Hardware acceleration method and related device for zero-knowledge proof

Abstract

The present invention relates to the field of data processing, and in particular to a hardware acceleration method and related device for zero-knowledge proof. The method comprises: obtaining a zero-knowledge proof task to be accelerated from a memory; obtaining multiple scalar multiplication tasks from the zero-knowledge proof task; dividing the multiple scalar multiplication tasks based on the maximum number of synchronous tasks that can be executed by the adder to obtain multiple subtasks corresponding to the multiple scalar multiplication tasks; inputting the multiple subtasks into the adder, performing mixed calculations on the multiple subtasks, and obtaining corresponding mixed calculation results; performing serial calculations in the first stage of the mixed calculations, and performing parallel calculations in the second stage; transmitting the mixed calculation results to the memory to complete the hardware acceleration of the multiple scalar multiplication tasks. Through the redivision of multiple scalar multiplication tasks and the mixed calculation strategy, the calculation speed and accuracy of zero-knowledge proof are improved, the hardware operation energy consumption is reduced, and the overall hardware performance of zero-knowledge proof is improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a hardware acceleration method for zero-knowledge proof and a related device. Background Art

[0002] Zero-knowledge proof is a cryptographic technique used to verify the authenticity of a statement without revealing specific information. In simple terms, zero-knowledge proof allows one party (the prover) to prove to another party (the verifier) ​​that they know a certain piece of information without revealing the information itself. For example, proving that you have a password without revealing the password content.

[0003] In related technologies, multi-scalar multiplication (MSM) is involved in zero-knowledge proof. MSM is a key part of encryption protocols and algorithms in zero-knowledge proof. MSM is an elliptic curve encryption operation, which mainly multiplies multiple scalars (usually integers) with multiple elliptic curve points and adds the results together.

[0004] Therefore, it is urgent to design a technical solution to achieve hardware acceleration of MSM and improve the overall performance of zero-knowledge proof. Summary of the invention

[0005] In view of the technical problems existing in the prior art, the present invention provides a hardware acceleration method and related devices for zero-knowledge proof, so as to improve the computing efficiency of MSM through hardware acceleration and improve the overall hardware performance when executing zero-knowledge proof.

[0006] In a first aspect, an embodiment of the present application provides a hardware acceleration method for zero-knowledge proof, the method being applied to a hardware system for executing zero-knowledge proof, the hardware system comprising at least a memory and an adder; the method comprising:

[0007] Obtaining a zero-knowledge proof task to be accelerated from a memory;

[0008] Acquire a multiple scalar multiplication task from the zero-knowledge proof task; the multiple scalar multiplication task includes multiple addition operations;

[0009] Based on the maximum number of synchronous tasks executable by the adder, the multiple scalar multiplication task is divided to obtain a plurality of subtasks corresponding to the multiple scalar multiplication task;

[0010] Input the multiple subtasks into an adder, perform mixed calculations on the multiple subtasks, and obtain corresponding mixed calculation results; in the mixed calculation, serial calculations are performed in the first stage, and parallel calculations are performed in the second stage;

[0011] The mixed calculation result is transmitted to a memory to complete the hardware acceleration of the multiple scalar multiplication task.

[0012] In a second aspect, an embodiment of the present application provides a hardware acceleration device for zero-knowledge proof, which is applied to a hardware system for executing zero-knowledge proof, wherein the hardware system at least includes a memory and an adder; the device includes the following units:

[0013] An acquisition unit, configured to acquire a zero-knowledge proof task to be accelerated from a memory;

[0014] An extraction unit is configured to obtain a multiple scalar multiplication task from the zero-knowledge proof task; the multiple scalar multiplication task includes multiple addition operations;

[0015] The operation unit is configured to divide the multiple scalar multiplication tasks based on the maximum number of synchronous tasks that can be executed by the adder to obtain multiple subtasks corresponding to the multiple scalar multiplication tasks; input the multiple subtasks into the adder, perform mixed calculations on the multiple subtasks, and obtain corresponding mixed calculation results; perform serial calculations in the first stage of the mixed calculations and perform parallel calculations in the second stage; and transmit the mixed calculation results to the memory to complete the hardware acceleration of the multiple scalar multiplication tasks.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising:

[0017] at least one processor, memory, and input-output unit;

[0018] The memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the hardware acceleration method of zero-knowledge proof of the first aspect.

[0019] In a fourth aspect, a computer-readable storage medium is provided, which includes instructions, and when the instructions are executed on a computer, the computer executes the hardware acceleration method of zero-knowledge proof of the first aspect.

[0020] The beneficial effect of the present invention is: a hardware acceleration method and related device for zero-knowledge proof are provided. In the technical scheme, a hardware system for executing zero-knowledge proof is applied, and the hardware system at least includes a task control module, a memory, and an adder, and the method is applied to the task control module. First, the zero-knowledge proof task to be accelerated is obtained from the memory. Secondly, a multiple scalar multiplication task is obtained from the zero-knowledge proof task, and the multiple scalar multiplication task contains multiple addition operations. Then, based on the maximum number of synchronous tasks that can be executed by the adder, the multiple scalar multiplication task is divided to obtain multiple subtasks corresponding to the multiple scalar multiplication task. Then, the multiple subtasks are input into the adder, and mixed calculations of the multiple subtasks are performed to obtain corresponding mixed calculation results. Among them, the first stage of the mixed calculation performs serial calculations, and the second stage performs parallel calculations. Finally, the mixed calculation results are transmitted to the memory to complete the hardware acceleration of the multiple scalar multiplication tasks. This solution significantly improves the computing speed and accuracy of zero-knowledge proof through the redistribution of multiple scalar multiplication tasks and hybrid computing strategies, optimizes resource utilization, reduces hardware computing energy consumption, and improves the overall hardware performance, flexibility and scalability of zero-knowledge proof. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flowchart of a hardware acceleration method for zero-knowledge proof according to an embodiment of the present application;

[0022] Figure 2 It is a schematic diagram of the principle of a hardware acceleration method of an embodiment of the present application;

[0023] Figure 3 It is a schematic diagram of the principle of a fast multiplication algorithm of the related technology;

[0024] Figure 4 It is a schematic diagram of the principle of an optimization algorithm of the related technology;

[0025] Figure 5 It is a schematic diagram of the principle of a hardware acceleration algorithm of an embodiment of the present application;

[0026] Figure 6 It is a structural diagram of a hardware acceleration device for zero-knowledge proof in an embodiment of the present application;

[0027] Figure 7 is a schematic diagram of the structure of an electronic device according to an embodiment of the present application;

[0028] Figure 8 It is a structural schematic diagram of a medium device according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0030] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0031] In the description of the present application, the term "for example" is used to mean "used as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid unnecessary details to obscure the description of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0032] The embodiments of the present application provide a hardware acceleration method and related devices for zero-knowledge proof, which are used to improve the computing efficiency of MSM through hardware acceleration and improve the overall hardware performance when executing zero-knowledge proof.

[0033] In the technical solution provided by the present application, a hardware system for executing zero-knowledge proof is provided, and the hardware system includes at least a task control module, a memory, and an adder. First, the task control module obtains the zero-knowledge proof task to be accelerated from the memory. Secondly, a multiple scalar multiplication task is obtained from the zero-knowledge proof task, and the multiple scalar multiplication task contains multiple addition operations. Then, based on the maximum number of synchronous tasks that can be executed by the adder, the multiple scalar multiplication task is divided to obtain multiple subtasks corresponding to the multiple scalar multiplication task. Then, the multiple subtasks are input into the adder, and mixed calculations of the multiple subtasks are performed to obtain corresponding mixed calculation results. Among them, the first stage of the mixed calculation performs serial calculations, and the second stage performs parallel calculations. Finally, the mixed calculation results are transmitted to the memory to complete the hardware acceleration of the multiple scalar multiplication tasks.

[0034] In the technical solution provided in this application, the calculation speed and accuracy of zero-knowledge proof are significantly improved through the redivision of multiple scalar multiplication tasks and hybrid computing strategies, resource utilization is optimized, hardware computing energy consumption is reduced, and the flexibility and scalability of the zero-knowledge proof hardware acceleration system are improved.

[0035] In the technical solution provided by the present application, the solution effectively improves the operation speed of zero-knowledge proof through the collaborative work of the task control module, the memory and the adder. Specifically, the method obtains the zero-knowledge proof task that needs to be accelerated from the memory and extracts the multiple scalar multiplication tasks therein. The adder is used to perform efficient addition operations, thereby significantly improving the calculation speed. According to the maximum number of simultaneous tasks that the adder can execute, the multiple scalar multiplication tasks are divided into several subtasks, and parallel calculations are performed in the second stage, making full use of hardware resources, improving calculation efficiency, and reducing calculation time.

[0036] The task control module is responsible for task acquisition, division and scheduling, so that the computing tasks can be effectively assigned to the adder for execution, avoiding resource waste and computing redundancy. A hybrid computing strategy is adopted, which performs serial computing in the first stage and parallel computing in the second stage, ensuring the optimal use of hardware resources in different stages, thereby ensuring efficient computing. In addition, by dynamically dividing multiple scalar multiplication tasks into multiple subtasks, the system can be adjusted according to different task requirements and has good flexibility.

[0037] The hardware system consists of modules such as task control module, memory and adder. The collaborative work between modules improves the scalability of the system, and modules can be added, subtracted or replaced according to needs. Compared with serial computing, parallel computing can complete tasks more quickly under the same task volume, reduce computing time and reduce overall energy consumption. Through the optimized scheduling of the task control module, the adder can always maintain an efficient working state, avoid idle resources, and further reduce energy consumption. The calculations performed by dedicated hardware accelerators (such as adders) are more accurate and stable than software implementations, reducing errors. The task control module can accurately divide and schedule tasks, ensure the correct execution of each subtask, and improve the overall calculation accuracy.

[0038] The hardware acceleration method scheme for zero-knowledge proof provided in the embodiment of the present application can also be executed by an electronic device, which can be a server, a server cluster, or a cloud server. The electronic device can also be a terminal device such as a mobile phone, a computer, a tablet computer, a wearable device, or a dedicated device (such as a dedicated terminal device with a hardware acceleration device for zero-knowledge proof, etc.). These electronic devices can also be equipped with the chips introduced in the above embodiments. Alternatively, these electronic devices can also be installed with a service program for executing the hardware acceleration method scheme for zero-knowledge proof.

[0039] Figure 1 A flowchart of a hardware acceleration method for zero-knowledge proof provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method comprises the following steps:

[0040] 101, obtaining a zero-knowledge proof task to be accelerated from a memory;

[0041] 102, obtaining a multiple scalar multiplication task from the zero-knowledge proof task; the multiple scalar multiplication task includes multiple addition operations;

[0042] 103, dividing the multiple scalar multiplication task based on the maximum number of synchronous tasks executable by the adder to obtain a plurality of subtasks corresponding to the multiple scalar multiplication task;

[0043] 104, input the multiple subtasks into an adder, perform mixed calculations on the multiple subtasks, and obtain corresponding mixed calculation results; in the mixed calculation, serial calculations are performed in the first stage, and parallel calculations are performed in the second stage;

[0044] 105 , transmitting the mixed calculation result to a memory to complete the hardware acceleration of the multiple scalar multiplication task.

[0045] In the embodiments of the present application, zero-knowledge proof is a cryptographic technique used to verify the authenticity of a statement without revealing specific information. In simple terms, zero-knowledge proof allows one party (the prover) to prove to another party (the verifier) ​​that they know certain information without revealing the information itself. For example, it can prove that one party has a password without revealing the password content.

[0046] Among them, Multi-Scalar Multiplication (MSM) is a common operation in elliptic curve cryptography. It mainly multiplies multiple scalars (usually integers) with multiple elliptic curve points and adds the results together. MSM is a key part of many encryption protocols and algorithms, including zero-knowledge proofs.

[0047] In the embodiment of the present application, the above method steps are applied to a hardware system for performing zero-knowledge proof. The hardware system includes at least a memory and an adder. The hardware system achieves efficient acceleration of complex computing tasks through the collaborative work of dedicated hardware modules. The core components of the hardware system include a memory and an adder, which work together to support efficient task processing and computing execution.

[0048] The memory module plays the role of data storage and task management in the system. The memory is used to store the zero-knowledge proof tasks to be accelerated. All the data to be processed and the intermediate calculation results are stored here to provide data support for the accelerator. During the task execution, the memory module acts as a data cache to increase the data access speed and reduce the data transmission delay. After the calculation task is executed, the memory receives and stores the calculation results to provide a basis for subsequent operations.

[0049] The adder is the core computing component in the system, dedicated to processing addition operations in multiple scalar multiplication tasks. The adder is responsible for receiving subtask data from the memory and performing addition operations according to task requirements. Through efficient hardware design, the adder can quickly complete complex addition calculations. During execution, the adder supports serial and parallel computing, and can simultaneously process multiple subtasks in parallel computing, maximizing the use of hardware resources and improving computing efficiency. The adder supports hybrid computing strategies, including serial computing and parallel computing stages, to optimize resource usage under different task types.

[0050] The above steps 101 to 105 can be applied to the task control module, or can also be performed by other devices. The task control module is a key component responsible for managing and scheduling the execution of zero-knowledge proof tasks. The task control module plays a central role in the entire hardware acceleration process, coordinating the work of each module to ensure that the computing task can be completed efficiently and accurately. In practical applications, the task control module can also be integrated in other devices, such as an adder. Alternatively, other devices are used to implement the functions of the task control module, which is not limited by this application.

[0051] In 101, a zero-knowledge proof task to be accelerated is obtained from a memory.

[0052] As an optional embodiment, a query request is first initiated to the memory to obtain the zero-knowledge proof task to be accelerated. The query request contains a task identifier or other relevant information to locate specific task data. Further optionally, the task data stored in the memory usually has a unique identifier, and the task control module uses this identifier to accurately query the corresponding task. Then, the memory reads the corresponding zero-knowledge proof task data according to the query request of the task control module. These data may include a description of the task, input parameters required for calculation, multiple scalar multiplication tasks, etc. The read task data is transmitted to the task control module via a system bus or other communication interface. After receiving the task data, a preliminary check is performed to ensure data integrity and correctness. For example, check whether the data is damaged, whether the task format meets expectations, etc. Exemplarily, the task control module parses the task data and extracts the specific content and details of the task. This includes extracting multiple scalar multiplication tasks and related input parameters.

[0053] To improve the efficiency of subsequent processing, the task control module may cache the parsed task data for quick access and processing. The cache mechanism helps reduce frequent data reading operations and improve the overall performance of the system. The task control module marks the prepared task data as pending to prepare for subsequent task division and scheduling.

[0054] In step 101, obtaining the zero-knowledge proof task to be accelerated from the memory is the first step in the system computing process. The task control module provides a basis for subsequent task division and scheduling by querying, reading, parsing and caching task data. The efficient execution of this process ensures that the system can quickly enter the task processing stage and achieve the goal of hardware acceleration.

[0055] In 102, a multiple scalar multiplication task is obtained from the zero-knowledge proof task. The multiple scalar multiplication task includes multiple addition operations.

[0056] As an optional embodiment, the data format of the zero-knowledge proof task is first parsed to identify the structure and content of the task. A zero-knowledge proof task usually contains multiple subtasks, each of which may contain multiple scalar multiplication operations. Scalars and base points are extracted from the task data. Scalars are specific numerical values, and base points are usually points on elliptic curves or other mathematical structures. After parsing the task data, the task control module identifies which subtasks belong to multiple scalar multiplication tasks. These tasks usually have specific tags or structures for easy identification and extraction. The addition operation in the multiple scalar multiplication task needs to be clearly identified. The task control module identifies the addition operation that needs to be performed by parsing the mathematical expression or task description.

[0057] To facilitate subsequent processing, the task control module subdivides the multiple scalar multiplication task into smaller subtasks. These subtasks usually contain multiple addition operations to facilitate efficient calculation by the adder module. According to the nature and number of the addition operations, they are combined into small task packages suitable for mixed calculations composed of parallel and serial components. These small task packages will be input into the adder for calculation. The specific division method is shown in step 103 below.

[0058] It is understandable that multiple scalar multiplication tasks usually exist in the form of mathematical expressions. The task control module needs to have the ability to parse these expressions in order to correctly identify and extract addition operations. The storage and management of task data adopts structured data formats, such as lists, arrays, or custom binary formats, for fast access and processing. Depending on the complexity of the task and system resources, the task control module can adopt different optimization strategies, such as task decomposition, parallel processing, etc., to improve computing efficiency.

[0059] In the related art, multi-scalar multiplication (MSM) is an important step in zero-knowledge proof. This step occupies most of the computational processing time of proof generation time. Therefore, improving the processing speed of MSM can significantly improve the speed of proof generation. For example, assume that the following formula needs to be calculated in MSM: Where n is the problem size, i.e. the total number of scalars and points. r is the number of buckets when using the Pippenger method. is a scalar and P is a point on the elliptic curve. is the i-th point on the elliptic curve, is the scalar corresponding to the i-th point on the elliptic curve. Further, in order to optimize this calculation, especially when using the Pippenger algorithm, it can be further decomposed into the following formula:

[0060]

[0061]

[0062]

[0063] Among them, k is the index value of the bucket, is the set of points in bucket k, express The scalar value of is equal to the set value of all points. This formula represents the bucket partitioning process. The bucket partitioning here is to classify all points according to their scalar value k, and gather all the points with scalar value k together to form a bucket. The bucketing step is to reduce computational complexity. By grouping all points with the same scalar into one bucket, these points can be processed together in subsequent steps. This can effectively reduce repeated calculations, especially in the Pippenger algorithm, where the parameter value of the number of buckets (r) is mainly selected to optimize computational efficiency.

[0064] is the weighted result of bucket k, Represents the set of points in bucket k Each point in the bucket is scaled by the scalar k. In the bucket weighting step, the set of points in each bucket is weighted, and all the points in the bucket are multiplied by the corresponding scalar value k to obtain the weighted bucket. . This step integrates the points in the bucket into the final result.

[0065] Represents the result of multiple scalar multiplication. That is, the weighted result of all buckets The sum is performed to obtain the final MSM operation result.

[0066] For example, suppose there are three points P1, P2, and P3, and the corresponding scalars are a1, a2, and a3. Assume a1 = 2, a2 ​​= 2, and a3 = 3. Assume the number of buckets r = 2. Based on the above assumptions, divide P1, P2, and P3 into two buckets, for example, divide P1 and P2 into buckets according to the scalar value In the example, P3 is divided into buckets In. Perform bucket weighting, that is: , Finally, the weighted results of all buckets are summed to obtain the final calculation result, that is, .

[0067] In the related art, the MSM can be efficiently calculated by the above-mentioned Pippenger algorithm, especially when processing a large number of scalars and points, the complexity of the calculation is reduced by bucket division and weighting.

[0068] However, in the hardware computing scenario of zero-knowledge proof, the second weighted step of computing is When calculating T, each T needs to be calculated separately, which consumes a lot of computing resources and has low computing efficiency. In the related technology, a fast multiplication algorithm can be used on the hardware to calculate The algorithm flow is as follows:

[0069] T = 0

[0070] while(k != 0):

[0071] if((k&1) == 1):

[0072] T = B + T

[0073] B = B + B

[0074] k>>= 1

[0075] In the related art, it is assumed that r = 2 C , combined with the above process, the total number of addition operations that MSM needs to perform is: .

[0076] In the related art, another optimization algorithm process is as follows:

[0077] R(r-1) = B(r-1)

[0078] for k = (r-2) to 1 do

[0079] R(k) = R(k+1) + B(k)

[0080] Among them, B(k) is the value of the point in the kth bucket. The number of additions required by the optimized algorithm is: In addition, in the related art, there is the following relationship with the unoptimized method: .

[0081] The applicant found that for the fast multiplication algorithm, the number of addition operations that need to be performed is too large. When the module that performs the addition operation of each point on the elliptic curve (also known as the point adder) supports parallel computing, when it is necessary to use this parallel feature, the lowest bit of all scalars is processed first, and then the second lowest bit of all scalars is processed. In addition, additional storage space is required to store intermediate variables, that is, the result of the step B = B + B and the result of T = B + T need to be stored, which means that the storage space required is twice as much as the original.

[0082] Although the number of addition operations required by the optimized algorithm is greatly reduced and no additional storage space is required, each addition operation depends on the previous addition operation, so that only one addition operation can be performed at a time, which makes it incompatible with parallel situations. In other words, even if the point adder supports parallel operations, or there are multiple point adders, the algorithm cannot be used.

[0083] In order to solve the above technical problems existing in the related art, in the embodiment of the present application, for the second step, optimize The calculation steps are combined with a hybrid calculation method that combines serial and parallel calculations, which greatly improves the calculation efficiency on hardware.

[0084] The hybrid computing method is implemented by using steps 103 and 104. MSM optimizes performance by dividing a task into multiple subtasks and performing hybrid computing in an adder.

[0085] In 103, based on the maximum number of synchronous tasks executable by the adder, the multiple scalar multiplication task is divided to obtain a plurality of subtasks corresponding to the multiple scalar multiplication task.

[0086] Specifically, according to the maximum number of simultaneous tasks of the adder, the multiple scalar multiplication task is decomposed into multiple subtasks for easy processing. For example, if the adder can process 8 addition operations at a time, then if the multiple scalar multiplication task contains 80 addition operations, it can be divided into 10 subtasks.

[0087] Each subtask contains a set of addition operations, and the total number does not exceed the maximum number of simultaneous tasks. This ensures that the amount of computation of each subtask is within the range that the adder can handle.

[0088] As an optional embodiment, in 103, based on the maximum number of synchronous tasks that can be executed by the adder, the multiple scalar multiplication tasks are divided to obtain multiple subtasks corresponding to the multiple scalar multiplication tasks, which can be implemented as follows:

[0089] Acquire configuration information of adders in the current hardware system to determine the maximum number of synchronous tasks; and divide the multiple scalar multiplication task into a plurality of subtasks based on the total number of tasks in the multiple scalar multiplication task and the maximum number of synchronous tasks, wherein the total number of subtasks is greater than or equal to the maximum number of synchronous tasks.

[0090] Further, the number of computing tasks included in each subtask is determined by the maximum number of synchronous tasks. The number of computing tasks included in each subtask is less than or equal to the ratio between the total number of tasks in the multiple scalar multiplication task and the maximum number of synchronous tasks. Optionally, the number of computing tasks included in the last subtask is less than the ratio. The unoccupied computing resources in the last subtask are used to perform non-addition operations.

[0091] Specifically, when the system starts or in the task initialization phase, the detailed configuration information of the adder is obtained through the hardware interface or the configuration file. The maximum number of synchronous tasks that the adder can process simultaneously is extracted from the configuration information. For example, the configuration of the adder may show that 8 addition operations can be processed simultaneously in each clock cycle. According to the obtained adder configuration information, its maximum synchronous task capability is determined. This capability refers to the number of independent addition tasks that the adder can process in one clock cycle, for example, 8. The total number of tasks involved in the multiple scalar multiplication task is calculated. For example, the total number of addition operations included in the task is 80. Based on the maximum number of synchronous tasks of the adder, the total number of tasks is divided into multiple subtasks. The total number of subtasks must be greater than or equal to the maximum number of synchronous tasks in order to better utilize the computing power of the adder.

[0092] The number of subtasks is determined based on the total number of tasks and the maximum number of simultaneous tasks. For example, if the total number of tasks is 80 and the adder can handle 8 addition operations at a time, then the number of subtasks is at least 10. Furthermore, the 80 addition operations are divided into 10 subtasks, each of which contains 8 addition operations. In this way, each subtask can be processed independently and within the maximum number of simultaneous tasks that the adder can handle.

[0093] For example, each subtask includes a set of addition operations. For example, subtask 1 may include calculating , subtask 2 includes calculating , and so on. These subtasks are processed in parallel in the adder, and the calculation of each subtask can be completed in one or more clock cycles. Then, the calculation results of all subtasks are aggregated to obtain the final multiple scalar multiplication result. Assume an MSM task as follows: Based on this, the maximum number of synchronous tasks for the adder is 8. 80 addition operations require at least 10 subtasks (each subtask contains 8 addition operations). Then, the subtasks obtained by division include the following: Subtask 1: ; Subtask 2: ; ...; Subtask 3: .

[0094] Through the above method, the MSM task is reasonably divided into multiple subtasks so that the adder can efficiently process each subtask. Such division not only makes the computational amount of each subtask within the processing capacity of the adder, but also optimizes the parallelism and efficiency of the computation. This processing method can give full play to the computing power of the hardware and improve the overall computing performance.

[0095] In 104, the multiple subtasks are input into an adder, and mixed calculations of the multiple subtasks are performed to obtain corresponding mixed calculation results.

[0096] In the embodiment of the present application, the first stage of hybrid computing performs serial computing, and the second stage performs parallel computing. The following is a detailed description of these two stages.

[0097] In the first stage, some preliminary calculations or preprocessing operations are performed in sequence. Usually, these operations include: data preparation and preliminary calculations. Specifically, the data in the subtasks are first sorted and preprocessed to make them suitable for subsequent parallel calculations. Then, some calculations that need to be performed in sequence are performed, such as the accumulation or aggregation of intermediate results.

[0098] For example, if there is a set of addition operations that need to be calculated, the serial calculation stage can be used to handle certain operations with strong dependencies and ensure that the data is ready before entering the parallel calculation stage. Extract the required parts from multiple subtasks and organize them into a format suitable for parallel calculation. Perform some preliminary operations, such as merging scalar and point data into an intermediate result.

[0099] In the second stage, the parallel computing capability of the adder is used to process multiple subtasks at the same time, thereby improving the computing efficiency. First, the previously generated subtasks are input into multiple adders at the same time, and the parallel computing capability of the adder is used for fast computing. Then, the computing results of each subtask are aggregated into the final result.

[0100] For example, each subtask is assigned to an adder and the calculations are performed simultaneously. The addition operations in the subtasks are processed in parallel in the adder. Finally, the results of all parallel calculations are aggregated to obtain the final calculation result.

[0101] It is worth noting that in 104, by dividing the multiple scalar multiplication tasks into multiple subtasks and using a combination of serial and parallel computing in hybrid computing, the computing efficiency can be effectively improved. The serial computing stage is responsible for data preparation and preliminary calculations, while the parallel computing stage makes full use of the parallel capability of the adder for acceleration.

[0102] As an optional embodiment, in 104, the multiple subtasks are input into an adder, and mixed calculations of the multiple subtasks are performed to obtain corresponding mixed calculation results, see below. Figure 2 As shown, it can be implemented as:

[0103] 201, in the first stage, for each subtask, the intermediate results corresponding to each position in the subtask are calculated in turn, and the target intermediate results of each subtask are accumulated;

[0104] 202, in the second stage, for the subtasks ranked before the last one in the serial calculation process, weighted accumulation operation is synchronously performed on the target intermediate result of each subtask and the input value in the current elliptic curve to obtain a mixed calculation result of each subtask; and,

[0105] 203, for the subtask ranked last in the serial calculation process, weighted accumulation operation is performed on the target intermediate result of each subtask to obtain a mixed calculation result of each subtask.

[0106] Further optionally, in the first stage, in 201, for each subtask, the intermediate results corresponding to each position in each subtask are calculated in turn. Then, after the intermediate results corresponding to each position are calculated, the first intermediate result of the previous position is added to the second intermediate result of the current position calculated, and the accumulated third intermediate result is stored in the auxiliary bit corresponding to each subtask. The auxiliary bit is a temporary storage area for storing the accumulated results calculated at each position for use in the subsequent parallel calculation stage. After the calculation and accumulation of the current position are completed, the parallel calculation results are written into the corresponding auxiliary bits to facilitate subsequent parallel calculations or result aggregation.

[0107] For example, assume that the number of tasks r = 32768, that is, c = 15, m = 150, t = 150. Then, the number of subtasks is 150, the same as the value of m, the length of each subtask is 219, and the length of the last subtask is 137. Assuming that the subscript value starts from 0 to divide the subtask, the subscript range from 32549 to 32768 corresponds to the first subtask, the subscript range from 32330 to 32549 corresponds to the second subtask, and so on, the subscript range from 137 to 356 corresponds to the 149th subtask, and the 150th subtask corresponds to the subscript range from 0 to 137.

[0108] In the first stage, the first cycle calculates R(32767) + B(32766) of the first subtask, the second cycle calculates R(32548) + B(32547) of the second subtask, and so on, and the 150th cycle calculates R(136) + B(135). In the 151st cycle, the result R(32766) = R(32767)+B(32766), so R(32765) = R(32766) + B(32765) is calculated in the 151st cycle.

[0109] Compared with the fast multiplication algorithm in the related art, the embodiment of the present application does not require additional memory to store the target intermediate result obtained in the first stage, but uses other positions (i.e. auxiliary bits) of the original memory. In addition, in the last calculation process of T = T + B in the embodiment of the present application, it is necessary to determine whether it is the last calculation of T = T + B.

[0110] In the first stage, assume that the number of tasks is r = 2 C , the point adder can process m addition operations at the same time, and the number of cycles required to process a complete addition operation is t. Where c, m, and t are all positive integers, and Then, the MSM task is divided into m subtasks, and the number of tasks in each subtask is , usually, the number of the last subtask will be insufficient , then, some meaningless calculations can be inserted into the insufficient part to occupy the position. The subtasks are serial inside, while the subtasks are parallel, so that the parallelism of the point adder can be fully utilized.

[0111] That is, the time required to complete one subtask is similar to the time required to complete all subtasks. The process is expressed as the following formula:

[0112]

[0113] In the second stage, in 202, for the subtasks ranked before the last one in the serial calculation process, a weighted accumulation operation is synchronously performed on the target intermediate result of each subtask and the input value in the current elliptic curve to obtain a mixed calculation result of each subtask.

[0114] In 203, for the subtask ranked last in the serial calculation process, a weighted accumulation operation is performed on the target intermediate result of each subtask to obtain a mixed calculation result of each subtask.

[0115] In the second stage, the hybrid calculation results are calculated The process is expressed as the following formula:

[0116]

[0117] In the second stage, As an auxiliary bit, it is used to store intermediate data. Store the result of step B = B + B, and Store the result of step T = T + B.

[0118] It should be noted that the last T = T + B in the second stage does not need to be calculated, and the number of subtasks in the second stage is m-1, because the lowest-order subtask is actually , that is, a multiplication operation of 1 is performed.

[0119] After executing step 103 and step 104, the effect to be achieved in the second stage is: In this equation, the left side of the equation is the data before the second stage, and the right side of the equation is the data after the second stage. After executing the above steps, the second stage can meet the following conditions, namely: .

[0120] If a complete addition cycle is used as a unit, the number of addition cycles required by the fast multiplication algorithm in the related art is: The number of addition cycles required by another optimization algorithm flow in the related art is: .

[0121] It is understandable that in the embodiment of the present application, the number of mixed computing cycles required for multiple subtasks is for: ;in, is the total number of tasks, is the maximum number of synchronization tasks, Is a positive integer.

[0122] Obviously, it can be seen that the number of hybrid computing cycles required by the embodiment of the present application is much smaller than the other two algorithms in the related art. Furthermore, the number of hybrid computing cycles required by the embodiment of the present application is proportional to the actual number of cycles.

[0123] In 105, the mixed calculation result is transmitted to a memory to complete the hardware acceleration of the multiple scalar multiplication task.

[0124] As an optional embodiment, in 105, the mixed calculation result is transmitted to the memory, which is an important link in realizing hardware acceleration of multiple scalar multiplication tasks. In the aforementioned steps, the mixed calculation result of each subtask is obtained by performing weighted accumulation operation on the target intermediate result of the subtask and the elliptic curve input value. These results represent the final output of each subtask in the calculation process, usually a numerical value or a group of numerical values, which have combined the target intermediate result and the input value of the elliptic curve. The mixed calculation result is generated by a parallel computing unit or a serial computing unit in the hardware accelerator.

[0125] In 105, these mixed calculation results are transferred to the memory, which can be a hardware storage unit in various forms, such as a register, a cache, or a larger external memory (such as RAM). The mixed calculation results are transferred to the memory via a high-speed data bus. The high-speed bus can ensure the rapid transfer of data between the computing unit and the memory, reducing latency. In some hardware implementations, a DMA (direct memory access) controller may be used to transfer the mixed calculation results to avoid direct intervention by the CPU, thereby improving transmission efficiency. For calculation results that need to be accessed quickly, the results can be stored in registers. These registers may be directly connected to the computing unit or the memory interface. If the results need to be accessed multiple times in a short period of time, they can be stored in a cache to increase the access speed. For larger-scale computing tasks, the mixed calculation results can be stored in an external memory, such as DDR RAM, for further processing in subsequent stages.

[0126] Transferring mixed computation results to memory is a key step in the hardware acceleration process because it allows the computation results to be quickly accessed and used. Since the mixed computation results are generated by the parallel computing units of the hardware accelerator, this parallel processing method can greatly improve the processing speed of multiple scalar multiplication tasks. By directly transferring to memory, the delay of intermediate processing is reduced, making the computation results quickly available for subsequent processing steps.

[0127] The mixed calculation results in the memory can be quickly accessed by other hardware units for further calculation or output. These stored results can be read by subsequent processing units (such as accumulators, decoding units, etc.) to further complete the final output of the multiple scalar multiplication task.

[0128] The core of step 105 is to transfer the mixed calculation results from the computing unit to the memory. This process is completed through a high-speed transmission mechanism (such as a bus or DMA), and the calculation results are stored in a suitable storage medium, providing a solid foundation for hardware acceleration of multiple scalar multiplication tasks. This design not only improves the calculation speed, but also optimizes the storage and access efficiency, and is a key step in achieving hardware acceleration.

[0129] In the actual example, it is assumed that r = 16 and m = 3. Based on this, the specific process of the fast multiplication algorithm in the related art can be found in Figure 3 As shown. Figure 3 In FIG. 1 , dark gray represents an addition operation, and light gray represents a memory copy operation. The number of addition cycles required for the fast multiplication algorithm in the related art is 19.

[0130] Based on the above assumptions, the specific process of another optimization algorithm in the related art can be found in Figure 4 As shown. Figure 4 In the figure, dark gray represents an addition operation, and light gray represents a memory copy operation. The number of addition cycles required by the other optimized algorithm is 14.

[0131] Continuing on the above assumptions, compared with the fast multiplication algorithm in the related art, an example process of an embodiment of the present application is as follows: Figure 5 As shown. Figure 5 In the figure, dark gray indicates an addition operation, and light gray indicates a memory copy operation. The number of addition cycles required in this example is 9. The data in the second stage of this example is special, but in extreme cases, the total number of addition cycles required is 11.

[0132] In an embodiment of the present application, a hardware acceleration method for zero-knowledge proof is provided, which is applied to a hardware system for executing zero-knowledge proof, and the hardware system at least includes a task control module, a memory, and an adder. First, the task control module obtains the zero-knowledge proof task to be accelerated from the memory. Secondly, a multiple scalar multiplication task is obtained from the zero-knowledge proof task, and the multiple scalar multiplication task contains multiple addition operations. Then, based on the maximum number of synchronous tasks that can be executed by the adder, the multiple scalar multiplication task is divided to obtain multiple subtasks corresponding to the multiple scalar multiplication task. Then, the multiple subtasks are input into the adder, and a mixed calculation of the multiple subtasks is performed to obtain a corresponding mixed calculation result. Among them, the first stage of the mixed calculation performs serial calculation, and the second stage performs parallel calculation. Finally, the mixed calculation result is transmitted to the memory to complete the hardware acceleration of the multiple scalar multiplication task. This method significantly improves the calculation speed and accuracy of zero-knowledge proof through the redivision of multiple scalar multiplication tasks and the mixed calculation strategy, optimizes resource utilization, reduces hardware computing energy consumption, and improves the flexibility and scalability of the zero-knowledge proof hardware acceleration system.

[0133] In another embodiment of the present application, a hardware acceleration device for zero-knowledge proof is provided, which is applied to a hardware system for executing zero-knowledge proof, wherein the hardware system at least includes a memory and an adder; see Figure 6 The hardware acceleration device comprises the following units:

[0134] An acquisition unit, configured to acquire a zero-knowledge proof task to be accelerated from a memory;

[0135] An extraction unit is configured to obtain a multiple scalar multiplication task from the zero-knowledge proof task; the multiple scalar multiplication task includes multiple addition operations;

[0136] The operation unit is configured to divide the multiple scalar multiplication tasks based on the maximum number of synchronous tasks that can be executed by the adder to obtain multiple subtasks corresponding to the multiple scalar multiplication tasks; input the multiple subtasks into the adder, perform mixed calculations on the multiple subtasks, and obtain corresponding mixed calculation results; perform serial calculations in the first stage of the mixed calculations and perform parallel calculations in the second stage; and transmit the mixed calculation results to the memory to complete the hardware acceleration of the multiple scalar multiplication tasks.

[0137] Further optionally, the operation unit divides the multiple scalar multiplication tasks based on the maximum number of synchronous tasks executable by the adder to obtain a plurality of subtasks corresponding to the multiple scalar multiplication tasks, and is configured as follows:

[0138] Obtain configuration information of the adder in the current hardware system to determine the maximum number of synchronization tasks;

[0139] Based on the total number of tasks in the multiple scalar multiplication task and the maximum number of synchronous tasks, the multiple scalar multiplication task is divided into a plurality of subtasks; wherein the total number of subtasks is greater than or equal to the maximum number of synchronous tasks.

[0140] Further optionally, the number of computing tasks included in each subtask is determined by the maximum number of synchronization tasks.

[0141] Further optionally, the number of computing tasks included in each subtask is less than or equal to the ratio between the total number of tasks in the multiple scalar multiplication task and the maximum number of synchronous tasks.

[0142] Further optionally, the number of computing tasks included in the last subtask is smaller than the ratio.

[0143] Further optionally, unoccupied computing resources in the last subtask are used to perform non-addition operations.

[0144] Further optionally, the computing unit inputs the multiple subtasks into an adder, performs mixed calculations on the multiple subtasks, and obtains corresponding mixed calculation results, and is configured as follows:

[0145] In the first stage, for each subtask, the intermediate results corresponding to each position in the subtask are calculated in turn, and the target intermediate results of each subtask are accumulated;

[0146] In the second stage, for the subtasks ranked before the last one in the serial calculation process, weighted accumulation operation is synchronously performed on the target intermediate result of each subtask and the input value in the current elliptic curve to obtain the mixed calculation result of each subtask; and,

[0147] For the subtask that ranks last in the serial calculation process, a weighted accumulation operation is performed on the target intermediate results of each subtask to obtain a mixed calculation result of each subtask.

[0148] Further optionally, the computing unit, in the first stage, sequentially calculates the intermediate results corresponding to each position in the subtask for each subtask, and accumulates the target intermediate results of each subtask, and is configured as follows:

[0149] For each subtask, calculate the intermediate results corresponding to each position in each subtask in turn;

[0150] After the intermediate result corresponding to each position is calculated, the first intermediate result of the previous position is accumulated to the calculated second intermediate result of the current position, and the accumulated third intermediate result is stored in the auxiliary bit corresponding to each subtask.

[0151] Further optionally, the number of mixed computing cycles required by the multiple subtasks is for: ;in, is the total number of tasks, is the maximum number of synchronization tasks, Is a positive integer.

[0152] The system can implement various steps in the above method embodiment, which will not be expanded here.

[0153] In an embodiment of the present application, the zero-knowledge proof task to be accelerated is obtained from the memory by the above-mentioned device. Secondly, a multiple scalar multiplication task is obtained from the zero-knowledge proof task, and the multiple scalar multiplication task contains multiple addition operations. Then, based on the maximum number of synchronous tasks that can be executed by the adder, the multiple scalar multiplication task is divided to obtain multiple subtasks corresponding to the multiple scalar multiplication task. Then, the multiple subtasks are input into the adder, and the mixed calculation of the multiple subtasks is performed to obtain the corresponding mixed calculation results. Among them, the first stage of the mixed calculation performs serial calculation, and the second stage performs parallel calculation. Finally, the mixed calculation result is transmitted to the memory to complete the hardware acceleration of the multiple scalar multiplication tasks. The device significantly improves the calculation speed and accuracy of zero-knowledge proof through the redivision of multiple scalar multiplication tasks and the mixed calculation strategy, optimizes resource utilization, reduces hardware computing energy consumption, and improves the overall hardware performance, flexibility and scalability of zero-knowledge proof.

[0154] See also Figure 7 , Figure 7 Schematic diagram of an electronic device provided by an embodiment of the present invention. Figure 7As shown, an embodiment of the present invention provides an electronic device 500, including a memory 510, a processor 5102, and a computer program 511 stored in the memory 510 and executable on the processor 5102. When the processor 5102 executes the computer program 511, the following steps are implemented: obtaining a zero-knowledge proof task to be accelerated from the memory; obtaining a multiple scalar multiplication task from the zero-knowledge proof task; the multiple scalar multiplication task includes multiple addition operations; based on the maximum number of synchronous tasks that can be executed by the adder, the multiple scalar multiplication task is divided to obtain a plurality of subtasks corresponding to the multiple scalar multiplication task; the multiple subtasks are input into the adder, and mixed calculations of the multiple subtasks are performed to obtain corresponding mixed calculation results; in the mixed calculation, serial calculations are performed in the first stage, and parallel calculations are performed in the second stage; the mixed calculation results are transmitted to the memory to complete the hardware acceleration of the multiple scalar multiplication tasks.

[0155] See also Figure 8 , Figure 8 A schematic diagram of an embodiment of a computer-readable storage medium provided in an embodiment of the present invention. Figure 8 As shown, this embodiment provides a computer-readable storage medium 600, on which a computer program 611 is stored. When the computer program 611 is executed by a processor, the following steps are implemented: obtaining a zero-knowledge proof task to be accelerated from a memory; obtaining a multiple scalar multiplication task from the zero-knowledge proof task; the multiple scalar multiplication task includes multiple addition operations; based on the maximum number of synchronous tasks that can be executed by the adder, the multiple scalar multiplication task is divided to obtain a plurality of subtasks corresponding to the multiple scalar multiplication task; the multiple subtasks are input into the adder, and mixed calculations of the multiple subtasks are performed to obtain corresponding mixed calculation results; in the mixed calculation, serial calculations are performed in the first stage, and parallel calculations are performed in the second stage; the mixed calculation results are transmitted to the memory to complete the hardware acceleration of the multiple scalar multiplication tasks.

[0156] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0157] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0158] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0159] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0160] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0161] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0162] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A hardware acceleration method for zero-knowledge proof, characterized in that: A hardware system for performing zero-knowledge proof, the hardware system comprising at least a memory and an adder, the method comprising: Obtaining a zero-knowledge proof task to be accelerated from a memory; Acquire a multiple scalar multiplication task from the zero-knowledge proof task; the multiple scalar multiplication task includes multiple addition operations; Based on the maximum number of synchronous tasks executable by the adder, the multiple scalar multiplication task is divided to obtain a plurality of subtasks corresponding to the multiple scalar multiplication task; Input the multiple subtasks into an adder, perform mixed calculations on the multiple subtasks, and obtain corresponding mixed calculation results; in the mixed calculation, serial calculations are performed in the first stage, and parallel calculations are performed in the second stage; The mixed calculation result is transmitted to a memory to complete the hardware acceleration of the multiple scalar multiplication task; The method of dividing the multiple scalar multiplication tasks based on the maximum number of synchronous tasks executable by the adder to obtain multiple subtasks corresponding to the multiple scalar multiplication tasks includes: Obtain configuration information of the adder in the current hardware system to determine the maximum number of synchronization tasks; Based on the total number of tasks in the multiple scalar multiplication task and the maximum number of synchronous tasks, the multiple scalar multiplication task is divided into a plurality of subtasks; wherein the total number of subtasks is greater than or equal to the maximum number of synchronous tasks; The step of inputting the plurality of subtasks into an adder, performing mixed calculations on the plurality of subtasks, and obtaining corresponding mixed calculation results includes: In the first stage, for each subtask, the intermediate results corresponding to each position in the subtask are calculated in turn, and the target intermediate results of each subtask are accumulated; In the second stage, for the subtasks ranked before the last one in the serial calculation process, weighted accumulation operation is synchronously performed on the target intermediate result of each subtask and the input value in the current elliptic curve to obtain the mixed calculation result of each subtask; and, For the subtask that ranks last in the serial calculation process, a weighted accumulation operation is performed on the target intermediate results of each subtask to obtain a mixed calculation result of each subtask.

2. The hardware acceleration method for zero-knowledge proof according to claim 1, characterized in that: The number of computing tasks included in each subtask is determined by the maximum number of synchronous tasks.

3. The hardware acceleration method for zero-knowledge proof according to claim 1, characterized in that: The number of computing tasks included in each subtask is less than or equal to the ratio between the total number of tasks in the multiple scalar multiplication task and the maximum number of synchronous tasks.

4. The hardware acceleration method for zero-knowledge proof according to claim 3, characterized in that: The number of computing tasks included in the last subtask is smaller than the ratio.

5. The hardware acceleration method for zero-knowledge proof according to claim 3, characterized in that: The unoccupied computational resources in the last subtask are used to perform non-addition operations.

6. The hardware acceleration method for zero-knowledge proof according to claim 1, characterized in that: In the first stage, for each subtask, the intermediate results corresponding to each position in the subtask are calculated in turn, and the target intermediate results of each subtask are accumulated, including: For each subtask, calculate the intermediate results corresponding to each position in each subtask in turn; After the intermediate result corresponding to each position is calculated, the first intermediate result of the previous position is accumulated to the calculated second intermediate result of the current position, and the accumulated third intermediate result is stored in the auxiliary bit corresponding to each subtask.

7. The hardware acceleration method for zero-knowledge proof according to claim 1, characterized in that: The number of mixed computing cycles required by the multiple subtasks for: ;in, is the total number of tasks, is the maximum number of synchronization tasks, Is a positive integer.

8. A hardware acceleration device for zero-knowledge proof, characterized in that: A hardware system for executing zero-knowledge proof, the hardware system comprising at least a memory and an adder, the hardware acceleration device comprising the following units: An acquisition unit, configured to acquire a zero-knowledge proof task to be accelerated from a memory; an extraction unit, configured to obtain a multiple scalar multiplication task from the zero-knowledge proof task; The multiple scalar multiplication task includes multiple addition operations; an operation unit configured to divide the multiple scalar multiplication task based on the maximum number of synchronous tasks executable by the adder to obtain a plurality of subtasks corresponding to the multiple scalar multiplication task; Input the multiple subtasks into an adder, perform mixed calculations on the multiple subtasks, and obtain corresponding mixed calculation results; in the mixed calculation, serial calculations are performed in the first stage, and parallel calculations are performed in the second stage; The mixed calculation result is transmitted to a memory to complete the hardware acceleration of the multiple scalar multiplication task; The operation unit divides the multiple scalar multiplication tasks based on the maximum number of synchronous tasks executable by the adder to obtain a plurality of subtasks corresponding to the multiple scalar multiplication tasks, and is configured as follows: Obtain configuration information of the adder in the current hardware system to determine the maximum number of synchronization tasks; Based on the total number of tasks in the multiple scalar multiplication task and the maximum number of synchronous tasks, the multiple scalar multiplication task is divided into a plurality of subtasks; wherein the total number of subtasks is greater than or equal to the maximum number of synchronous tasks; The computing unit inputs the multiple subtasks into an adder, performs mixed calculations on the multiple subtasks, and obtains corresponding mixed calculation results, and is configured as follows: In the first stage, for each subtask, the intermediate results corresponding to each position in the subtask are calculated in turn, and the target intermediate results of each subtask are accumulated; In the second stage, for the subtasks ranked before the last one in the serial calculation process, weighted accumulation operation is synchronously performed on the target intermediate result of each subtask and the input value in the current elliptic curve to obtain the mixed calculation result of each subtask; and, For the subtask that ranks last in the serial calculation process, a weighted accumulation operation is performed on the target intermediate results of each subtask to obtain a mixed calculation result of each subtask.

9. An electronic device, characterized in that: include: Memory for storing computer software programs; A processor is used to read and execute the computer software program, thereby implementing the hardware acceleration method for zero-knowledge proof as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer software program, which, when executed by a processor, implements the hardware acceleration method for zero-knowledge proof as described in any one of claims 1 to 7.

Images