A zero-knowledge proof generation method for optimizing resource utilization

Abstract

The application discloses a zero-knowledge proof generation method for optimizing resource utilization, which comprises zero-knowledge proof circuit automatic division and configurable pipeline parallel execution of sub-circuits, and aims to solve the problems of high memory consumption and low resource utilization rate in a zero-knowledge proof system. First, the complex zero-knowledge proof circuit is automatically divided into multiple sub-circuits, and the calculation process of the sub-circuits is ensured to be completed in series through public shared variables, so that the memory occupation in the proof generation process is reduced. Secondly, the witness generation stage and the proof calculation stage are decoupled, and a pipeline processing mode is introduced, so that the witness generation and the proof calculation between the sub-circuits are independently and coordinately executed in parallel, the resource utilization rate is optimized, and the parallel degree can be adjusted to adapt to different scene requirements. The application effectively reduces the memory use of the zero-knowledge proof system, significantly improves the resource utilization rate and the proof generation efficiency under the controllable memory condition, and thus improves the overall performance and the scalability of the system.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of zero-knowledge proof, and particularly relates to a zero-knowledge proof generation method with optimized resource utilization and high efficiency. BACKGROUND

[0002] Zero-knowledge proof (ZKP) protocol is a class of cryptographic protocols that allows a prover to convince a verifier of a statement's truth without revealing any underlying information. This powerful property makes ZKP the foundation of privacy protection technology. Among many ZKP systems, zero-knowledge succinct non-interactive argument of knowledge (ZK-SNARK) has become one of the most widely used solutions due to its efficiency and simplicity. The advantage of ZK-SNARK lies in its minimization of interaction in the proving and verification process, and even in the face of complex calculations, the generated proof is very small. These characteristics make ZK-SNARK particularly suitable for verifiable computing application scenarios.

[0003] Although the proof of ZK-SNARK is simple and the verification is efficient, the process of generating the proof is still a major challenge to its large-scale application. For the generation process of a zero-knowledge proof, it can usually be divided into two key steps: witness generation and proof computation. The former is responsible for generating intermediate variables (witness values) that satisfy the constraint system from the circuit input. This step usually needs to handle a large number of strong dependence calculations, and the generation of each intermediate result depends on the previous calculation results, resulting in poor parallelization capability of witness generation. Proof computation depends on the results of witness generation and must wait for witness generation to complete before proceeding, usually requiring a large number of arithmetic operations on a large finite field, resulting in a time required to generate a proof far exceeding the time required for verification. The computational complexity brings significant overhead. Many existing works have optimized the proof computation process in the proof generation process through algorithm improvement or hardware acceleration, significantly improving the time overhead and resource utilization of the proof computation process; but as another key process, witness generation gradually becomes the bottleneck of system performance improvement and resource utilization, seriously affecting the overall efficiency and scalability of the entire system.

[0004] Besides the parallelism issue in witness generation, zero-knowledge proof generation systems also face significant memory pressure during proof generation. Both witness generation and proof computation require substantial memory to store intermediate computation results and circuit constraints, and this memory requirement increases significantly with circuit complexity. Particularly when handling complex circuits or generating large-scale proofs, excessive memory consumption can prevent the system from handling multiple tasks simultaneously, thus limiting its parallel processing capabilities. Furthermore, excessive memory usage may even prevent the system from successfully completing proof generation under resource constraints. Therefore, optimizing memory usage and reducing memory consumption during proof generation are key challenges for ZK-SNARK systems in handling complex circuits and large-scale proof generation. Summary of the Invention

[0005] The purpose of this invention is to design a zero-knowledge proof generation method that optimizes resource utilization. By automatically partitioning the zero-knowledge proof circuit and implementing configurable pipelined execution of sub-circuits, it addresses the bottlenecks in memory usage and proof generation efficiency in existing zero-knowledge proof systems. This invention fully considers the characteristics of existing zero-knowledge proof generation technologies, such as the high coupling between witness generation and proof computation, low witness generation resource utilization, and large overall memory consumption. This invention effectively reduces system memory overhead and improves resource utilization, especially in scenarios involving continuous generation of large-scale circuit proofs, significantly enhancing the overall system performance and scalability. This invention is widely applicable to various verifiable computations and other applications requiring efficient proof generation.

[0006] The specific technical solution for achieving the objective of this invention is as follows:

[0007] A zero-knowledge proof generation method with optimized resource utilization includes an automatic partitioning method for zero-knowledge proof circuits and a configurable pipelined parallel execution method for sub-circuits; wherein,

[0008] The automatic partitioning method for zero-knowledge proof circuits divides the zero-knowledge proof circuit into several serializable sub-circuits. By publicizing the dependent calculation results between sub-circuits as shared variables, the independent calculation of each sub-circuit is completed, thereby reducing the memory occupation in the proof generation process and thus reducing the scalability limitation problem of the zero-knowledge proof system caused by memory issues.

[0009] The configurable pipelined parallel execution method of the sub-circuit decouples the witness generation stage and the proof calculation stage in the zero-knowledge proof generation process, and introduces a pipelined processing mode with configurable parallel granularity. This allows the witness generation and proof calculation stages between sub-circuits to be executed independently and in coordination, thereby improving the resource utilization of the entire process. At the same time, the pipeline parallel granularity can be flexibly adjusted to adapt to various different scenarios.

[0010] The zero-knowledge proof circuit automatic partitioning method specifically comprises the following steps:

[0011] Step A1: converting the constraint system corresponding to the zero-knowledge proof circuit into a constraint dependency graph CDG, calculating the out-degree and depth of each node, and obtaining all constraints without post-constraints for subsequent traversal;

[0012] Step A2: taking the out-degree and depth of the node as the priority calculation mode, performing post-order traversal on the CDG, and assigning a partition to the node during the traversal process;

[0013] Step A3: after the traversal is completed, restoring the obtained several partitions into the zero-knowledge proof sub-circuit constraint system, and obtaining the shared variables between the sub-circuits and the dependency relationship between the sub-circuits;

[0014] The configurable pipeline parallel execution method of the sub-circuit specifically comprises the following steps:

[0015] Step B1: initializing a witness generation and proof calculation queue, and setting the maximum parallel number of witness generation and proof calculation, respectively;

[0016] Step B2: according to the dependency relationship of the sub-circuit, adding the sub-circuit without pre-dependence of all to-be-calculated proof tasks to the witness generation queue;

[0017] Step B3: when the witness generation queue is not empty, according to the limitation of the parallel granularity, taking out a corresponding number of sub-circuits for parallel witness generation. After the calculation is completed, the sub-circuit is added to the proof calculation queue, and this step is parallel to step B2;

[0018] Step B4: when the proof calculation queue is not empty, according to the limitation of the parallel granularity, taking out a corresponding number of sub-circuits for proof calculation, and generating the zero-knowledge proof corresponding to the sub-circuit, and this process is parallel to steps B2 and B3;

[0019] Step B5: constantly repeating steps B2-B4 until all sub-circuit proofs of all to-be-proved tasks are generated completely.

[0020] Further, the step A1 comprises the following steps:

[0021] Step A11: initializing a constraint dependency graph CDG, which is a directed acyclic graph, wherein each vertex represents a constraint or input, and each edge represents an input or an output of a constraint as an input of another constraint, that is, there is a dependency relationship between the constraints or inputs represented by the two vertices;

[0022] Step A12: traversing all inputs in the constraint system corresponding to the circuit, including public inputs and private inputs, adding them as vertices to the CDG, and marking the vertices as corresponding public or private input vertices;

[0023] Step A13: traverse all constraints in the circuit corresponding constraint system, add them as vertices into the CDG; if the constraint depends on some pre-constraints or inputs, add corresponding edges in the CDG, update the out-degree of the pre-constraints; update the current constraint depth according to the depth of all pre-constraints of the constraint;

[0024] Step A14: traverse all non-input nodes in the CDG, get all constraints without post-constraints, i.e. no constraint depends on the calculation of these constraints.

[0025] Further, the step A2 comprises the following steps:

[0026] Step A21: initialize the current partition number as 1, and initialize the number of nodes contained in the current partition as 0; calculate how many nodes each partition can contain at most;

[0027] Step A22: sequentially traverse all nodes without post-sequenced nodes;

[0028] Step A23: for all pre-sequenced nodes of each node, calculate the priority according to the out-degree and depth of these nodes, preferentially traverse the nodes with smaller depth, and then preferentially traverse the nodes with smaller out-degree;

[0029] Step A24: if a node has no pre-sequenced node, if the node is an input node, assign the node to the current partition as an input; otherwise, assign the node to the current partition, and add one to the number of nodes contained in the current partition; if the number of current partitions reaches the upper limit, increment the current partition number, and reset the number of nodes contained in the current partition as 0;

[0030] Step A25: complete the traversal of all nodes, and get all node partitions, i.e. constraint partitions.

[0031] Further, the step A3 comprises the following steps:

[0032] Step A31: initialize all sub-circuit constraint systems; initialize a sub-circuit dependency graph, a directed acyclic graph, wherein each vertex represents a sub-circuit, and each edge represents that the calculation process of a sub-circuit needs another sub-circuit to calculate and expose a shared variable before starting calculation, i.e. there is a dependency relationship between the two sub-circuits;

[0033] Step A32: traverse all constraint partitions, each constraint partition corresponds to a sub-circuit constraint system, and the input nodes of each partition are added to the sub-circuit constraint system as inputs;

[0034] Step A33: traverse all constraints in the constraint partition, add the constraint to the sub-circuit constraint system; if the postcondition of a constraint does not belong to the partition, the constraint is a shared variable between two partitions, and a sub-circuit dependency is added in the sub-circuit dependency graph;

[0035] Step A34: traverse ends, get all sub-circuit constraint systems and sub-circuit dependency graphs.

[0036] The beneficial effects of the present application include:

[0037] The present application aims to improve the performance and resource utilization of zero-knowledge proof generation system, focusing on designing an efficient and high resource utilization zero-knowledge proof generation method that is flexible and adaptable to various scenarios. The purpose is to make the zero-knowledge proof system fully utilize resources, process proof generation requests more efficiently, and improve system performance. Specifically, to solve the problem of high memory occupation in the zero-knowledge proof system, the present application designs an automatic circuit partitioning algorithm, which divides the complex ZKP circuit into multiple sub-circuits and exposes the dependencies between sub-circuits as shared variables to complete independent computation of each sub-circuit, thereby reducing memory occupation in the proof generation process, further improving the flexibility of pipeline execution, and avoiding reducing the parallelization capability of the system due to memory occupation problems. To solve the problem of high coupling between witness generation and proof calculation and low resource utilization of witness generation, a configurable pipeline parallel execution method for sub-circuits is designed, which decouples witness generation and proof calculation, allowing these two key processes to be executed in parallel, thereby improving system resource utilization. By adjusting the parallel granularity, the present application can adapt flexibly according to system resources, thereby improving the overall performance of the system; by combining automatic circuit partitioning and pipeline execution mechanism, the present application significantly improves the resource utilization and proof generation efficiency of the zero-knowledge proof generation system under the premise of controllable memory. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 is the zero-knowledge proof generation method architecture proposed by the present application;

[0039] Figure 2 is the automatic circuit partitioning method for zero-knowledge proof proposed by the present application;

[0040] Figure 3 is the configurable pipeline parallel execution method for sub-circuits proposed by the present application. DETAILED DESCRIPTION

[0041] The present application will be further described in detail in combination with the following specific embodiments and drawings. The process, conditions, experimental methods, etc. for implementing the present application are generally known and common sense, and the present application does not have special limitations.

[0042] Figure 1 The overall architecture diagram of the zero-knowledge proof generation method proposed by the application is shown.

[0043] The zero-knowledge proof circuit automatic division method proposed by the application can divide a complex circuit into a plurality of serially computable sub-circuits.

[0044] In the application, each different proof generation request is defined as a "task". However, once the witness generation is completed, the proof calculation of the sub-circuit can be completely parallelized. In order to cope with the inconsistency of the time overhead of witness generation and proof calculation under different circuit structures or different resource configurations, the application designs a configurable pipeline mechanism, which allows dynamic adjustment of the parallel granularity of witness generation and proof calculation according to the actual situation.

[0045] Figure 2 The schematic diagram of the zero-knowledge proof circuit automatic division method proposed by the application is shown. In order to effectively manage large-scale zero-knowledge proof circuits, the application converts the constraint system of the circuit into a constraint dependency graph (CDG), which captures the dependency relationship between the constraints in the constraint system and converts the circuit division problem into a graph division problem. The construction process of CDG is shown in Algorithm 1:

[0046]

[0047]

[0048] comprising the following specific steps:

[0049] Step 1: First, the system initializes an empty graph G = (V, E), where V represents the set of nodes and E represents the set of edges. At the same time, the system initializes an empty array root for subsequent depth-first search (DFS) operations (lines 2-3 of Algorithm 1);

[0050] Step 2: Traverse all public and private inputs. For each input x, add the corresponding input node to G and mark the node as public or private input node according to the nature of the input (lines 4-7 of Algorithm 1);

[0051] Step 3: Traverse each constraint c in the constraint set C in turn. For each constraint c, add the corresponding constraint node to G. If an input x is an input of the constraint c, add an edge connecting x and c in the graph G (lines 8-13 of Algorithm 1);

[0052] Step 4: Traverse all constraint pairs. If the output of c_1 is the input of c_2, add an edge connecting c_1 and c_2 in the graph G and update the out-degree and depth of the corresponding nodes (lines 14-20 of Algorithm 1);

[0053] Step 5: Traverse all nodes in the graph G. If a node has no incoming edge in the graph, add it to the root node array root (lines 21-25 of Algorithm 1);

[0054] Step 6: Return the CDG and root for subsequent CDG partitioning (line 26 of Algorithm 1).

[0055] After obtaining the CDG, the present application uses a greedy algorithm for circuit partitioning. The first core goal of partitioning is to ensure that the partitioned sub-circuits have the ability to be executed serially. To achieve this requirement, the present application ensures that in any partition, the output of a previous sub-circuit does not depend on the input of a subsequent sub-circuit, thereby ensuring the independence and serializability of each sub-circuit. The second core goal of partitioning is "balance". The second core goal of partitioning is to achieve balance in the size of the sub-circuits and the number of shared variables. First, the size of the sub-circuit directly affects the memory usage in the proof generation process. Larger sub-circuits will occupy more memory resources, especially when dealing with large-scale circuits, which can cause system resources to be exhausted. Second, the number of shared variables is also one of the important factors for measuring the quality of partitioning. Although partitioning the circuit can reduce the memory usage of the entire circuit, too many shared variables will increase the memory consumption in the witness generation phase, offsetting the memory optimization effect brought by partitioning. In addition, each shared variable also increases the complexity of the verification process. Therefore, controlling the number of shared variables is crucial to ensuring memory efficiency and reducing verification overhead. Since the topological sorting of the graph is not unique, the problem is equivalent to finding a reasonable topological sorting that minimizes the number of shared variables while meeting the "serializable" requirement. To solve this problem, the present application traverses the CDG using a greedy algorithm. Specifically, during the depth-first traversal, nodes with fewer dependencies are preferentially assigned to the same sub-circuit to reduce the number of shared variables between sub-circuits. This process not only balances the computational complexity of each sub-circuit, but also minimizes the dependencies between sub-circuits as much as possible. The automatic partitioning method of zero-knowledge proof circuit proposed by the present application is shown in Algorithm 2:

[0056]

[0057]

[0058] The following key steps are included:

[0059] Step 1: First, the system initializes the partition set P = (V_1, V_2, …, V_k), where V_i represents the i-th partition. Initialize the current partition number p = 1 and the size of each partition At the same time, the system initializes the input node mapping table ips to record the partition to which the input node belongs (lines 2-4 of Algorithm 2).

[0060] Step 2: The system traverses the root node array root and calls the depth-first search (DFS) algorithm for each root node, traversing each node and its child nodes in turn (lines 5-7 of Algorithm 2).

[0061] Step 3: In the DFS procedure, first determine whether the current node v has been visited. If it has been visited and is not an input node, return directly. Otherwise, if node v is an input node, add the current partition number p to the input node set ips to which the input node belongs, and return (lines 12-18 of Algorithm 2).

[0062] Step 4: If node v is not an input node, the system marks the node as visited. Then, according to the depth and out-degree order of the child nodes, the system first traverses the child nodes with smaller depth, and then traverses the child nodes with smaller out-degree, recursively calls DFS to traverse each child node (lines 19-22 of Algorithm 2).

[0063] Step 5: After traversing the child nodes, add the current node v to the current partition. If the size of the current partition reaches the preset partition size s, increase the partition number p by 1, and continue to allocate nodes for the next partition (lines 23-26 of Algorithm 2).

[0064] Step 6: After DFS traverses all root nodes and their associated child nodes, the system constructs the subcircuit constraint system F and the subcircuit dependency graph D according to the partition set P and the input node set ips (line 8 of Algorithm 2).

[0065] Step 7: Return the subcircuit set and the subcircuit dependency graph (line 9 of Algorithm 2).

[0066] wherein,

[0067] In step 6, the algorithm for constructing subcircuits is shown in Algorithm 3:

[0068]

[0069] Including the following key steps:

[0070] Step 1: First, initialize all subcircuit constraint systems, as well as the subcircuit dependency graph D (lines 2-3 of Algorithm 3);

[0071] Step 2: Traverse each partition and instantiate the corresponding subcircuit for each partition (line 5 of Algorithm 3);

[0072] Step 3: For each partition, traverse each input in the input partition set. If the partition contains the input, add the input as a public or private input of the subcircuit (lines 6-10 of Algorithm 3);

[0073] Step 4: For each partition, traverse each node (constraint) in the partition. For each child node of the node, if the child node belongs to a different partition, add the output of the current node as a shared variable between the two subcircuits, and add a dependency in the subcircuit dependency graph (lines 11-18 of Algorithm 3);

[0074] Step 5: Return the set of sub-circuits and the sub-circuit dependency graph. (Line 20 of Algorithm 3).

[0075] Figure 3 A schematic diagram of the configurable pipeline execution mechanism proposed by the present application is shown. The present application achieves more efficient resource utilization and overall performance improvement by decoupling the witness generation and proof computation two key stages. In traditional ZKP system implementation, witness generation and proof computation are usually too highly coupled, leading to resource waste and performance bottlenecks. The pipeline mechanism of the present application allows witness generation and proof computation to be performed simultaneously between multiple tasks and different sub-circuits within each task. This parallel processing approach improves the resource utilization of the system, and can significantly improve system performance when the system needs to handle a large number of proof requests. In addition, the present application provides an interface for adjusting the parallelism, which can flexibly configure the parallel granularity of the pipeline according to the task load and resource status. This can adapt to various application scenarios and effectively improve resource utilization and system performance. The configurable pipeline execution mechanism proposed by the present application is shown in Algorithm 4:

[0076]

[0077] The following key steps are included:

[0078] Step 1: Initialize an empty witness generation queue Q_solve and an empty proof computation queue Q_prove (Line 2 of Algorithm 4).

[0079] Step 2: When all tasks have not been completed, run steps 3-5 in parallel;

[0080] Step 3: Parallel scheduling; check if any new sub-circuit is ready for execution, i.e. all its dependencies have been resolved. If so, add these sub-circuits to Q_solve for witness generation (Lines 4-6 of Algorithm 4);

[0081] Step 4: Parallel witness generation stage; select up to P_solve sub-circuits from Q_solve. Perform witness generation for each sub-circuit. After completion, move it to the Q_prove queue for proof computation (Lines 7-10 of Algorithm 4);

[0082] Step 5: Parallel proof computation stage; select up to P_prove sub-circuits from Q_prove, and perform proof computation for each sub-circuit (Lines 11-13 of Algorithm 4);

[0083] Step 6: Until the witness generation and proof computation of all tasks are completed, obtain the proof results of all sub-circuits.

[0084] To sum up, the application provides a zero-knowledge proof generation method which optimizes resource utilization and is efficient, solves the problem of high memory consumption in the existing zero-knowledge proof system through automatic division of the zero-knowledge proof circuit and the configurable pipeline parallel execution mechanism of the sub-circuit, effectively improves the utilization rate of system resources and the overall performance, and is particularly suitable for the continuous generation scene of large-scale circuit proof.

[0085] The protection scope of the application is not limited to the above embodiments. Changes and advantages that can be thought of by those skilled in the art without departing from the spirit and scope of the application are included in the application, and are protected by the appended claims.

Claims

1. A method for generating a zero-knowledge proof for optimizing resource utilization, characterized in that, The zero-knowledge proof circuit automatic division method is to divide the zero-knowledge proof circuit into a plurality of serializable sub-circuits, and to complete independent calculation of each sub-circuit by taking the dependent calculation results between the sub-circuits as shared variables and being disclosed. The zero-knowledge proof circuit automatic division method is to divide the zero-knowledge proof circuit into a plurality of serializable sub-circuits, and to complete independent calculation of each sub-circuit by taking the dependent calculation results between the sub-circuits as shared variables and being disclosed. The zero-knowledge proof circuit automatic division method is to divide the zero-knowledge proof circuit into a plurality of serializable sub-circuits, and to complete independent calculation of each sub-circuit by taking the dependent calculation results between the sub-circuits as shared variables and being disclosed. The zero-knowledge proof circuit automatic division method, specifically comprises: Step A1: converting the constraint system corresponding to the zero-knowledge proof circuit into a constraint dependency graph CDG, calculating the out-degree and depth of each node, and obtaining all constraints without post-constraints for subsequent traversal; Step A2: taking the out-degree and depth of the node as the priority calculation mode, performing post-order traversal on the CDG, and assigning a partition to the node during the traversal process; Step A3: after the traversal is completed, the obtained several partitions are restored to the zero-knowledge proof sub-circuit constraint system, and the shared variables between the sub-circuits and the dependency relationship between the sub-circuits are obtained; The zero-knowledge proof circuit automatic division method, specifically comprises: Step B1: initializing the witness generation and proof calculation queue, and setting the maximum parallel number of witness generation and proof calculation, respectively; Step B2: according to the sub-circuit dependency relationship, adding the sub-circuit without pre-dependence of all to-be-calculated proof tasks to the witness generation queue; Step B3: when the witness generation queue is not empty, according to the limitation of the parallel granularity, a corresponding number of sub-circuits are taken out for parallel witness generation; after the calculation is completed, the sub-circuit is added to the proof calculation queue, and this step is parallel to step B2; Step B4: when the proof calculation queue is not empty, according to the limitation of the parallel granularity, a corresponding number of sub-circuits are taken out for proof calculation, and the zero-knowledge proof corresponding to the sub-circuit is generated, and this process is parallel to steps B2 and B3; Step B5: repeatedly steps B2~B4 until all sub-circuit proofs of all to-be-proved tasks are generated.

2. The zero-knowledge proof generation method of claim 1, wherein, The step A1 comprises the following steps: Step A11: initializing the constraint dependency graph CDG, which is a directed acyclic graph, wherein each vertex represents a constraint or input, and each edge represents that the output of an input or a constraint is taken as the input of another constraint, that is, there is a dependency relationship between the constraints or inputs represented by the two vertices; Step A12: traversing all inputs in the constraint system corresponding to the circuit, including public inputs and private inputs, adding them as vertices to the CDG, and marking the vertices as corresponding public or private input vertices; Step A13: traversing all constraints in the constraint system corresponding to the circuit, adding them as vertices to the CDG; if the constraint depends on a pre-constraint or input, a corresponding edge is added in the CDG, and the out-degree of the pre-constraint is updated; the depth of the current constraint is updated according to the depth of all pre-constraints of the constraint. Step A14: traverse all non-input nodes in the CDG, get all constraints without post constraints, i.e. no constraint depends on the calculation of these constraints.

3. The zero-knowledge proof generation method of claim 1, wherein, The step A2 comprises the following steps: Step A21: initialize the current partition number as 1, and initialize the number of nodes contained in the current partition as 0; calculate how many nodes each partition can contain at most; Step A22: sequentially traverse all nodes without post nodes; Step A23: for all pre nodes of each node, calculate the priority according to the out-degree and depth of these nodes, preferentially traverse the nodes with small depth, and secondly preferentially traverse the nodes with small out-degree; Step A24: if a node has no pre node, assign the node to the current partition as input; Otherwise, assign the node to the current partition, and add one to the number of nodes contained in the current partition; if the number of current partitions reaches the upper limit, increment the current partition number, and reset the number of nodes contained in the current partition as 0; Step A25: complete the traversal of all nodes, get all node partitions, i.e. constraint partitions.

4. The zero-knowledge proof generation method of claim 1, wherein, The step A3 comprises the following steps: Step A31: initialize all sub-circuit constraint systems; initialize the sub-circuit dependency graph, a directed acyclic graph, wherein each vertex represents a sub-circuit, and each edge represents that the calculation process of a sub-circuit needs another sub-circuit to calculate and expose a shared variable before starting calculation, i.e. there is a dependency relationship between the two sub-circuits; Step A32: traverse all constraint partitions, each constraint partition corresponds to a sub-circuit constraint system, and the input nodes of each partition are added to the sub-circuit constraint system as input; Step A33: traverse all constraints in the constraint partition, and add the constraints to the sub-circuit constraint system; If the post constraint of a constraint does not belong to the partition, the constraint is regarded as a shared variable between two partitions, and a sub-circuit dependency relationship is added in the sub-circuit dependency graph; Step A34: after the traversal, all sub-circuit constraint systems and sub-circuit dependency graphs are obtained.

Images