the first permutation vector, the second vector, and the second permutation vector, construct the value polynomial and the commitment opening proof polynomial of the vector;

[0257] Construct a permutation relation polynomial according to the permutation relations between the first vector and the first permutation vector and between the second vector and the second permutation vector;

[0258] For any random number, substitute the random number into the permutation relation polynomial, the value polynomial corresponding to any vector, and the commitment opening proof polynomial to obtain a plurality of first sub-proof information respectively.

[0259] In some embodiments, the second processing unit 702 is further configured to:

[0260] Expand the vector lengths of the first vector, the first permutation vector, the second vector, and the second permutation vector to 2 k -1; where 2 k-1 and u is the vector length of the second vector formed by the range asset data; k Construct a first selector polynomial Q

[0261] (x) and a second selector polynomial Q blind (x); where the first selector polynomial Q last (x) satisfies: when u ≤ x < 2 blind , Q k (x) = 1, and when 0 < x < u, Q blind (x) = 0; the second selector polynomial Q blind (x) satisfies: when x = u, Q last (x) = 1, and when x ≠ u, Q last (x) = 0; last (x) = 0;

[0262] Substitute the random number into the first selector polynomial Q blind (x) and the second selector polynomial Q last (x) to obtain a plurality of second sub-proof information.

[0263] In some embodiments, the second processing unit 702 is further configured to:

[0264] Make a commitment to the value polynomial corresponding to the vector to obtain the commitment value corresponding to the vector;

[0265] Specifically, the second processing unit 702 is configured to:

[0266] The permutation polynomial is constructed based on the key, the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector; the key is obtained based on the commitment value corresponding to each vector.

[0267] In some embodiments, the random number and / or the key are provided by the light node.

[0268] Based on the same technical concept, embodiments of this application provide a computer device, such as... Figure 8 As shown, it includes at least one processor 801 and a memory 802 connected to at least one processor. In this embodiment, the specific connection medium between the processor 801 and the memory 802 is not limited. Figure 8 Taking the connection between the processor 801 and the memory 802 via a bus as an example, the bus can be divided into address bus, data bus, control bus, etc.

[0269] In this embodiment of the application, the memory 802 stores instructions that can be executed by at least one processor 801. By executing the instructions stored in the memory 802, at least one processor 801 can execute the steps of the consensus method of the blockchain node described above.

[0270] The processor 801 serves as the control center of the computer device, connecting to various parts of the device via various interfaces and lines. It performs consensus among blockchain nodes by running or executing instructions stored in the memory 802 and accessing data stored in the memory 802. In some embodiments, the processor 801 may include one or more processing units, integrating an application processor and a modem processor. The application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 may be implemented on the same chip; in other embodiments, they may be implemented on separate chips.

[0271] The processor 801 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0272] Memory 802, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 802 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 802 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 802 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0273] Based on the same technical concept, embodiments of the present invention also provide a computer-readable storage medium storing a computer-executable program, the computer-executable program being used to enable a computer to perform a consensus method of blockchain nodes listed in any of the above methods.

[0274] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0275] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0276] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0277] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0278] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A consensus method for blockchain nodes, characterized in that, The method is applied to the second full node in a blockchain network, including: The system receives user asset data acquisition requests from light nodes in the blockchain network for each target user; the target user is the transaction initiator of any transaction in the block; the block is sent to the light node by the first full node in the blockchain network. After confirming that it stores the asset data of each target user, it generates proof information based on the asset data of each target user and the scope asset data; the scope asset data is generated based on the asset data of multiple users stored in the second full node; the multiple users include each target user; the proof information is used to prove that the second full node stores the asset data of each target user; The asset data of each target user and the proof information are sent to the light node. The light node is used to verify the proof information. If the verification is successful, the legality of each transaction in the block is verified based on the asset data of each target user. The generation of proof information based on the asset data and scope asset data of each target user includes: A first permutation vector is constructed based on a first vector formed from the asset data of each target user; identical elements in the first permutation vector are adjacent to each other; a second permutation vector is constructed based on a second vector formed from the range asset data; the position of the element identical to the first element in the second permutation vector is determined based on the position of the first element of the identical elements in the first permutation vector; for any vector among the first vector, the first permutation vector, the second vector, and the second permutation vector, a value polynomial and a commitment opening proof polynomial are constructed; a permutation relationship polynomial is constructed based on the permutation relationship between the first vector and the first permutation vector and the permutation relationship between the second vector and the second permutation vector; for any random number, the random number is substituted into the permutation relationship polynomial, the value polynomial corresponding to any vector, and the commitment opening proof polynomial to obtain multiple first sub-proof information respectively.

2. The method as described in claim 1, characterized in that, Before constructing the value polynomial and the commitment opening proof polynomial for any one of the first vector, the first permutation vector, the second vector, and the second permutation vector, the method further includes: The lengths of the first vector, the first permutation vector, the second vector, and the second permutation vector are all increased to 2. k -1; where 2 k-1 <u<2 k u is the vector length of the second vector formed by the asset data within the specified range; Before obtaining the aforementioned proof information, the process also includes: Construct the first selector polynomial Q blind (x) and the second selector polynomial Q last (x); where the first selector polynomial Q blind (x) satisfies: when u ≤ x < 2 k , Q blind (x) = 1, and when 0 < x < u, Q blind (x) = 0; the second selector polynomial Q last (x) satisfies: when x = u, Q last (x) = 1, and when x ≠ u, Q last (x) = 0; The method further includes: Substituting the random number into the first selector polynomial Q blind (x) and the second choice polynomial Q last (x) yields multiple second sub-proof information.

3. The method as described in claim 1, characterized in that, After constructing the value polynomial of the vector for any one of the first vector, the first permutation vector, the second vector, and the second permutation vector, the method further includes: Make a commitment to the polynomial that takes the value corresponding to the vector to obtain the commitment value corresponding to the vector; Based on the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector, a permutation polynomial is constructed, including: The permutation polynomial is constructed based on the key, the permutation relationship between the first vector and the first permutation vector, and the permutation relationship between the second vector and the second permutation vector; the key is obtained based on the commitment value corresponding to each vector.

4. The method as described in claim 3, characterized in that, The random number and / or the key are provided to the light node.

5. A consensus method for blockchain nodes, characterized in that, The method is applied to light nodes in a blockchain network, including: After receiving a block sent by the first full node in the blockchain network, a request to obtain user asset data of each target user is sent to the second full node in the blockchain network; the target user is the transaction initiator of any transaction in the block; Receive the asset data and proof information of each target user sent by the second full node; The proof information is substituted into the verification formula for verification. If the verification passes, the legality of each transaction in the block is verified based on the asset data of each target user. The verification formula is used to verify whether the asset data of each target user exists in the range asset data according to the proof information, thereby determining whether the asset data of each target user is stored in the second full node. The range asset data is generated by the second full node based on the asset data of multiple users stored in the second full node. The multiple users include each target user. The proof information includes multiple first sub-proof information; the multiple first sub-proof information includes the value of the permutation relation polynomial after substituting random numbers, the value of the value polynomial corresponding to each vector after substituting the random numbers, and the value of the commitment opening proof polynomial corresponding to each vector after substituting the random numbers; the vector includes a first vector, a second vector, a first permutation vector, and a second permutation vector; the first vector is formed by the second full node based on the asset data of each target user; the second vector is formed by the second full node based on the range asset data; The verification process involves substituting the proof information into the verification formula, including: Substitute the values ​​of the commitment open proof polynomials corresponding to each vector into the first sub-verification formula. The first sub-verification formula is used to verify whether the value polynomials of each vector are constructed based on their respective vectors. Substitute the values ​​of the value polynomials corresponding to each vector and the values ​​of the permutation relation polynomials into the second sub-verification formula. The second sub-verification formula is used to verify whether the permutation relation polynomials are used to characterize the permutation relation between the first vector and the first permutation vector, and the permutation relation between the second vector and the second permutation vector. It is also used to verify whether each element in the first vector exists in the second vector.

6. A consensus device for a blockchain node, characterized in that, A consensus method for implementing a blockchain node as described in any one of claims 1-4, comprising: The second receiving unit is used to receive user asset data acquisition requests from target users sent by light nodes in the blockchain network; the target user is the transaction initiator of any transaction in the block; the block is sent to the light node by the first full node in the blockchain network. The second processing unit is used to generate proof information based on the asset data of each target user and the scope asset data after determining that it stores the asset data of each target user; the scope asset data is generated based on the asset data of multiple users stored in the second full node; the multiple users include each target user; the proof information is used to prove that the asset data of each target user is stored in the second full node; The second sending unit is used to send the asset data of each target user and the proof information to the light node. The light node is used to verify the proof information. If the verification is successful, the legality of each transaction in the block is verified based on the asset data of each target user. The second processing unit is specifically configured to: construct a first permutation vector based on a first vector formed from the asset data of each target user; ensure that identical elements in the first permutation vector are adjacent to each other; construct a second permutation vector based on a second vector formed from the range asset data; determine the position of the element in the second permutation vector that is identical to the first element based on the position of the first element of the identical element in the first permutation vector; construct a value polynomial and a commitment opening proof polynomial for any vector among the first vector, the first permutation vector, the second vector, and the second permutation vector; construct a permutation relationship polynomial based on the permutation relationship between the first vector and the first permutation vector and the permutation relationship between the second vector and the second permutation vector; and substitute any random number into the permutation relationship polynomial, the value polynomial corresponding to any vector, and the commitment opening proof polynomial to obtain multiple first sub-proof information.

7. A consensus device for a blockchain node, characterized in that, A consensus method for implementing a blockchain node as described in claim 5, comprising: The first sending unit is used to send a request to the second full node of the blockchain network to obtain user asset data of each target user after receiving a block sent by the first full node in the blockchain network; the target user is the transaction initiator of any transaction in the block; The first receiving unit is used to receive the asset data and proof information of each target user sent by the second full node; The first processing unit is used to substitute the proof information into the verification formula for verification. If the verification passes, the unit performs transaction legality verification on each transaction in the block based on the asset data of each target user. The verification formula is used to verify whether the asset data of each target user exists in the range asset data according to the proof information, thereby determining whether the asset data of each target user is stored in the second full node. The range asset data is generated by the second full node based on the asset data of multiple users stored in the second full node. The multiple users include each target user. The proof information includes multiple first sub-proof information; the multiple first sub-proof information includes the value of the permutation relation polynomial after substituting random numbers, the value of the value polynomial corresponding to each vector after substituting the random numbers, and the value of the commitment opening proof polynomial corresponding to each vector after substituting the random numbers; the vector includes a first vector, a second vector, a first permutation vector, and a second permutation vector; the first vector is formed by the second full node based on the asset data of each target user; the second vector is formed by the second full node based on the range asset data; The first processing unit is specifically used to substitute the value of the commitment opening proof polynomial corresponding to each vector into a first sub-verification formula, the first sub-verification formula being used to verify whether the value polynomial of each vector is constructed based on its corresponding vector; to substitute the value of the value polynomial corresponding to each vector and the value of the permutation relation polynomial into a second sub-verification formula, the second sub-verification formula being used to verify whether the permutation relation polynomial is used to characterize the permutation relation between the first vector and the first permutation vector and the permutation relation between the second vector and the second permutation vector; and to verify whether each element in the first vector exists in the second vector.

8. A computing device, characterized in that, include: Memory, used to store computer programs; A processor is configured to invoke a computer program stored in the memory and execute the method according to any one of claims 1 to 5 in accordance with the obtained program.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer-executable program for causing a computer to perform the method according to any one of claims 1 to 5.

Images