A non-interactive publicly verifiable system and computing method based on SNARK in a blockchain scenario

Abstract

The embodiment of the application provides a SNARK-based non-interactive public verifiable system and a computing method in a blockchain scenario, and belongs to the field of verifiable computing. The system comprises a user, which is provided with a public-private key pair, and the input data and the computing result of the computing task are ciphertexts, and the computing result is decrypted to obtain a final result under the condition that the computing result is verified; a computing server, which completes the computing task to obtain a computing result ciphertext, and pre-processes a computing function to obtain an R1CS program matrix, and finally uploads the computing result ciphertext and the R1CS program matrix to a blockchain; and a proof server, which further processes the R1CS program matrix and a random number R provided by the blockchain to generate two groups of parameters Sp and Sv of a CRS. The application can effectively avoid the random number leakage risk and the problem of relying on a trusted setting of the verifiable computing based on SNARK in the trusted initialization process on the basis of trusted computing.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of verifiable computing, in particular to a SNARK-based non-interactive publicly verifiable system and a computing method in a blockchain scenario. BACKGROUND

[0002] With the explosive growth of data, data processing has become a very complex and heavy work, and a single user cannot support a large amount of computing, thus giving rise to the rapid development of distributed computing and cloud computing computing services, which can provide users with sub-contracting and outsourcing computing. However, the third-party server is generally not trusted, and they may return an incorrect computing result to the user in order to save their own computing resources or for other purposes. In order to build a trusted outsourcing computing process, the concept of verifiable computing (VC) is proposed, which can outsource computing tasks to third-party computing providers, and the untrusted third-party computing providers need to submit a correctness proof about the computing result while completing the computing task.

[0003] The simple non-interactive knowledge-based system SANRK attracts many researchers to work around it due to its non-interactive nature, but the key CRS model of SNARK non-interactive nature relies on the random oracle hypothesis and trusted settings. In actual production, the random oracle hypothesis cannot be realized, and only pseudo-random numbers can be used instead, which leads to the risk of random number leakage in advance, threatening system security. Similarly, the trusted setting assumption also threatens the security of the system. Therefore, it is of great significance to study how to select random numbers and remove trusted settings.

[0004] As a distributed network, the essence of on-chain computing is to execute the computing task (simultaneously) multiple times, and the resource overhead is very expensive; therefore, the chain is not suitable for carrying too many computing tasks, and it is more suitable for "audit requirements", the computing is relatively lightweight, and it focuses on the computing task of global state update of business data. However, for various commercial application scenarios, the blockchain sometimes needs to carry heavy computing tasks to ensure the credibility of the system, and verifiable computing can solve this contradiction, which can credibly outsource heavy computing tasks to off-chain, and only need to perform lightweight verification computing on-chain, so that the blockchain can support application scenarios containing heavy computing tasks. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a SNARK-based non-interactive publicly verifiable system and a computing method in a blockchain scenario, which can verify the random number leakage risk and the problem of relying on trusted settings existing in the computing initialization.

[0006] In order to achieve the above object, the embodiment of the present application provides a SNARK-based non-interactive publicly verifiable system in a blockchain scenario, which comprises:

[0007] A commissioned user is provided with a public-private key pair, and the input data and the calculation result of the commissioned calculation task are both ciphertexts, and the calculation result is decrypted to obtain the final result under the condition that the calculation result is verified;

[0008] A calculation server completes a calculation task on the ciphertexts, obtains calculation result ciphertexts, and pre-processes a commissioned function to obtain an R1CS program matrix, and finally uploads the calculation result ciphertexts and the R1CS program matrix to a blockchain;

[0009] A proof server further processes the R1CS program matrix and a random number R provided by the blockchain to generate two groups of parameters Sp and Sv of the CRS; wherein the blockchain generates the random number R, and the random number R is a hash value of a block, and the block contains the calculation result ciphertexts uploaded by the calculation server.

[0010] Preferably, the calculation method comprises using the SNARK-based non-interactive publicly verifiable system in the blockchain scenario as described above.

[0011] Step 1, a commissioned user generates a public-private key pair, and uploads a commissioned function f, input data ciphertexts [[x]] and a public key pk to a blockchain;

[0012] Step 2, a calculation server obtains the commissioned function f and the public key pk from the blockchain, performs calculation on the ciphertexts to obtain calculation result ciphertexts, pre-processes the commissioned function to obtain an R1CS program matrix, and finally uploads the calculation result ciphertexts and the R1CS program matrix to the blockchain;

[0013] Step 3, a proof server generates a CRS by using the R1CS program matrix and a random number provided by the blockchain, wherein S v Part of information can be used as a verification party to perform verification calculation, and S v Can be generated by the proof server to generate proof information;

[0014] Step 4, according to the input of the commissioned user, the proof information π generated by the proof server and S v Verify the information;

[0015] Step 5, according to the malfeasance checking strategy, whether to execute a malfeasance checking algorithm is judged;

[0016] Step 6, a commissioned user obtains result ciphertexts [[ω]], and decrypts the result ciphertexts by using a private key to obtain result plaintexts:

[0017] Preferably, in step 1,

[0018] Step 1.1, the commissioned user constructs a linear encryption system: select a domain A cyclic group G with pairing pairing properties, a generator g∈G, execute the generation algorithm to randomly generate a pair of public and private key pairs Gen(1 λ )→(pk, sk), the linear encryption system has additive homomorphism and pairing properties, and provides technical support for verifying computation under ciphertext;

[0019] Step 1.2, upload the commissioned function f, input information ciphertext [[x]] and public key pk to the blockchain.

[0020] Preferably, in step 2,

[0021] Step 2.1, the computing server executes the computation on the ciphertext, and then re-encrypts the result to the computation result ciphertext [[ω]] under the key pair pk, sk through the key rotation unique to homomorphic encryption;

[0022] Step 2.2, preprocess the commissioned function, convert the function corresponding mathematical operation circuit C to R1CS (Rank-1 Constraint System) program to generate three matrices Where m is the number of logic gate circuits, and n is the length of (x, ω); according to m randomly selected Vandermonde matrix V and its inverse matrix V -1 .

[0023] Preferably, in step 3,

[0024] Step 3.1, generate a CRS with the random number R provided by the blockchain and Related, a set of solutions can be found between the three matrices Where x is the plaintext input by the commissioned user, and ω is the result plaintext, and using the three matrices and this particular solution set Vandermonde matrix V and inverse matrix V -1 , three time polynomial algorithms P(x), L(x), R(x) corresponding to the three matrices A, B, C can be generated; here 3 time polynomial algorithms constitute a SNARG system, denoted as Π=(P(x), L(x), R(x)); first, the polynomial is transformed as follows:

[0025]

[0026] Where p i (i∈[0,m-1]) is the coefficient of the polynomial, and p(i)(i∈[0,m-1]) is the value of the polynomial at i; use the LPCP theorem to bring in R, and continue to transform the polynomial:

[0027] P(R) = [1 R 2 ...R m-1 ]V -1 (A·Z)

[0028] The entire expression is divided into two parts:

[0029] p(R) = ([1 R 2 ...R m-1 ]V -1 A)·Z = <q1, Z>

[0030] q1 = [1 R 2 ...R m-1 ]V -1 A

[0031] Because 1, x in vector Z are all public known, so q1 can be divided into two parts:

[0032]

[0033] Similarly, we can get:

[0034]

[0035]

[0036] Output verifier CRS:

[0037] The generated verifier CRS should be encrypted data:

[0038]

[0039] Output prover CRS:

[0040]

[0041] Step 3.2, the proof server executes the proof algorithm prove(S p , [[x]], [[ω]])→π, since the computing server has uploaded the encrypted result [[ω]] to the blockchain, the proof information can be generated by the proof server π = [[a]], [[b]], [[c]]

[0042]

[0043]

[0044]

[0045] Step 3.3, the verifier CRS: Proof information π = [[a]], [[b]], [[c]] and malice checking parameters are uploaded to the blockchain.

[0046] Preferably, in step 4,

[0047] The verifier obtains the CRS Then, the verification equation is checked by using the additive homomorphism operation and pairing operation in the linear encryption system, whether the verification equation is equal or not, in combination with the proof information π = [[a]], [[b]], [[c]] generated by the proof server:

[0048]

[0049] If the above formula is established, the verification is passed, otherwise, the verification is not passed.

[0050] Preferably, in step 5,

[0051] Step 5.1, according to the execution result of step 4, it is judged whether to execute the malice checking algorithm, if the verification is not passed, the malice checking algorithm is executed, if the verification is passed, the random checking algorithm is executed;

[0052] Step 5.2, random checking algorithm: it is judged whether the random number R is less than the threshold (the size of the threshold can be set according to the security level, the higher the security level, the larger the threshold), if it is less than the threshold, the malice checking algorithm is executed on the last verifiable calculation, if it is greater than or equal to the threshold, it is considered that the verification is passed. The purpose is to prevent the proof server from cheating, and to use the random number R this time to determine whether to execute the malice checking algorithm on the last verifiable calculation, which can effectively realize the randomness of the checking;

[0053] Step 5.3, malice checking algorithm: obtaining After encryption, the proof information generation process is executed, it is judged whether it is equal to π generated by the proof server, if it is equal, the algorithm result is true, if it is not equal, the algorithm result is false.

[0054] In addition, the application also provides a machine readable storage medium, the machine readable storage medium stores instructions, the instructions are used to make the machine execute the above-mentioned SNARK-based non-interactive publicly verifiable system calculation method based on the blockchain scene.

[0055] In addition, the application also provides a processor for running a program, wherein the program is used to execute the above-mentioned SNARK-based non-interactive publicly verifiable system calculation method based on the blockchain scene when the program is run.

[0056] By the technical solution, the method uses the hash of a specific block in the blockchain as a random number for generating the CRS, avoids using a random oracle that is not achievable in reality, and thus can effectively prevent risks caused by early leakage of the random number; the method is also based on a double-server model, thereby constructing a SNARK that does not need to be trusted to be set, and providing a simple and effective fraud checking mechanism, and further enhancing the security of the system. The method makes all calculations containing private information be performed on a ciphertext by means of a linear encryption system, and realizes privacy protection.

[0057] Other features and advantages of the embodiments of the present application will be described in detail in the following specific implementation part. BRIEF DESCRIPTION OF DRAWINGS

[0058] The accompanying drawings are included to provide a further understanding of the embodiments of the present application, constitute a part of the specification and are used to explain the embodiments of the present application together with the following specific implementation, but do not constitute a limitation on the embodiments of the present application. In the drawings:

[0059] Figure 1 is a system model schematic diagram of the SNARK-based non-interactive publicly verifiable system in the blockchain scenario of the present application; and

[0060] Figure 2 is a protocol flow schematic diagram of the SNARK-based non-interactive publicly verifiable system in the blockchain scenario of the present application. DETAILED DESCRIPTION

[0061] The specific implementation of the embodiments of the present application is described in detail below in combination with the drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the embodiments of the present application, and does not limit the embodiments of the present application.

[0062] The SNARK-based non-interactive publicly verifiable system under the blockchain scenario includes four main objects: a commissioned user, a computing server, a proof server and an unauthorized user: wherein the commissioned user has his own public and private key pair, the input data and the calculation result of the commissioned calculation task are both ciphertexts, and the final result is obtained by decrypting the calculation result if the calculation result is verified; wherein the computing server completes the calculation task on the ciphertexts, obtains the ciphertext of the calculation result, and pre-processes the commissioned function to obtain the R1CS program matrix, and finally uploads the ciphertext of the calculation result and the R1CS program matrix to the blockchain; wherein the proof server further processes the R1CS program matrix and the random number R provided by the blockchain to generate two groups of parameters Sp and Sv of the CRS. The random number R provided by the blockchain is a key step to make the initialization work credible. The random number R is the hash value of a block, and the block contains the ciphertext of the calculation result uploaded by the computing server, thereby effectively preventing the risk brought by the early leakage of the random number, and the proof server and the verification server do not collude. The unauthorized user refers to a user who has no right to view the plaintext of the ciphertext of the calculation result. The unauthorized user only performs the verification calculation and the calculation specified by the evil checking mechanism, which is the key of the publicly verifiable calculation. The unauthorized user can be a node of the blockchain, thereby achieving consensus and chain uploading of the outsourced calculation result.

[0063] The SNARK-based non-interactive publicly verifiable system under the blockchain scenario includes the following steps:

[0064] Step 1, calculation task commissioning, specifically: the commissioned user uploads the commissioned information, including: generating a public and private key pair, uploading the commissioned function f, input information ciphertext [[x]] and public key pk to the blockchain.

[0065] Step 1 includes the following sub-steps:

[0066] Step 1.1: The commissioned user constructs a linear encryption system: selects a domain A cyclic group G with Pairing pairing property, a generator g G, and executes a generation algorithm to randomly generate a pair of public and private key pairs Gen(1 λ )→(pk, sk), the linear encryption system has additive homomorphism and pairing property, which provides technical support for the verification calculation to be performed under ciphertexts.

[0067] Step 1.2: Upload the commissioned function f, input information ciphertext [[x]] and public key pk to the blockchain. Since the blockchain is not suitable for storing a large amount of information, the information can be stored in a trusted system such as IPFS, and only the information address is stored in the blockchain, thereby achieving the purpose of trusted public storage.

[0068] Step 2, the computing task is executed, specifically: the computing server performs computation on the ciphertext to obtain the computation result ciphertext [[ω]], and preprocesses the delegated function to assist in the generation of the Common Reference String (CRS) and the proof information.

[0069] Step 2 includes the following sub-steps:

[0070] Step 2.1: The computing server performs computation on the ciphertext, for example, performs ciphertext computation using homomorphic encryption, obtains the computation result, and then re-encrypts the result into the computation result ciphertext [[ω]] under the key pair pk, sk through the key rotation specific to homomorphic encryption, so as to further realize the lightweight verification.

[0071] Step 2.2: The delegated function is preprocessed, and the function corresponding mathematical operation circuit C is converted into an R1CS (Rank-1 Constraint System) program to generate three matrices where m is the number of logic gate circuits, i.e., the number of constraints, representing the size of the circuit, and n is the length of (x, ω). In addition, according to the randomly selected m Van der Monde matrix V and its inverse matrix V -1 .

[0072] Step 2.3: The computing server uploads the computation result ciphertext and the R1CS program matrix to the blockchain;

[0073] Step 3, system initialization, specifically: the proof server generates the CRS using the R1CS program matrix and the random number provided by the blockchain, i.e., the SNARK generation algorithm Setup→(Sp, Sv), where Sv can be used as part of the information for the verifier to perform verification computation, and Sv can be generated by the proof server to generate proof information.

[0074] Step 3 includes the following sub-steps:

[0075] Step 3.1: Generate the CRS with the random number R provided by the blockchain and related, where a set of solutions can be found among the three matrices, where x is the plaintext input by the delegated user, and ω is the result plaintext. Using the three matrices and this specific solution set, the Van der Monde matrix V and the inverse matrix V -1 can be generated to generate three time polynomial algorithms P(x), L(x), and R(x) corresponding to the three matrices A, B, and C. Here, the three time polynomial algorithms constitute a SNARG system, denoted as Π=(P(x), L(x), R(x)). In order to adapt to the construction of the protocol, before generating the polynomials, the polynomials are transformed as follows:

[0076]

[0077] where P i (i∈[0,m-1]) are coefficients of the polynomial, p(i)(i∈[0,m-1]) are the values of the polynomial at i. Using the LPCP theorem, we continue to deform the polynomial:

[0078] P(R)=[1 R 2 ...R m-1 ]V -1 (A·Z)

[0079] We can find that A, V, and random number R are all public, and the entire expression can be divided into two parts:

[0080] p(R)=([1 R 2 ... m-1 ]V -1 A)·Z=<q1,Z>

[0081] q1=[1 R 2 ...R m-1 ]V -1 A

[0082] Because 1, x in vector Z are all public known, so we can divide q1 into two parts:

[0083]

[0084] Therefore:

[0085]

[0086]

[0087] Output verification party CRS:

[0088] Since the verification party verifies in the case of encryption, in order to further reduce the calculation complexity of the verification party, the generated verification party CRS should be encrypted data

[0089]

[0090] Output proof party CRS:

[0091]

[0092] Step 3.2: The proof server executes the proof algorithm prove(S p, [[x]], [[ω]]) -> π, since the computing server has uploaded the encrypted result [[ω]] to the blockchain, the proof information can be generated by the proof server π = [[a]], [[b]], [[c]]

[0093]

[0094]

[0095]

[0096] Step 3.3: upload the verification party CRS: the proof information π = [[a]], [[b]], [[c]] and the malice checking parameter to the blockchain.

[0097] Step 4, verify the result, specifically: according to the input of the user, the proof information π generated by the proof server and S in the CRS v perform verification, specifically as follows:

[0098] The verification party obtains Then, combined with the proof information π = [[a]], [[b]], [[c]] generated by the proof server, using the additive homomorphism operation and pairing operation in the linear encryption system, check whether the verification equation is equal:

[0099]

[0100] If the above formula is established, the verification passes, otherwise the verification fails.

[0101] Step 5, execute the malice checking mechanism, specifically: according to the malice checking strategy to determine whether to execute the malice checking algorithm.

[0102] Step 5 includes the following sub-steps:

[0103] Step 5.1: execute the first step of the malice checking strategy, according to the execution result of step 4 to determine whether to execute the malice checking algorithm, if the verification fails, execute the malice checking algorithm; if the verification passes, execute the random checking algorithm.

[0104] Step 5.2: the random checking algorithm is: judge whether the random number R is less than the threshold (the size of the threshold can be set according to the security level, the higher the security level, the larger the threshold), if less than the threshold, execute the malice checking algorithm for the last verifiable calculation, if greater than or equal to the threshold, it is considered that the verification passes. The purpose is to prevent the proof server from cheating, and to use this random number R to determine whether to execute the malice checking algorithm for the last verifiable calculation, which can effectively realize the randomness of the check.

[0105] Step 5.3: Perform the misbehavior checking algorithm, get After encryption, perform the proof proof information generation process, judge whether it is equal to π generated by the proof server, if equal, the algorithm result is true, if not equal, the algorithm result is false.

[0106] Step 6, result decryption, specifically: the user gets the result ciphertext [[ω]], and decrypts it with the private key to get the result plaintext:

[0107] At this point, from step 1 to step 5, the SNARK-based non-interactive public verifiable system in the blockchain scenario is completed.

[0108] The SNARK described in the step can make the interactive proof become non-interactive, so there are many research works around SNARK. SNARK is defined on the basis of succinct non-interactive argument (SNARG), so we first introduce SNARG, and then introduce SNARK. Let NP relation R = {(μ, ω)}, where μ is the statement of the problem, ω is the solution of the problem, and Π is a SNARG system of the language L defined by the NP relation R. The system consists of three algorithms (Gen, P, V) and is strictly defined as follows:

[0109] Definition 1 (SNARG) Π = (Gen, P, V) is a SNARG system of the language L defined by the NP relation R, which satisfies the following properties:

[0110] Perfect completeness, for any algorithm A, there is a negligible function negl(λ),

[0111]

[0112] Where the running time of P(crs, μ, ω) is ploy(λ, n), and n is the length of (μ, ω).

[0113] Reliability, for any polynomial algorithm A, such that

[0114]

[0115] Succinctness

[0116] |π| = poly(λ + |μ|)

[0117] SNARK can be defined on the basis of SNARG.

[0118] Definition 2 (SNARK) SNARK is a SNARG equipped with an extractor ε that satisfies the following conditions: for any polynomial size P, there is a polynomial time extractor εP , for any z e {0, 1} λ , such that

[0119]

[0120] Generally, priv ≠ crs, this time SNARK is a private verification system for the designated verifier, when priv = crs, the verifier does not need specific private information, all verifiers can be verified, called public verifiable system, the SNARK system used in this paper is a public verifiable system. The core algorithm of SNARK system is composed of: generation algorithm Setup: Setup(C)→(Sp, Sv), corresponding to step 3.1. Prove algorithm Prove: Prove(Sp, x, ω)→π, corresponding to step 3.2. Verification algorithm Verify: Verify(Sv, x, π)→Yes / No, corresponding to step 4.

[0121] The R1CS (Rank-1 Constraint System) described in the step is: generally, because the circuit C is complex, it is difficult to derive polynomials, so we need to use the intermediate medium R1CS to convert the relationship of the circuit C into a matrix relationship, which is called R1CS program matrix, corresponding to step 2.2. The R1CS program matrix includes three matrices and a set of solutions Z between the three matrices, so as to satisfy

[0122]

[0123] The relationship between each logic gate in the circuit C can be expressed by the matrix A, B, C, and the private and public input of the circuit is expressed by . Among them, m is the number of logic gate circuits, that is, the number of constraints, and n is the length of (x, ω).

[0124] The (LinearPCP) LPCP, corresponding to steps 3.2 and 4, is also based on the PCP theorem, but the difference is that LPCP adds a constraint to the described problem, the definition of LPCP is: for any d-order polynomial P, whether each coefficient of the polynomial meets the specific requirements can be determined by verifying the value of the random polynomial at several points.

[0125] P(x) = c0 + c1 · x + c2 · x 2 +... + c d · x d

[0126] Assume that the value of the polynomial P(x) in the domain is (c0, c1,... c dIf the coefficients of P(x) are arbitrary, then we immediately verify that there exists a point r such that P(r)≠Q(r) for any polynomial Q(x)≠P(x) of degree d.

[0127]

[0128] That is, two polynomials of degree d with different coefficients will have at most d coincidences in the field Fp. When p is large, will be a negligible function.

[0130]

[0129] Figure 1 It is a system model diagram of the SNARK-based non-interactive publicly verifiable system in the blockchain scenario of the application. As shown in the figure, Figure 1 corresponding to step 1; executing the outsourcing task, corresponding to step 2; generating a CRS and proof information, corresponding to step 3; verifying the outsourcing task, corresponding to steps 4, 5, and 6; the client of the delegated user: an entity with outsourcing computing needs constitutes a delegated user, and provides a delegated function, encrypted input data, and an encrypted public key for a computing server, and participates in the verification of the final result and the acquisition of the result plaintext. The blockchain platform: acting as a CRS model, it is a public platform that provides public reference strings and trusted random numbers. Since our verification process is very lightweight, the verification algorithm can be consensus-chained to retain evidence. The computing server: having strong computing power, in this paper, ciphertext computation is used to implement the computing task, which cannot pry into the privacy input and output result of the user, and can protect the privacy information of the delegated user. In addition, the circuit is preprocessed, and finally the result in the ciphertext state and the preprocessing result are uploaded to the blockchain. The proof server: as an untrusted third party, it is assumed that it cannot collude with the computing server, and obtains information from the blockchain to generate a CRS and proof information, and uploads them to the blockchain. The unauthorized user client: only needs to do verification calculation, and the data used in the verification process are all encrypted data, so the result will not be leaked, and the privacy protection effect is achieved.

[0130] As shown in the figure, Figure 2 we propose a specific implementation process of the protocol:

[0131] The delegated user uploads the input data [[x]] to be outsourced, the target function f, and the public key pk to the blockchain, corresponding to step 1.2, wherein the input data is private data of the delegated user, and needs to be encrypted with the public key pk before being uploaded to the blockchain.

[0132] The computing server obtains information f and pk from the blockchain to perform a computing task to obtain an encrypted final result.

[0133] The computing server executes the computing task corresponding to step 2.1, and generates the matrices A, B, and C of the R1CS program and the corresponding Vandermonde inverse matrix V -1 The encrypted result [[ω]] is uploaded to the blockchain corresponding to step 2.2, and the corresponding step 2.3.

[0134] The proof server downloads the required random number R from the blockchain, and the selected R is the block hash containing [[ω]], so as to prevent the server from modifying the result and cheating; and the matrices A, B, and C of the R1CS program and the corresponding Vandermonde inverse matrix V are downloaded -1 , the encrypted result [[ω]], and the user public key pk, etc., are used to execute the SNARK generation algorithm Setup(C)→(Sp, Sv) corresponding to step 3.1, and the proof algorithm Prove(Sp, x, ω)→π corresponding to step 3.2.

[0135] The proof server uploads the proof π to the blockchain corresponding to step 3.3.

[0136] The commissioned user and the unauthorized user obtain S v , π from the blockchain, execute the verification algorithm Verify(Sv, x, π)→Yes / No corresponding to step 4, verify the correctness of the result, and execute the cheating checking strategy of the cheating checking mechanism corresponding to step 5; the commissioned user also needs to download the encrypted result [[ω]] corresponding to step 6, and decrypt the encrypted result using the private key to obtain the computing result.

[0137] In addition, the application also provides a machine readable storage medium, which stores instructions for causing a machine to execute the above-mentioned computing method of the SNARK-based non-interactive publicly verifiable system in the blockchain scenario.

[0138] In addition, the application also provides a processor for running a program, wherein the program is used to execute the above-mentioned computing method of the SNARK-based non-interactive publicly verifiable system in the blockchain scenario when the program is run.

[0139] Those skilled in the art should understand that the embodiments of the application can be provided as a method, a system, or a computer program product. Therefore, the application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the application can be in the form of a computer program product implemented on one or more computer usable storage media containing computer usable program code (including but not limited to disk storage, CD-ROM, optical storage, etc.).

[0140] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0141] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0142] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0143] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0144] The memory can include non-persistent memory and / or volatile memory, such as a random access memory (RAM) including a cache area for the temporary storage of data. The memory can also include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), or electrically erasable programmable read only memory (EEPROM), for the storage of software that is read during runtime. The memory is an example of computer readable media.

[0145] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0146] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not only include those elements, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0147] Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system or computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer usable program code.

[0148] The above merely provides embodiments of the present application and is not intended to limit the present application. Various modifications and changes can be made to the present application by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the scope of the claims of the present application.

Claims

1. A SNARK-based non-interactive publicly verifiable system in a blockchain scenario, characterized in that, The SNARK-based non-interactive publicly verifiable system in the blockchain scenario comprises: A user, provided with a public-private key pair, the input data and the calculation result of the commissioned calculation task are both ciphertexts, and the calculation result is decrypted to obtain the final result under the condition that the calculation result is verified; A calculation server, which completes the calculation task on the ciphertexts, obtains the calculation result ciphertext, and pre-processes the commissioned function to obtain an R1CS program matrix, and finally uploads the calculation result ciphertext and the R1CS program matrix to the blockchain; A proof server, which further processes the R1CS program matrix and a random number R provided by the blockchain to generate two groups of parameters Sp and Sv of the CRS; wherein the random number R is generated by the blockchain, and the random number R is a hash value of a block, and the block contains the calculation result ciphertext uploaded by the calculation server.

2. The method of claim 1, wherein the method of claim 1 is used. The calculation method comprises: Step 1, the user generates a public-private key pair, and uploads the commissioned function f, the input data ciphertext [[x]] and the public key pk to the blockchain; Step 2, the calculation server obtains the commissioned function f and the public key pk from the blockchain, performs calculation on the ciphertexts to obtain the calculation result ciphertext, pre-processes the commissioned function to obtain an R1CS program matrix, and finally uploads the calculation result ciphertext and the R1CS program matrix to the blockchain; Step 3, the proof server generates the CRS by using the R1CS program matrix and the random number provided by the blockchain, wherein Sv can be used as part of the information for the verifier to perform verification calculation, and Sv can be used by the proof server to generate proof information; Step 4, S in the CRP and the proof information π generated by the proof server according to the input of the user to be authenticated v performing verification of information; Step 5, whether to execute the malpractice checking algorithm is judged according to the malpractice checking strategy; Step 6, the commissioned user gets the result cipher-text [[ω]], decrypts it with the private key, and then gets the result plain-text:

3. The method of claim 2, wherein, In step 1, Step 1.1, the commissioned user constructs a linear encryption system: select a domain A cyclic group G with pairing property, a generator g ∈ G, execute the generation algorithm to randomly generate a pair of public and private keys Gen(1 λ )→(pk,sk), the linear encryption system has additive homomorphism and pairing property, and provides technical support for verifying computation under ciphertext. Step 1.2, the commissioned function f, the input information ciphertext [[x]] and the public key pk are uploaded to the blockchain.

4. The method of claim 3, wherein, In step 2, Step 2.1, the calculation server performs calculation on the ciphertexts, and then re-encrypts the result into the calculation result ciphertext [[ω]] under the key pair pk, sk through the key rotation specific to the homomorphic encryption; Step 2.2, preprocessing the function, converting the function corresponding mathematical operation circuit C into R1CS (Rank-1 Constraint System) program will generate three matrices Wherein, m is the number of logic gate circuits, n is the length of (x, ω); according to randomly selected m Van der mon matrix V and its inverse matrix V -1 .

5. The method of claim 4, wherein, In step 3, Step 3.1, generating CRS with the random number R provided by the blockchain and where a set of solutions can be found among the three matrices where x is the plaintext input by the user, ω is the result plaintext, and the Vandermonde matrix V and the inverse matrix V -1 , three time polynomial algorithms P(x), L(x), R(x) corresponding to the three matrices A, B, C can be generated; here the three time polynomial algorithms constitute an SNARG system, denoted as Π = (P(x), L(x), R(x)); first, the polynomial is transformed as follows: where p i (i∈[0,m-1]) is the coefficient of the polynomial, p(i)(i∈[0,m-1]) is the value of the polynomial at i; use the LPCP theorem to bring R, continue to deform the polynomial: P(R) = [1 R 2 ...R m-1 ]V -1 (A·Z) The entire expression is divided into two parts: p(R) = ([1 R 2 ...R m-1 ]V -1 A) · Z = <q1,Z> q1 = [1 R 2 ...R m-1 ]V -1 A Because 1 and x in the vector Z are both public known, q1 can be divided into two parts: Similarly, we can get: The output verifier CRS: The generated verifier CRS should be the encrypted data: The output proof server CRS: Step 3.2, the proof server executes the proof algorithm prove(S p ,[[x]],[[ω]])→π, since the computing server has uploaded the encrypted result [[ω]] to the blockchain, the proof information can be generated by the proof server π = [[a]], [[b]], [[c]] Step 3.3, the verifier CRS: Proof information π = [[a]], [[b]], [[c]] and misbehaviour check parameters are uploaded to the blockchain.

6. The method of claim 5, wherein the SNARK-based non-interactive public verifiability system in a blockchain-based scenario is characterized by, In step 4, The verifier obtains Then, the verifier checks whether the verification equation is equal by using the additive homomorphic operation and the pairing operation in the linear encryption system in combination with the proof information π = [[a]], [[b]], [[c]] generated by the proof server. If the above formula is established, the verification is passed, otherwise the verification is failed.

7. The computation method for a non-interactive, publicly verifiable system based on SNARK in a blockchain scenario according to claim 6, characterized in that, In step 5, Step 5.1, whether to execute the malpractice checking algorithm is judged according to the execution result of step 4, if the verification is failed, the malpractice checking algorithm is executed, if the verification is passed, the random checking algorithm is executed; Step 5.2, the random checking algorithm: whether the random number R is less than the threshold value (the size of the threshold value can be set according to the security level, the higher the security level, the larger the threshold value), if it is less than the threshold value, the malpractice checking algorithm is executed on the last verifiable calculation, if it is greater than or equal to the threshold value, it is considered that the verification is passed; the purpose is to prevent the proof server from cheating, and to use the random number R this time to decide whether to execute the malpractice checking algorithm on the last verifiable calculation, which can effectively realize the randomness of the checking. Step 5.3, Malicious Check Algorithm: Get After encryption, the proof of execution proof information generation process is performed to determine whether it is equal to π generated by the proof server. If they are equal, the algorithm result is true. If they are not equal, the algorithm result is false. 8.A machine readable storage medium having stored thereon instructions for causing a machine to perform the method of computing a SNARK-based non-interactive publicly verifiable system in a blockchain-based scenario according to any one of claims 2-7.

9. A processor, comprising: A program for running, wherein the program is configured to perform the method of computing a SNARK-based non-interactive publicly verifiable system in a blockchain-based scenario according to any one of claims 2-7 when the program is run.

Images