An anonymous decentralized computing system and computing method based on group contracts

Abstract

The present invention discloses an anonymous decentralized computing system and computing method based on group contracts, including group contracts. Group contracts use group signatures to protect the anonymity of individual group members while allowing traceability within the group. The group signature function is represented by a polynomial time algorithm. The group contract specifically includes: InitializeGroup, Register User , CountVote, Trace and Revoke; CountVote is an internal function, used only in tracking and revoking, used to check and enumerate non-duplicate votes; InitializeGroup, Register User , Trace and Revoke are public functions; InitializeGroup, Register User The codes for CountVote, Trace, and Revoke are encrypted and protected by TEE-DS. Workers securely interact with it, retrieve the encrypted codes, and decrypt them in the TEE. This invention does not rely on a trusted third party; while guaranteeing anonymity, it also ensures strong Byzantine fault tolerance and the ability to resist impersonators.

Description

Technical Field

[0001] The present invention relates to the field of distributed learning technology, and in particular to an anonymous decentralized computing system and computing method based on group contracts. Background Art

[0002] Current research on distributed learning focuses on two approaches: federated learning (a client-parameter server model) and decentralized computing. In contrast to federated learning, decentralized computing treats all nodes equally, and information exchange does not require the intervention of a parameter server. However, nodes participating in decentralized computing can cause problems if their identities are exposed.

[0003] Existing technologies protect identity privacy by changing their virtual identity each time a user participates in a new learning process, or even between iterations of the same process. However, this approach cannot track malicious nodes that disrupt the training process, leading to credibility issues for the entire system. Furthermore, decentralized computing can only tolerate a limited number of Byzantine nodes. For example, SPDL (Secure and Privacy-Enabled Decentralized Computing for Blockchain) only allows for a Byzantine node count of less than 33%. If node registration is improperly managed, adversaries could launch impersonation attacks, creating a large number of Byzantine nodes exceeding this limit and causing system failure. Furthermore, decentralized architecture is another issue worth considering. Current solutions to these issues require the involvement of trusted institutions. Summary of the Invention

[0004] In order to overcome the above-mentioned problems existing in the prior art, the present invention proposes an anonymous decentralized computing system and computing method based on group contracts.

[0005] The technical solution adopted by the present invention to solve its technical problem is: an anonymous decentralized computing system based on group contracts, including a group contract, wherein the group contract uses group signatures to protect the anonymity of individual group members while allowing traceability within the group, and uses a polynomial time algorithm to represent the group signature function, GroupSig def = (Setup, Join, Sign, Verify, Open, Revoke); the group contract specifically includes the following functions: InitializeGroup, Register User , CountVote, Trace and Revoke, among which CountVote is an internal function and is only used in tracking and revocation to check and enumerate non-duplicate votes; InitializeGroup, Register User , Trace and Revoke are public functions; InitializeGroup, Register UserThe codes of CountVote, Trace, and Revoke are protected by TEE-DS in encrypted form. The staff interacts with it securely, obtains the encrypted codes, and decrypts them in TEE.

[0006] In the anonymous decentralized computing system based on group contracts, InitializeGroup is used to initialize a group and generate key parameters required for the remaining functions; it accepts security parameters λ and PubKey DS As input, where PubKey DS is the public key used by TEE-DS to encrypt data;

[0007] Specifically: InitializeGroup calls GroupSig.Setup, which takes 1 λ Generate a group public key gp as input k And a group management private key gmsk; generate the signing key (pk c ,sk c ), and use PubKeyDS to pair gmsk and sk c Encryption; InitializeGroup output gp k 、pk c , Enc_gmsk and Enc_sk c .

[0008] The above-mentioned anonymous decentralized computing system based on group contract, the Register User Function is used for user registration; requires cred i and where cred i is the user's certificate, is the user's public key;

[0009] Specifically: For user X i , first verify the user's cred i , use GroupSig.Join algorithm for X i Generate group private key gsk i and group member identity information (i, A i ); Output usage Encrypted encryption key Enc_gsk i To ensure that except owner X i No one else can access the key.

[0010] In the above anonymous decentralized computing system based on group contracts, the Trace function is used to track malicious users. First, the Trace function calls the CountVote function to enumerate the votes of other users. If the number of votes exceeds the predefined threshold h, GroupSig.Open is used to generate the identity parameter A of the malicious user X′*i based on the group manager's private key gmsk and the group signature σ′*G. i ; Blockchain enables all users to obtain i The corresponding label i;

[0011] The Revoke function is used to invalidate the malicious user with label i; after calling the CountVote function to count the votes of the remaining users, if the threshold h is exceeded, the Revoke function updates the Acc parameter of the dynamic accumulator with the help of the GroupSig.Revoke algorithm, indicating that the user X i Expired.

[0012] An anonymous decentralized computing method based on a group contract, using the aforementioned anonymous decentralized computing system based on a group contract, includes the following steps:

[0013] Step 1, Initialization: Build a group GR k , with safety parameter 1 λ and TEE-DS's public encryption key PubKey DS As input, call the group contract to output the group public key gp k , contract signature public key pk c , encrypted group management private key Enc_gmsk and encrypted contract signature private key Enc_sk;

[0014] Step 2, user registration: The user obtains the member private key gsk and joins the anonymous decentralized computing system;

[0015] Step 3, Distributed Learning: Decentralized computing in the anonymous decentralized computing system includes: group member verification and model training. Group member verification is used to confirm the qualifications of users and the model training phase. Users who pass the group member verification will perform decentralized computing.

[0016] Step 4: Tracking and revocation;

[0017] The specific process of tracking users is as follows: v Logo R v Conduct a vote and collect votes After that, the user calls the tracking function of the group contract; if the number of valid votes exceeds the threshold h, the tracking function outputs the group membership parameter A i ;Users obtain A from the blockchaini The associated label i indicates that the malicious user’s signature has been successfully traced;

[0018] The specific process of revoking a user is as follows: v Logo R v Conduct a vote and collect votes Afterwards, the user calls the revocation function of the group contract and provides the label i of the malicious user as input; if the number of valid votes exceeds the threshold h, the malicious user is revoked by updating the new dynamic accumulator parameter Acc.

[0019] In the aforementioned anonymous decentralized computing method based on group contracts, step 2 specifically includes:

[0020] Step 2.1, User X i Call the Register of the group contract User Function, input cred i and where cred i is the user's certificate, is the user's public encryption key; Register User The function outputs the encrypted group member private key Enc_gsk i , can be obtained by the corresponding user X i Decryption; Register User The function outputs the user's group membership information (i, A i ), the information is recorded on the blockchain for subsequent tracking;

[0021] Step 2.2: User X i Decrypt Enc_gsk i , obtain its group signature private key gsk i .

[0022] In the anonymous decentralized computing method based on group contracts, step 3 of group member verification specifically includes: adding a public function named GiVeIdentityProof to the original group contract, which is used to verify the user's temporary identity R and issue an identity certificate P;

[0023] The specific process is: Use GroupSig.Verify to verify the group public key gpk and group signature σ G The correctness of the signature; execute the GroupSig.Open algorithm to obtain the user's membership parameter A i ; Calculate the label and membership parameter A of the decentralized computation i The hash value of

[0024] During the group member verification phase, a practical Byzantine fault-tolerant protocol is adopted as the backbone for reaching consensus.

[0025] In the above anonymous decentralized computing method based on group contracts, the model training in step 3 includes: during the model training process, each user maintains an array C[|U|] to record the number of times information is received from a specific user; each piece of information to be transmitted is packaged as <ID i ,(t,mes i )> σ , where σ represents the elliptic curve digital signature algorithm signature; for each received <ID v ,(t,mas v )> σ , user X i Search and ID v The corresponding R v If R is not found in U v , or the round is not the current round t, user X i neglect <ID v ,(t,mas v )> σ User X i Use the corresponding public key pk v Verify the signature, if the signature is valid and the information is received, it is used for model training; in each round, the user updates its local gradient, a new block Appended to the blockchain middle.

[0026] The beneficial effect of the present invention is that the group contract of the present invention fully combines private smart contracts and group signatures. The solution replaces the trusted institution required in group signatures with the entire blockchain and uses the trusted execution environment (TEE) to prevent privacy leakage.

[0027] The present invention proposes an anonymous decentralized computing method that combines anonymity and traceability mechanisms to offset Byzantine nodes. Compared with centralized methods, it does not rely on a trusted third party. While ensuring anonymity, it also ensures strong Byzantine fault tolerance and the ability to resist imposters. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The present invention will be further described below with reference to the accompanying drawings and examples.

[0029] Figure 1 This is the architecture diagram of the anonymous decentralized computing system of the present invention;

[0030] Figure 2 The GiveIdentityProof function of an embodiment of the present invention;

[0031] Figure 3 This is a schematic diagram of group member verification according to an embodiment of the present invention;

[0032] Figure 4 It is the training and testing error of the model in the embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the technical solution of the present invention, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0034] like Figure 1 As shown, this embodiment discloses an anonymous decentralized computing system based on group contracts. The group contract uses group signatures to protect the anonymity of individual group members while allowing traceability within the group. Specifically, a set of polynomial time algorithms is used to represent the group signature function, expressed as GroupSig def = (Setup (for initialization), Join (for group member registration), Sign (for output signature), Verify (for verification signature), Open (for tracing the group members to which the signed member belongs), and Revoke (for revoking group membership)). In order to further ensure privacy in the group contract, TEE-DS is used to help implement the contract, which can protect the private keys of the group manager and group members. In addition, the input and output parameters in the TEE are also encrypted. However, some parameters, such as the group public key, need to be publicly accessible in the group signature field.

[0035] The group contract contains five functions: InitializeGroup, Register User , CountVote, Trace, and Revoke. Of these five functions, CountVote is an internal function that can only be called from within the group contract. The other four are public and can be called by external users. The code for these functions is encrypted and protected by TEE-DS. Workers need to interact with them securely, obtain the encrypted code, and decrypt it in the TEE. Each function will be described in detail below.

[0036] InitializeGroup: The InitializeGroup function is used to initialize a group and generate the key parameters required by the remaining functions. It accepts the security parameter λ and PubKey Ds As input, where PubKey DS The public key used by TEE-DS to encrypt data. First, InitializeGroup calls GroupSig.Setup, which takes 1 λ Generate a group public key gp as input kAnd a group management private key gmsk. Then, it generates the signing key (pk c ,sk c ), and use PubKeyDS to pair gmsk and sk c Finally, InitializeGroup outputs gp k 、pk c , Enc_gmsk and Enc_sk c It is worth noting that the remaining four functions are only generated when InitializeGroup is executed.

[0037] Register User :Register User Function is used to register users. It requires cred i and Register Useri , where cred i is the user's certificate, Is the user's public key. For user X i , which first verifies the user's cred i , then use the GroupSig.Join algorithm for X i Generate group private key gsk i and group member identity information (i, A i ). Finally, the function output uses Register User Encrypted encryption key gsk i To ensure that except owner X i No one else can access the key. i ) is stored locally by the group manager, but in this solution, the centralized group manager is removed and the data is stored on the blockchain for future tracing. (i, A i ) is just a symbol and has no direct connection with the signature, so it does not reveal the user X i any personally identifiable information.

[0038] CountVote: The CountVote function is an internal mechanism, used only by the tracking and revocation functions. Its primary function is to check and enumerate unique votes. To do this, the function utilizes the GroupSig.Open algorithm to verify the identity of the signer. The anonymous nature of group signatures requires this approach to avoid duplicate counting by a single entity. Upon successful verification, the function tallies the votes and returns a count.

[0039] Trace: The main purpose of this function is to track malicious users. First, the Trace function calls the CountVote function to enumerate the votes of other users. If the number of votes exceeds the predefined threshold h, GroupSig.Open is used to generate the identity parameter A of the malicious user X′*i based on the group manager's private key gmsk and the group signature σ′*G (generated by the malicious user). i The blockchain enables all users to gain access to i The corresponding tag i indicates the successful association between the signature and the user identity. In the subsequent Revoke function, a malicious user can revoke the signature by providing the tag i.

[0040] Revoke: The purpose of this process is to invalidate the malicious user with identifier i. After calling the CountVote program to count the votes of the remaining users, if the specified threshold h is exceeded, the Revoke program will use the GroupSig.Revoke algorithm to update the Acc parameter of the dynamic accumulator, indicating that user X i Expired.

[0041] Based on the technical support of group contracts, anonymous decentralized computing methods can be divided into four stages: Figure 1 As shown in the figure, it is divided into four stages: initialization, user registration, decentralized computing, and tracking and revocation.

[0042] 1) Initialization: This embodiment sets up an interaction scenario, where users X1, X2, ...X t Constructed a group GR k With safety parameter 1 λ and TEE-DS's public encryption key PubKey DS As input, call the InitializeGroup function of the group contract. This function outputs multiple parameters for the next stage, such as the group public key gp k , contract signature public key pk c , encrypted group management private key Enc_gmsk and encrypted contract signature private key Enc sk.

[0043] 2) User Registration: During the user registration process, the user obtains the member private key gsk and joins the ADL (Anonymous Decentralized Computing) system. User registration includes the following steps:

[0044] Step 1: User X i Call the Register of the group contract User Function, input cred i and where cred i is the user's certificate, Is the user's public encryption key. Register User The function outputs the encrypted group member private key Enc_gsk i , can be obtained by the corresponding user X i Decryption. In addition, Register User The function also outputs the user's group membership information (i, A i ), this information will be recorded on the blockchain for subsequent tracking. i ) is purely a symbol and does not reveal any private information as long as it is not associated with a signature.

[0045] Step 2: User X i Decrypt Enc_-gsk i , obtain its group signature private key gsk i With this signature private key, user X i You can participate in the decentralized computing process.

[0046] 3) Decentralized Computing: Decentralized computing in anonymous decentralized computing is divided into two parts: group member verification and model training. Group member verification is used to confirm the qualifications of users and the model training phase. Users who have been verified as group members perform decentralized computing.

[0047] a) Group member identity verification: This embodiment adds a public function called GiveIdentityProof to the original group contract, such as Figure 2 This function is used to verify the user's temporary identity R and issue an identity certificate P.

[0048] The function first uses GroupSig.Verify to verify the group public key gpk and group signature σ G The correctness of the signature. Then execute the GroupSig.Open algorithm to obtain the user's membership parameter A i Then, the label and membership parameter A of the decentralized computation DL is calculated i This approach ensures that different decentralized computations will produce different hash values, but within a specific decentralized computation, signatures from the same user will produce the same hash value. This approach effectively protects ADL (Anonymous Decentralized Computing) from attacks by imposters.

[0049] During the group member verification phase, the main goal is to authenticate users participating in the training, exclude unqualified users, and prevent Sybil attacks. Ultimately, users reach a consensus and form a training user list U. The Practical Byzantine Fault Tolerance (PBFT) protocol is used as the backbone for reaching consensus. This protocol operates independently of the digital currency system and exhibits high efficiency. The group member verification phase consists of four phases: pre-preparation (PRE-PREPARE), preparation (PREPARE), commit (COMMIT), and completion (ACCOMPLISH), as shown in the following example. Figure 3 shown.

[0050] In the pre-preparation stage, participate in decentralized computing DL u Each user uses the Elliptic Curve Digital Signature Algorithm (ECDSA) to generate a one-time and non-repeated public and private key pair (pk i ,sk i ). Each user X i A temporary identifier will be generated Where ID i is a randomly generated number, GR k Represents the group label to which the group signature obtained in the previous user registration phase belongs. Subsequently, X i Using R i and decentralized computing DL u The tag calls the GiveIdentityProof function of the group contract and receives the output P i , as a temporary identity certificate. i Request a temporary identity from the blockchain that is valid for this specific decentralized computation process, X i P i Broadcast to its peers.

[0051] In the preparation phase, the judgment of Sybil attack is embedded to ensure that the training user list does not contain users who impersonate multiple users by sending multiple identity information R. First, user X i Authentication from user X v Received P v (denoted as Verify(P v )). If the embedded information is repeated or the signature is invalid, P v will be discarded. The remaining verified P v Hash(DL u , M v ) is stored in M_SET. Then, X i In SET R Storage and non-repeated Hash (DL u , M v ) corresponding to R. In this embodiment, SETR The size of is denoted as n, where n = 3f + 1, where f represents the maximum number of Byzantine users allowed. v ∈SET R , user X i Sign it and send <PREPARE,R i , Rv> σ Broadcast to other users.

[0052] It's important to note that in this embodiment, group signatures are only used during the pre-preparation and preparation phases. Because group signatures are bound to ECDSA signatures, they are not required in subsequent processes. This optimization significantly reduces the system's signature overhead. Furthermore, the ECDSA keys in this system are temporary and will change during the next distributed learning process, thus ensuring identity privacy.

[0053] In the submission phase, for any R v If user X i Received from at least 2f+1 different users <PREPARE,R j , R v ) σ , it will broadcast <COMMIT,R i , R v > σ .

[0054] In the completion phase, for any R v If user X i Received from at least 2f+1 different users <COMMIT,R i , R v > σ , it will R v Add to its training user list U. Finally, user X i Set its broadcast list to the users in U. Generate a new block Record U and DL u , and appended to the blockchain middle.

[0055] b) Model training: In this system, SPDL (a decentralized computing system that supports security and privacy of blockchain) is used as the model training algorithm, but it is not limited to this. This embodiment will not go into the detailed algorithm process of model training, because the detailed algorithm process is existing technology, and the focus of this embodiment is information verification, which will be described in detail below. In this case, (t,mes i ) to represent user X i The information sent in round t.

[0056] During model training, each user maintains an array C[|U|] to record the number of times a message is received from a specific user, thereby preventing replay attacks. Each message to be transmitted is packaged as <ID i ,(t,mes i )> σ , where σ represents the ECDSA (Elliptic Curve Digital Signature Algorithm) signature. Group signature is not required here because it is already bound to the ECDSA (Elliptic Curve Digital Signature Algorithm) signature during group member verification. In addition, since the ECDSA (Elliptic Curve Digital Signature Algorithm) signature is temporary and one-time and will be changed in the next decentralized computing process, it will not leak any identity privacy. It is only used to verify whether the information comes from user X. i . Then, for each received <ID v ,(t,mes v )> σ , user X i Metropolis search and ID v The corresponding R v If R is not found in U v , or the round is not the current round t, user X i Will ignore <ID v ,(t,mes v )> σ Then, user X i Use the corresponding public key pk v Verify the signature. If the signature is valid and the information is received, it is used for model training.

[0057] In each round, users update their local gradients, and a new block Appended to the blockchain This block records the relevant training information of the t+1 round. As mentioned in the previous paragraph, through the combination of group member verification and message verification, user X i It ensures that it only interacts with users in the training user list U. Therefore, an adversary cannot create Byzantine users that exceed the number of users under its control to disrupt the model training process. Throughout the process, users communicate anonymously and securely without revealing their identity privacy.

[0058] 4) Tracking and revocation: In anonymous decentralized computing, users can track user X. v Logo R v Once a set of votes is collected, The user will call the tracking function of the group contract. If the number of valid votes exceeds the threshold h, the tracking function will output the group membership parameter A. i . Subsequently, users can obtain the samei The associated label i indicates that the malicious user’s signature has been successfully traced. The process of revoking a user is similar to the process of tracing a user. Afterwards, the user calls the revoke function of the group contract and provides the label i of the malicious user as input. If the number of valid votes exceeds the threshold h, the malicious user is revoked by updating the new dynamic accumulator parameter Acc.

[0059] To verify the Byzantine fault tolerance of the anonymous decentralized system in this example, we tested it using different Byzantine ratio (BR) training models. The Byzantine ratio represents the ratio of the number of Byzantine users to the total number of users. In the experiment, the total number of users was set to 20, and the BR values ​​were 0%, 10%, 20%, and 30%, respectively. Considering f = 33% × N, this is the upper limit of the PBFT algorithm. Figure 4 Shows the test error of the model training (the proportion of incorrect predictions made on the test dataset to the total number of predictions). Figure 2 In this paper, "PURE" is defined as a system that removes all Byzantine fault tolerance related components, including group membership verification in the anonymous decentralized computing system (ADL), BFT GARs, the PBFT algorithm for model training, and the blockchain system. In this experiment, Byzantine users attempt to interfere with the training process by sending extremely large gradients and not sending any messages after the PREPARE phase of the PBFT algorithm in the anonymous decentralized computing system. Figure 2 As can be seen in the figure, the "PURE" system is directly damaged by the presence of Byzantine users, resulting in a failure of test error convergence. In contrast, the anonymous decentralized computing system (ADL) of this application includes Byzantine fault tolerance and can converge to a favorable test error value even when the number of Byzantine users is less than 30%. Therefore, it can be concluded that the anonymous decentralized computing system (ADL) of this embodiment has good Byzantine fault tolerance.

[0060] The above embodiments are merely exemplary embodiments of the present invention and are not intended to limit the scope of the present invention. The scope of protection of the present invention is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present invention within the spirit and scope of protection of the present invention, and such modifications or equivalent substitutions shall also be deemed to fall within the scope of protection of the present invention.

Claims

1. An anonymous decentralized computing system based on group contracts, characterized by: Including group contracts, the group contract uses group signatures to protect the anonymity of individual group members while allowing traceability within the group. The group signature function is represented by a polynomial time algorithm, GroupSig def = (Setup, Join, Sign, Verify, Open, Revoke); the group contract specifically includes the following functions: InitializeGroup, , CountVote, Trace and Revoke, among which CountVote is an internal function and is only used in tracking and revocation to check and enumerate non-duplicate votes; InitializeGroup, , Trace and Revoke are public functions; InitializeGroup, The codes for CountVote, Trace, and Revoke are protected by TEE-DS in encrypted form. The staff interacts with it securely, obtains the encrypted codes, and decrypts them in TEE.

2. The anonymous decentralized computing system based on group contracts according to claim 1, characterized in that: InitializeGroup is used to initialize a group and generate key parameters required by the remaining functions; it accepts security parameters and As input, where is the public key used by TEE-DS to encrypt data; Specifically: InitializeGroup calls GroupSig.Setup, which uses Generates a group public key as input and a group to manage private keys ;Generate signing key for group contract and use right and Encryption; InitializeGroup output 、 、 and .

3. The anonymous decentralized computing system based on group contracts according to claim 1, characterized in that: described Function is used for user registration; required and ,in is the user's certificate, is the user's public key; Specifically: For users , first verify the user's , using the GroupSig.Join algorithm for Generate group private key and group member identity information ; Output usage Encrypted encryption key Enc_ To ensure that except the owner No one else can access the key.

4. The anonymous decentralized computing system based on group contracts according to claim 1, characterized in that: The Trace function is used to track malicious users. First, the Trace function calls the CountVote function to enumerate the votes of other users. If the number of votes exceeds the predefined threshold h, GroupSig.Open is used to calculate the number of votes of other users according to the group management private key. and group signatures , generating malicious users Identity parameters ; Blockchain enables all users to obtain The corresponding label i; The Revoke function is used to invalidate the malicious user with label i; after calling the CountVote function to count the votes of the remaining users, if the threshold h is exceeded, the Revoke function updates the Acc parameter of the dynamic accumulator with the help of the GroupSig.Revoke algorithm, indicating that the user Expired.

5. An anonymous decentralized computing method based on group contracts, characterized in that: Using an anonymous decentralized computing system based on a group contract as described in any one of claims 1 to 4, comprising the following steps: Step 1, Initialization: Build a group , with safety parameters and TEE-DS's public encryption key As input, call the group contract to output the group public key , Signature key for group contracts , encrypted group management private key and the signing key of the group contract ; Step 2, user registration: The user obtains the member private key gsk and joins the anonymous decentralized computing system; Step 3, Distributed Learning: Decentralized computing in the anonymous decentralized computing system includes: group member verification and model training. Group member verification is used to confirm the qualifications of users and the model training phase. Users who pass the group member verification will perform decentralized computing. Step 4: Tracking and revocation; The specific process of tracking users is as follows: Logo Conduct a vote and collect votes After that, the user calls the tracking function of the group contract; if the number of valid votes exceeds the threshold h, the tracking function outputs the group membership parameters ; Users obtain and The associated label i indicates that the malicious user’s signature has been successfully traced; The specific process of revoking a user is as follows: Logo Conduct a vote and collect votes Afterwards, the user calls the revocation function of the group contract and provides the label i of the malicious user as input; if the number of valid votes exceeds the threshold h, the malicious user is revoked by updating the new dynamic accumulator parameter Acc.

6. The anonymous decentralized computing method based on group contracts according to claim 5, characterized in that: The step 2 specifically includes: Step 2.1, User Calling the group contract Function, input and ,in is the user's certificate, is the user's public encryption key; The function outputs the encrypted member private key , which can be used by the corresponding user Decryption; Function outputs the user's group membership information , information is recorded on the blockchain for subsequent tracking; Step 2.2: User Decryption , obtain its group signature private key .

7. The anonymous decentralized computing method based on group contracts according to claim 5, characterized in that: The group member verification step 3 specifically includes: adding a public function called GiveIdentityProof to the original group contract, which is used to verify the user's temporary identity R and issue identity proof P; The specific process is: Use GroupSig.Verify to verify the group public key and group signatures The correctness of the signature; execute the GroupSig.Open algorithm to obtain the user's membership parameters ; Compute labels and membership parameters for decentralized computation The hash value of During the group member verification phase, a practical Byzantine fault-tolerant protocol is adopted as the backbone for reaching consensus.

8. The anonymous decentralized computing method based on group contracts according to claim 5, characterized in that: The step 3 model training includes: During the model training process, each user maintains an array , to record the number of times a message is received from a specific user; each message to be transmitted is packaged as , where σ represents the elliptic curve digital signature algorithm signature; for each received ,user Search and Related corresponding If it is not found in U , or the round is not the current round t, the user neglect ;user Use the corresponding public key The signature is verified, and if the signature is valid and the information is received, it is used for model training; in each round, the user updates their local gradient and a new block is appended to the blockchain.

Images