Zero-knowledge proving method, verification method, equipment and storage medium

Abstract

The invention discloses a zero-knowledge proving method, a verification method, equipment and a storage medium. The method comprises the following steps: acquiring a plurality of first instances; different first examples are description data of different aspects of the to-be-proved problem; superposing the plurality of first instances to obtain a superposed second instance; and generating a certification value of the to-be-certified question by using the second instance, so that a verifier verifies whether the to-be-certified question is correct by using the certification value. In this way, the calculation amount required for certification can be reduced.

Description

Technical Field

[0001] The present application relates to the field of computer encryption technology, and in particular to a zero-knowledge proof method, verification method, device and storage medium. Background Art

[0002] The current society is in the information age, and information leakage incidents are common. Zero-knowledge proof technology can complete verification more efficiently and securely while protecting privacy data.

[0003] In some scenarios, the problem to be proved contains a large number of instances, and the corresponding zero-knowledge proof process requires a large amount of computation. How to reduce the amount of computation in the proof process is of great significance to solving the effectiveness of the proof. Summary of the invention

[0004] The main technical problem solved by this application is to provide a zero-knowledge proof method, verification method, device and storage medium, which can reduce the amount of calculation required for proof.

[0005] In order to solve the above technical problems, a technical solution adopted in the present application is: to provide a zero-knowledge proof method, the method comprising: obtaining a number of first instances; different first instances are description data of different aspects of the problem to be proved; superimposing a number of first instances to obtain a superimposed second instance; using the second instance to generate a proof value of the problem to be proved, so that the verifier uses the proof value to verify whether the problem to be proved is correct.

[0006] In order to solve the above technical problems, another technical solution adopted by the present application is: to provide a zero-knowledge verification method, including: obtaining a proof value sent by a prover regarding the problem to be proved, the proof value being generated by a second instance obtained by superimposing several first instances; and using the proof value to verify whether the problem to be proved is correct.

[0007] To solve the above technical problems, another technical solution adopted in the present application is: to provide an electronic device, comprising a memory and a processor coupled to each other, the memory storing program instructions; the processor is used to execute the program instructions stored in the memory to implement the above method.

[0008] In order to solve the above technical problem, another technical solution adopted by the present application is: providing a computer-readable storage medium for storing program instructions, which can be executed to implement the above method.

[0009] In the above scheme, after obtaining several first instances, several first instances are superimposed to obtain the superimposed second instances, and then the proof value of the problem to be proved is generated using the second instance, so that the verifier can use the proof value to verify whether the problem to be proved is correct. In this application, several first instances are superimposed into a second instance, and the proof value is generated using the second instance. Therefore, in the process of the verifier verifying the correctness of the problem to be proved, only the proof value can be used to prove the correctness of the problem to be proved. Compared with the method of using a first instance to generate a proof value for proof each time, the above method of this application can effectively reduce the number of proofs, thereby reducing the amount of calculation required for the overall proof. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a flowchart of an embodiment of a zero-knowledge proof method provided by the present application;

[0011] Figure 2 yes Figure 1 A schematic flow chart of an implementation method before or during step S13 is shown;

[0012] Figure 3 yes Figure 1 The flowchart of step S13 is shown as an implementation method;

[0013] Figure 4 It is a schematic diagram of the process of constructing a Merkle tree corresponding to the second polynomial provided by the present application;

[0014] Figure 5 It is a flowchart of an embodiment of a zero-knowledge verification method provided by the present application;

[0015] Figure 6 It is a schematic diagram of a framework of an embodiment of an electronic device provided by the present application;

[0016] Figure 7 It is a schematic diagram of the framework of the computer-readable storage medium provided by this application. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and effect of the present application clearer and more specific, the present application is further described in detail below with reference to the accompanying drawings and examples.

[0018] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0019] It should be noted that zero-knowledge proof is a cryptographic protocol that allows the prover to prove to the verifier that a proposition (problem to be proved) is true (correct) without revealing any additional information about the problem to be proved to the verifier. The verifier cannot know any information other than the authenticity of the problem to be proved through the proof process.

[0020] See also Figure 1 , Figure 1 is a flowchart of an embodiment of a zero-knowledge proof method provided by this application. It should be noted that if there are substantially the same results, this embodiment does not Figure 1 The process sequence shown is limited. Figure 1 As shown, this embodiment includes:

[0021] S11: Obtain several first instances; different first instances are descriptive data of different aspects of the problem to be proved.

[0022] This embodiment is used to, when the problem to be proved includes multiple first instances, superimpose the multiple first instances to form a second instance, and then prove whether the problem to be proved is correct through the second instance.

[0023] The problem to be proved can be any problem that the prover wants to prove to the verifier, and different first instances are descriptive data of different aspects of the problem to be proved. In an implementation scenario, the problem to be proved is the task running logic, and the corresponding first instance is data used to describe that the task running logic can give the corresponding task running result under a given task running state. The task in this implementation scenario can be any task that can be run using a computer program.

[0024] S12: Superimpose a plurality of first instances to obtain a superimposed second instance.

[0025] In one embodiment, each first instance includes a number of instance data. The number of instance data of each first instance can be used to construct a first polynomial representing each first instance, and then the first polynomials of each first instance are superimposed to obtain a second polynomial representing the second instance.

[0026] In an optional embodiment, different instance data in each first instance satisfy certain constraints. In this embodiment, the constraints of each first instance can be constructed based on a number of instance data in each first instance, and then the first polynomial corresponding to each first instance can be constructed based on the constraints of each first instance; then the first polynomial corresponding to each first instance is superimposed to obtain a second polynomial representing the second instance.

[0027] Of course, linear fitting can also be performed directly on several instance data corresponding to several first instances respectively to obtain a second polynomial representing the second instance.

[0028] S13: Generate a proof value of the problem to be proved by using the second instance, so that the verifier can use the proof value to verify whether the problem to be proved is correct.

[0029] In one embodiment, the second instance or the second polynomial representing the second instance can be directly used to generate the proof value of the problem to be proved, so that the verifier can use the proof value to verify whether the problem to be proved is correct. If it is proved that the problem to be proved is correct, it is determined that all the first instances of the problem to be proved are correct.

[0030] In another embodiment, the correctness of the process of superimposing several first instances can be proved before or during the execution of step S13, and when the process of superimposing several first instances is proved to be correct and the problem to be proved is proved to be correct, it is determined that all the first instances of the problem to be proved are correct. The specific method of proving the correctness of the process of superimposing several first instances before or during the execution of step S13 can be referred to the following Figure 2 The specific process of using the second example to generate the proof value of the problem to be proved can be referred to Figure 3 Description of the illustrated embodiment.

[0031] In this embodiment, after the proof value of the problem to be proved is generated, the proof value is sent to the verifier, and the verifier uses the proof value to verify whether the problem to be proved is correct. During the whole process, the verifier does not know any additional information of the problem to be proved, but can determine the authenticity of the problem to be proved through the verification process.

[0032] In the above scheme, after obtaining several first instances, several first instances are superimposed to obtain the superimposed second instances, and then the proof value of the problem to be proved is generated using the second instance, so that the verifier can use the proof value to verify whether the problem to be proved is correct. In this application, several first instances are superimposed into a second instance, and the proof value is generated using the second instance. Therefore, in the process of the verifier verifying the correctness of the problem to be proved, only the proof value can be used to prove the correctness of the problem to be proved. Compared with the method of using a first instance to generate a proof value for proof each time, the above method of this application can effectively reduce the number of proofs, thereby reducing the amount of calculation required for the overall proof.

[0033] See also Figure 2 , Figure 2 yes Figure 1 The flowchart of an implementation method before or during step S13 is shown. In this embodiment, proving the correctness of the process of superimposing a plurality of first instances includes the following steps:

[0034] S21: Based on the instance data in each first instance, verify whether each constraint condition holds.

[0035] In this embodiment, a plurality of instance data of each first instance are arranged in rows and columns to form a plurality of first instance data groups and a plurality of second instance data groups.

[0036] In one embodiment, each first instance data group is a column of instance data of the first instance, and each second instance data group is a row of instance data of the first instance.

[0037] In another embodiment, each first instance data group is a row of instance data of the first instance, and each second instance data group is a column of instance data of the first instance.

[0038] Each first instance data group corresponds to a group index value; each second instance data group of the first instance forms a function, the independent variable of the function is the group index value, and the dependent variable is the instance data value corresponding to the group index value in the second instance group.

[0039] Table 1

[0040]

[0041] For example, please refer to Table 1, which is a first example, d11, d21...dm1 is a first example data group in the first example, d11, d12, d13...d1n is a second example data group (i.e., second example data group 1) in the first example, and the second example group 1 forms a function (e.g., f1), similarly, the second example data 2 forms a function (e.g., f2), and the second example data m forms a function (e.g., fm). Taking the second example group 1 forming a function f1 as an example, the group index value is the independent variable of the function f1, d11, d12, d13...d1n are the dependent variables of the function f1, and are also the instance data values ​​corresponding to the group index value in the second example group 1.

[0042] In a specific implementation scenario, the problem to be proved includes task running logic, wherein different group index values ​​are used to represent different task running states, and the instance data value corresponding to the group index value is the running result under the corresponding task running pile.

[0043] The constraint conditions in this embodiment are established based on the relationship between the instance data in each first instance.

[0044] In one embodiment, the constraint condition is a constraint formula, and the constraint formula corresponding to each first instance is constructed by calculating at least one function corresponding to the first instance, and the function constituting the constraint formula is an associated function of the constraint formula. The constraint formula corresponding to each first instance includes at least one first constraint formula and / or at least one second constraint formula. The first constraint formula indicates that the result of calculating the instance data values ​​corresponding to the same constraint group index value in the second instance data group corresponding to each associated function is equal to a constraint value, and the second constraint formula indicates that the result of calculating the instance data values ​​corresponding to different constraint group index values ​​in the second instance data group corresponding to each associated function is equal to a constraint value.

[0045] Please continue to refer to Table 1. Taking the second instance data group 1 forming function f1, the second instance data group 2 forming function f2, and the second instance data group m forming function fm, and when the group index value is 3 (3 is the constraint group index value), 5f1+3f2=a as an example, 5f1+3f2 can be considered as a constraint formula, f1 and f2 are associated functions of the constraint formula, and 5f1+3f2=a means that when the associated functions f1 and f2 have the same group index value of 3, the result of the corresponding instance data value operation is equal to a constraint value a, so the constraint formula 5f1+3f2 is the first constraint formula. For another example, when the group index value of f1 is 3 and the group index value of f2 is 5, 5f1+4f2=b. Since the group index values ​​3 and 5 belong to different constraint group index values, and the result of the above operation (5f1+4f2) on the corresponding instance data values ​​under different constraint group index values ​​is equal to a constraint value b, when the group index value of f1 is 3 and the group index value of f2 is 5, 5f1+4f2 is the second constraint equation.

[0046] In layman's terms, taking Table 1 as an example, the first constraint represents the constraint relationship between different second instance data groups under the same group index value; for example, under the same group index value 2, 5d22+3d11=c. The second constraint represents the constraint relationship between the same second instance data groups and / or between different second instance data groups under different group indexes; for example, d11=5d13, or d11=2d12+4d23.

[0047] In this embodiment, after determining each constraint condition, it is also necessary to verify whether each constraint condition holds. The following method can be used to verify whether each constraint condition holds: for each constraint formula, substitute the constraint group index value of the constraint formula into the constraint formula to obtain the third operation result, and verify whether the third operation result is equal to the constraint value corresponding to the constraint formula. If so, it is determined that the constraint formula holds.

[0048] In order to facilitate the expression of the relationship between instance data and the way to verify the constraints, the instance data of each first instance can be arranged in rows and columns in a table. The specific arrangement can be referred to in the previous text. Then, for each constraint, the table can be checked to verify whether the instance data in the table meets each constraint.

[0049] For example, for a constraint C j =q a (j)×T[P a (j)]+q b (j)×T[P b (j)]+q M (j)×T[P c (j)]×T[P d (j)]+g. Among them, C j ,qa (j), q b (j), q M (j) and g are both preset constants, which are used to represent the relationship between the instance data in the table. a (j), P b (j), P c (j) and P d (j) is the position index in the table, T[P a (j)], T[P b (j)], T[P c (j)] and T[P d (j)] is the instance data value at the corresponding position in the table, that is, the instance data value corresponding to the constraint group index value is substituted into the associated function of the constraint formula. Among them, for each constraint formula, if the constraint group index value of the constraint formula is substituted into the constraint formula, the third operation result is obtained and the preset constant C j If they are equal, then the constraint is determined to hold.

[0050] It should be noted that, in one embodiment, before substituting the constraint group index value of the constraint formula into the constraint formula to obtain the third operation result and verifying whether the third operation result is equal to the constraint value corresponding to the constraint formula, a data consistency check may be performed on the instance data values ​​corresponding to each group index value in each first instance to check whether the data in the table is correct data. For example, for the instance data values ​​corresponding to each group index value in each first instance, the instance data values ​​determined by multiple checks should be the same. If they are the same, the instance data value corresponding to the group index value has passed the consistency check. The consistency check is to illustrate that the subsequent "finding the instance data value corresponding to the specified group index value from several instance data of each first instance" is correct.

[0051] S22: In response to each constraint condition being satisfied, verify whether a first calculation result of the second polynomial is the same as a corresponding second calculation result, the second calculation result being obtained based on instance data in each first instance.

[0052] S23: In response to the first calculation result and the second calculation result being the same, determining that the process of superimposing the plurality of first instances is correct.

[0053] In this embodiment, when verifying that all constraints are met, it is possible to further verify whether the first calculation result of the second polynomial is the same as the corresponding second calculation result obtained based on the instance data in each first instance, so as to verify whether the process of superimposing several first instances is correct.

[0054] From the description of step S12, it can be seen that the second polynomial is obtained by superimposing the first polynomials corresponding to the first instances. The instance data in the first instance satisfy certain constraints, so the first polynomial can be constructed according to the constraints between the instance data to obtain the second polynomial.

[0055] Among them, the constraint condition is a constraint formula, and the constraint formula corresponding to each first instance is constructed by calculating at least one function corresponding to the first instance (for details, please refer to the previous description), and the first polynomial and the second polynomial are both obtained by weighted calculation based on the constraint formula of the corresponding first instance. Therefore, to verify whether the process of superimposing several first instances is correct is actually to verify whether the process of obtaining the second polynomial by weighted calculation of the constraint formula of the first instance is correct. It should be noted that since the constraint formula corresponding to each first instance is constructed by calculating at least one function corresponding to the first instance, the first polynomial and the second polynomial are both obtained by weighted calculation based on the constraint formula of the corresponding first instance, so the second polynomial is constructed based on the calculation of at least one function corresponding to each first instance.

[0056] In one embodiment, before verifying whether the first calculation result of the second polynomial is the same as the corresponding second calculation result, the method further includes: substituting the specified group index value determined by the prover or the verifier into the second polynomial to obtain the first calculation result, and searching for the instance data value corresponding to the specified group index value from the plurality of instance data of each first instance, and performing a matching operation with the second polynomial on the found instance data value to obtain the second calculation result. The specified group index value may be one or more group index values ​​among all group index values.

[0057] In an optional embodiment, the first calculation result can be calculated in the following manner: first, the specified index value is substituted into the second polynomial, and each constraint expression and other parameter items in the second polynomial after the substitution are multilinearly expanded; then, the first calculation result of the second polynomial after the multilinear expansion is obtained.

[0058] In other embodiments, the instance data in the second instance can be converted into a tree-structured circuit, which is divided into two parts: a bottom part and a top part. The bottom part contains the specific logic implementation of the circuit, that is, it contains defined operators (such as multiplication, addition, subtraction, etc.) and leaf nodes (these leaf nodes represent a set of circuit input values). This bottom part can be regarded as a multi-layer structure, and each layer is calculated according to the output of the next layer until the input value of the bottom layer (leaf node layer) is processed. Among them, if there are m instances (multiple different input sets), each instance corresponds to a data block, and each data block is calculated according to the logic of the circuit. Finally, each block will output a value, which is the leaf node of the top part. The top part adds multiple values ​​output by the bottom part to perform sum verification. In summary, the bottom part is responsible for processing complex logic and calculations to generate multiple output values; the top part verifies whether the sum of these output values ​​is correct through the sum check protocol. This hierarchical design enables the circuit to handle complex computing tasks and efficiently verify the correctness of the results.

[0059] In one embodiment, in order to make the obtained first polynomial and second polynomial more accurate, each second instance data group in each first instance can be subjected to erasure coding processing to obtain each processed second instance data group. The amount of data in each processed second instance data group is greater than the amount of data in the corresponding second instance data group before processing. The erasure coding processing uses interpolation to expand the number of group index values ​​and corresponding instance data values ​​to increase the amount of data contained in each second instance data group, and then processes the instance data values ​​in each processed second instance data group to obtain the corresponding function, and then constructs the constraint condition by the function corresponding to each processed second instance data group, and then constructs the first polynomial and the second polynomial.

[0060] See also Figure 3 , Figure 3 yes Figure 1 FIG. 1 is a flow chart of an implementation method of step S13.

[0061] In this embodiment, the proof value of the problem to be proved is generated by using the second example, including the following steps:

[0062] S31: Use the second instance and the target hash function to construct a Merkle tree and generate a commitment value.

[0063] In this embodiment, the second polynomial obtained above can be used to represent the second instance, and the instance data value of the second polynomial under each group index value can be determined. Then, the target hash function is used to perform step-by-step hash operations on the instance data values ​​corresponding to different group index values ​​to construct a Merkle tree, and the Merkle tree root is obtained, and the value of the Merkle tree root is used as the commitment value.

[0064] For example, see Figure 4 It should be noted that Figure 4 This is only used as an example to illustrate how to construct a Merkle tree. In fact, there are many instance data values ​​of the second polynomial under each group of index values. Figure 4 Only four examples are used to illustrate the tree construction process. No matter how many instance data values ​​there are, the way to construct the Merkle tree is the same. Figure 4 As shown, Figure 4 The instance data values ​​1-4 in the are the values ​​of the second polynomial under 4 different group index values, where for the 4 instance data values, two adjacent instance data values ​​are hashed to obtain corresponding hash values, and then the two adjacent hash values ​​are hashed again until there are no two adjacent hash values. The final hash value is the root of the Merkle tree, which is the commitment value of the second polynomial.

[0065] S32: Send the commitment value to the verifier.

[0066] S33: Receive the random challenge point selected by the verifier based on the commitment value, and use the second instance, the commitment value and the random challenge point to generate a proof value for the problem to be proved.

[0067] After receiving the random challenge point selected by the verifier based on the commitment value, the prover can use the second polynomial, the commitment value and the random challenge point to generate a proof value for the problem to be proved.

[0068] The proof value in this embodiment includes the function value of the second polynomial at the random challenge point, and the Merkle path information related to the random challenge point. Among them, the Merkle path information is the path information from the function value at the random challenge point to the root node (commitment value) in the Merkle tree to the present, and the Merkle path information is used by the verifier to verify that the function value given by the prover at the random challenge point does belong to the previously promised polynomial (the second polynomial corresponding to the commitment value). The method of this embodiment is to convert the problem of proving the correctness of the problem to be proved into the problem of proving that the second polynomial is the polynomial corresponding to the root commitment sent by the prover.

[0069] Among them, after the prover generates the proof value of the problem to be proved, the proof value is sent to the verifier. The verifier can verify whether the information provided by the prover matches the commitment value received previously based on the function value of the second polynomial at the random challenge point and the Merkle path information related to the random challenge point. If it matches, continue to select random challenge points and execute step S33 and subsequent steps until the verifier believes that the second polynomial is the polynomial corresponding to the root commitment sent by the prover, that is, the problem to be proved is correct.

[0070] Among them, the function value of the second polynomial at the random challenge point can be hashed step by step according to the Merkle path. If the final calculated hash value is equal to the root commitment, it indicates whether the information provided by the prover matches the commitment value received previously.

[0071] Of course, in one embodiment, a low-degree test may also be performed on the second polynomial, and the second polynomial may be proved to be a true polynomial by proving that the second polynomial is a low-degree polynomial, that is, the problem to be proved is correct.

[0072] See also Figure 5 , Figure 5 It is a flowchart of an embodiment of the zero-knowledge verification method provided by the present application. It should be noted that if there are substantially the same results, this embodiment does not Figure 5 The process sequence shown is limited. Figure 5 As shown, this embodiment includes:

[0073] S51: Obtain a proof value sent by a prover regarding a problem to be proved, where the proof value is generated by a second instance obtained by superimposing a plurality of first instances.

[0074] S52: Use the proof value to verify whether the problem to be proved is correct.

[0075] The relevant processing process of this embodiment can refer to the relevant description of the zero-knowledge proof method in the previous text, which will not be repeated here.

[0076] See also Figure 6 , Figure 6 Schematic diagram of the framework of an electronic device according to an embodiment of the present application. In this embodiment, the electronic device 60 includes a memory 61 and a processor 62 coupled to each other.

[0077] The memory 61 stores program instructions, and the processor 62 is used to execute the program instructions stored in the memory 61 to implement the steps of any of the above method implementations. In a specific implementation scenario, the electronic device 60 may include but is not limited to: a microcomputer, a server, and in addition, the electronic device 60 may also include a mobile device such as a laptop computer and a tablet computer, which is not limited here.

[0078] Specifically, the processor 62 is used to control itself and the memory 61 to implement the steps of any of the above-mentioned embodiments. The processor 62 can also be called a CPU (Central Processing Unit). The processor 62 may be an integrated circuit chip with signal processing capabilities. The processor 62 can also be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field-programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 62 can be implemented by an integrated circuit chip.

[0079] See also Figure 7 , Figure 7 It is a schematic diagram of the framework of the computer-readable storage medium provided by the present application. The computer-readable storage medium 70 of the embodiment of the present application stores a program instruction 71, and when the program instruction 71 is executed, the method provided by any embodiment of the above method and any non-conflicting combination is implemented. Among them, the program instruction 71 can form a program file and be stored in the above-mentioned computer-readable storage medium 70 in the form of a software product, so that a computer device (which can be a personal computer, a server, or a network device, etc.) executes all or part of the steps of each implementation method of the present application. The aforementioned computer-readable storage medium 70 includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, or a terminal device such as a computer, a server, a mobile phone, and a tablet.

[0080] In the above scheme, after obtaining several first instances, several first instances are superimposed to obtain the superimposed second instances, and then the proof value of the problem to be proved is generated using the second instance, so that the verifier can use the proof value to verify whether the problem to be proved is correct. In this application, several first instances are superimposed into a second instance, and the proof value is generated using the second instance. Therefore, in the process of the verifier verifying the correctness of the problem to be proved, only the proof value can be used to prove the correctness of the problem to be proved. Compared with the method of using a first instance to generate a proof value for proof each time, the above method of this application can effectively reduce the number of proofs, thereby reducing the amount of calculation required for the overall proof.

[0081] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0082] The above description is only an implementation method of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A zero-knowledge proof method, characterized in that: The method comprises: Obtain a plurality of first instances; different first instances are descriptive data of different aspects of the problem to be proved; Superimposing a plurality of the first instances to obtain a superimposed second instance; The proof value of the problem to be proved is generated by using the second instance, so that a verifier can use the proof value to verify whether the problem to be proved is correct.

2. The method according to claim 1, characterized in that Before or during the process of generating the proof value of the problem to be proved by using the second instance, the method further includes: Prove the correctness of the process of superimposing several of the first instances.

3. The method according to claim 1 or 2, characterized in that: Each of the first instances includes a number of instance data; The superimposing a plurality of the first instances to obtain a superimposed second instance includes: Constructing constraint conditions of each of the first instances based on a plurality of instance data in each of the first instances; Based on the constraint conditions of each of the first instances, construct a first polynomial corresponding to each of the first instances; The first polynomials corresponding to the first instances are superimposed to obtain a second polynomial representing the second instance.

4. The method according to claim 3, characterized in that Before or during the process of generating the proof value of the problem to be proved by using the second instance, the method further includes the following steps to prove the correctness of the process of superimposing several first instances: Verify whether each constraint condition holds true based on the instance data in each of the first instances; In response to each of the constraint conditions being satisfied, verifying whether a first calculation result of the second polynomial is the same as a corresponding second calculation result, the second calculation result being obtained based on instance data in each of the first instances; In response to the first calculation result and the second calculation result being the same, it is determined that the process of superimposing the plurality of first instances is correct.

5. The method according to claim 4, characterized in that The plurality of instance data of each first instance are arranged in rows and columns to form a plurality of first instance data groups and a plurality of second instance data groups, each of the first instance data groups is a row of instance data of the first instance, and each of the second instance data groups is a column of instance data of the first instance, or each of the first instance data groups is a column of instance data of the first instance, and each of the second instance data groups is a row of instance data of the first instance, and each of the first instance data groups corresponds to a group index value; each of the second instance data groups of the first instance forms a function, the independent variable of the function is the group index value, and the dependent variable is the instance data value corresponding to the group index value in the second instance group; wherein: The constraint condition is a constraint formula, and the constraint formula corresponding to each of the first instances is formed by calculating at least one function corresponding to the first instance, and the function forming the constraint formula is an associated function of the constraint formula. The constraint formula corresponding to each of the first instances includes at least one first constraint formula and / or at least one second constraint formula, and the first constraint formula indicates that the result of the calculation of the instance data values ​​corresponding to the same constraint group index value in the second instance data group corresponding to each associated function is equal to a constraint value, and the second constraint formula indicates that the result of the calculation of the instance data values ​​corresponding to different constraint group index values ​​in the second instance data group corresponding to each associated function is equal to a constraint value; and verifying whether each constraint condition is satisfied based on the instance data in each of the first instances includes: For each of the constraint formulas, substitute the constraint group index value of the constraint formula into the constraint formula to obtain a third operation result, and verify whether the third operation result is equal to the constraint value corresponding to the constraint formula. If so, determine that the constraint formula holds; And / or, the constraint condition is a constraint formula, the constraint formula corresponding to each first instance is formed by calculating at least one function corresponding to the first instance, and the first polynomial and the second polynomial are both obtained by weighted calculation based on the constraint formula of the corresponding first instance; before verifying whether the first calculation result of the second polynomial is the same as the corresponding second calculation result, the method further includes: Substituting a specified group index value into the second polynomial to obtain the first calculation result, searching for an instance data value corresponding to the specified group index value from a number of instance data of each of the first instances, and performing a matching operation with the second polynomial on the found instance data value to obtain the second calculation result, wherein the specified group index value is determined by the prover or by the verifier.

6. The method according to claim 5, characterized in that Substituting the specified group index value into the second polynomial to obtain the first calculation result includes: Substituting the specified index value into the second polynomial, and performing multilinear expansion on each of the constraint expressions and other parameter items in the second polynomial after the substitution; Obtaining the first calculation result of the second polynomial after the multilinear expansion; And / or, before substituting the constraint group index value of the constraint formula into the constraint to obtain a third operation result, and verifying whether the third operation result is equal to the constraint value corresponding to the constraint formula, the method further includes: Performing a data consistency check on the instance data value corresponding to each of the group index values ​​in each of the first instances; And / or, the problem to be proved includes task running logic; different group index values ​​are used to represent different task running states, and the instance data value corresponding to the group index value is the running result under the corresponding task running state.

7. The method according to claim 3, characterized in that The plurality of first instance data are divided into at least one second instance data group, and each second instance data group has different data attributes; Before constructing the constraint conditions of each of the first instances based on the instance data in each of the first instances, the method further includes: Erasure coding is performed on each of the second instance data groups in each of the first instances to obtain each of the processed second instance data groups, wherein the amount of data in each of the processed second instance data groups is greater than the amount of data of the corresponding second instance data group before processing.

8. The method according to claim 1, characterized in that The step of using the second instance to generate a proof value for the problem to be proved includes: Using the second instance and the target hash function, construct a Merkle tree and generate a commitment value; Sending the commitment value to the verifier; Receive a random challenge point selected by the verifier based on the commitment value, and generate a proof value of the problem to be proved by using the second instance, the commitment value and the random challenge point.

9. A zero-knowledge verification method, characterized in that: The method comprises: Obtain a proof value sent by a prover regarding a problem to be proved, where the proof value is generated by a second instance obtained by superimposing a plurality of first instances; The proof value is used to verify whether the problem to be proved is correct.

10. An electronic device, characterized in that: comprising a memory and a processor coupled to each other, The memory stores program instructions; The processor is used to execute the program instructions stored in the memory to implement the method according to any one of claims 1 to 9.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program instructions that can be run by a processor, and the program instructions can be executed by the processor to implement the method according to any one of claims 1 to 9.

Images