High-efficiency pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof

Abstract

The invention discloses an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof. The method comprises the following steps: a preprocessing stage: processing an image file, generating and storing method parameters required by a subsequent stage, and an authentication element and snapshot information based on file content; in the image auditing stage, challenge parameters required by the auditing process are generated by using a pseudo-random function, an auditing task is executed based on the challenge parameters, evidence of the auditing process is generated, and the correctness of an auditing result is verified; in the image updating stage, semantic-level updating is executed based on the operation parameters, evidence of the updating process is generated, and the correctness of updating operation is verified; the method aims at relieving the calculation burden of the data owner, and is particularly suitable for the data owner with limited calculation resources in a decentralized storage environment.

Description

Technical Field

[0001] The present invention relates to the field of data security technology in decentralized storage systems, and in particular to an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof. Background Art

[0002] Decentralized storage systems are increasingly popular due to their ability to distribute data across multiple nodes, improving data availability, fault tolerance, and censorship resistance. By eliminating single points of failure, decentralized storage provides a powerful data management platform that makes information not only more secure from centralized attacks, but also easier to access from different geographical locations. These features make decentralized storage an attractive alternative to traditional centralized systems, especially in environments that require high security and data redundancy.

[0003] However, protecting data security within a decentralized storage system presents unique challenges. Since data is not stored in a centralized location, it becomes critical to ensure that data remains unchanged across nodes. The main concern is to ensure that data is not modified without authorization after initial storage, and the decentralized nature further exacerbates the protection of data integrity. Therefore, a strong audit mechanism is essential to maintain data integrity and security. An important branch of the current decentralized storage auditing field is to support data dynamism in the audit method, where data and corresponding audit certifications need to be updated. However, existing dynamic auditing solutions face two important problems in this regard.

[0004] First, these solutions only handle block-level updates, which regenerate the audit authenticators for the corresponding updated binary blocks within the file. However, block-level dynamic auditing is very counter-intuitive, as files like images are semantically updated based on pixels rather than binary bits. Second, when an image file is modified, the data owner in existing approaches must recalculate the audit authenticators associated with the modified data blocks in the image file. This approach is not only impractical in real applications, but also exhausts the local resources of the data owner due to the additional computational burden of recalculating or updating a large number of authenticators. Summary of the invention

[0005] The purpose of the present invention is to propose an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof, allowing data owners to directly update the audit authenticator based on pixels without dividing the image file into data blocks for comparison; this method aims to reduce the computational burden of data owners and is particularly suitable for data owners with limited computing resources in a decentralized storage environment.

[0006] To achieve the above purpose, the technical solution adopted by the present invention is: an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof, comprising the following steps:

[0007] Step 1, preprocessing stage: process the image file to generate and store the method parameters required for the subsequent stages, as well as the authentication metadata and snapshot information based on the file content;

[0008] Step 2, Image Audit Phase: Use a pseudo-random function to generate the challenge parameters required for the audit process, perform the audit task based on the challenge parameters, generate evidence of the audit process, and verify the correctness of the audit results;

[0009] Step 3, image update phase: perform semantic-level updates based on operation parameters and generate evidence of the update process to verify the correctness of the update operation.

[0010] As a further improvement of the present invention, in step 1, the method for generating the method parameters specifically includes the following steps:

[0011] A. Split image file: The data owner splits the image file I into multiple image blocks {Ii};

[0012] B. Select the generator: Select generators g and h in the cyclic group G1; in order to use the polynomial commitment scheme, randomly select the commitment opening point o and the private value χ, and calculate the public parameters The common parameters N P is the degree of the polynomial P(x);

[0013] C. Generate auxiliary verification information: For each image block I i , generate auxiliary verification information μ i ,in

[0014] D. Create ZKP arithmetic circuit: Based on different image operations, create ZKP arithmetic circuit φ for dynamic image auditing and generate key pairs (pk i , vk i , pk d , vk d ), the key pair is used to participate in the subsequent evidence generation and verification process;

[0015] E. Generate convolution kernel: Generate a set of convolution kernels {A i} is used for pixel representation of an image, where i∈[0, N P -1], and a random confounding factor α was used to prevent direct exposure;

[0016] F. Storage verification information: The image owner stores g locally α .

[0017] As a further improvement of the present invention, in step D, the method for creating the ZKP arithmetic circuit is specifically as follows:

[0018] The storage service provider DSP selects different circuits based on the request of the image owner, performs pixel-level updates on the locally stored original image, and provides proof of the entire update process; the proof is then sent to the image owner for verification; a circuit module is designed to represent the original image, that is, an audit is performed on the original image, the original image is operated to obtain its correct representation, and the representation information is sent to the image owner for verification.

[0019] As a further improvement of the present invention, the ZKP arithmetic circuit specifically includes:

[0020] Update subcircuit: used to process the original image at pixel level according to different operation parameters;

[0021] Representation subcircuit: used to operate on the original image to obtain a representation that is closely related to the original image.

[0022] As a further improvement of the present invention, in step 1, the method for generating authentication elements and snapshot information based on file content specifically includes the following steps:

[0023] a. The image owner converts each large image block I i ∈I is locally divided into NP×NH×NC small pixel matrices, where I i = {I i，0,0 , I i，0,1 , ..., I i，0,NC×NH-1 , ..., I i，NP-1,NC×NH-1 Each group of NH pixel matrices is compressed to obtain a hash matrix H i ={H i，0,1 , ..., H i，0,NC-1 , ..., H i，NP-1,NC-1}, where H i，j，l Represents the hash operation H(I i，j，l×NH , ..., I i，j，(l+1)NH-1 ), j∈[0, NP-1], l∈[0, NC-1];

[0024] b. Convolution operation: Use a convolution kernel of size NC to perform weighted aggregation on the hash matrix to obtain the convolution coefficient C i ={C i，0 , C i，1 , ..., C i,NP-1}, where C i ,m=Conv({H i}, {A i}), Conv means using {A i}In {H i}Convolution operation performed on

[0025] c. Polynomial representation: Use polynomial commitment to represent each image block I i is the polynomial P i (x) = C i，0 +C i，1 x+C i， 2x 2 +…+C i，NP-1 x NP-1 , and finally get the commitment value P i (o), where using the commitment opening point o, the image owner computes the corresponding data authenticator for each image block as

[0026] d. Calculate snapshot information: Use the generated authentication element to calculate the snapshot information Finally, the file {I i}、Data Authenticator{τ i} and snapshot information sn are sent to the service provider DSP.

[0027] As a further improvement of the present invention, in step 2, generating evidence of the audit process specifically includes the following steps:

[0028] (1) The image owner initiates a challenge: The image owner generates two random keys λ1 and λ2, and specifies the number of image blocks I that need to be checked. After that, the image owner sends (λ1, λ2, I) to the data storage provider DSP.

[0029] (2) DSP generates a challenge set: DSP uses the received λ1 and λ2 to generate a challenge set Ω = (i, η i ), where i is the index of the image block, using the pseudo-random permutation function π λ1 (k) generate; η i is a random coefficient, obtained by pseudo-random function f λ2 (k) Generate; DSP accepts the challenged image block {Ii} and random coefficient η i , and a convolution kernel matrix called αAi, which is used to process the image block;

[0030] (3) DSP calculates and proves π: DSP uses the image audit circuit Ψ to calculate and prove π: π←Prove Ψ (pk d , {αA i},Ψ,{I i} i∈Ω , {η i} i∈Ω , Ca ), where Ca is the linear polymerization coefficient

[0031] (4) DSP generates auxiliary proof ω τ :DSP for the unchallenged image block I j Generate auxiliary proof ω τ : in,

[0032] (5) DSP packages all the results and sends them to the image owner: DSP sends the calculated proof π and auxiliary proof ω τ Packaged into a whole proof Prf and sent to the image owner.

[0033] As a further improvement of the present invention, in step 2, when verifying the correctness of the audit result, the smart contract SC performs a verification operation to determine whether the DSP has performed the correct audit operation according to the challenge by verifying the proof information sent by the DSP, which specifically includes the following steps:

[0034] 1) Generate a challenge set and reconstruct the proof: After receiving the proof, the SC first regenerates the challenge set Ω using the same challenge parameters (λ1, λ2, I) to ensure that it is consistent with the calculation result of the DSP;

[0035] 2) Verify the correctness of the ZKP circuit: SC uses the circuit to verify the key vk d , prove π and public witness Ca to verify that the ZKP circuit Ψ is correct: Make sure there are no miscalculations;

[0036] 3) Verify the calculation results of the circuit: SC uses the locally stored public parameters γi and g α Verify the calculation results of the circuit to ensure the correctness of the calculation results:

[0037] 4) Use the auxiliary verification information μ to verify the auxiliary proof: through the formula SC ensures that unchallenged data blocks are also correct; if all verification formulas are valid, the proof process passes and data integrity is confirmed; if any verification step fails, SC reports the failure and terminates the audit process.

[0038] As a further improvement of the present invention, in step 3, generating evidence of the update process specifically includes the following steps:

[0039] ① After receiving the modification information including image I, proof parameter λ3, operation type op and operation parameters, DSP loads the original image I and selects the appropriate dynamic update circuit φ from the library according to the operation type op opPerform subsequent calculations; then, DSP determines the set Δ={(i, η i )}, where i is the image block {I i}, η i is the random coefficient corresponding to that index;

[0040] ②Select dynamic update circuit: Select the appropriate dynamic update circuit φ according to the operation type op op , and load the original image I;

[0041] ③It is necessary to obtain the convolution coefficient of the current image I C i，j {i∈Δ, j∈[0, N P -1], and construct the polynomial And get the aggregated coefficient C a ;

[0042] ④Use dynamic update circuit φ op , according to the original image I, the updated image I′, the coefficient C a and the blinded convolution kernel matrix αA i , DSP executes dynamic update circuit φ o p, and get the circuit proof:

[0043] ⑤Computation-assisted proof:

[0044]

[0045] Then, DSP will assist the evidence ω τ , circuit proof π, coefficient information C a and the authentication element τ of the image data {i} Sent to data owner for verification.

[0046] As a further improvement of the present invention, in step 3, verifying the correctness of the update operation specifically includes the following steps:

[0047] i. Use the circuit's verification key to verify the dynamically updated circuit calculation: If the verification is successful, it means that the image pixel operation performed by the DSP is consistent with the result performed locally by the image owner, verifying the correctness of the operation;

[0048] ii. Verify the coefficient information sent by DSP to determine whether DSP operates on the original data, which is equivalent to the verification of an audit process:

[0049]

[0050] iii. Check the auxiliary evidence at the same time:

[0051]

[0052] If all equalities hold, the update verification passes.

[0053] The present invention provides an efficient pixel-level dynamic image auditing method in decentralized storage. The decentralized storage auditing method aims to ensure data security in dishonest decentralized storage providers. However, how the auditing process supports efficient dynamic data updates has always been a severe challenge. Existing dynamic auditing methods can only handle block-level updates, and semantic changes need to be converted into binary changes. In addition, existing dynamic auditing methods require data owners to recalculate auxiliary auditing information, which adds additional burden to data owners. The present invention proposes an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof, which can support semantic-level updates in the auditing process while eliminating the dynamic operation overhead generated by the audit on the data owner side. Experimental results show that the scheme has advantages in storage overhead and computational overhead.

[0054] The beneficial effects of the present invention are:

[0055] This invention aims to improve data integrity and security through innovative methods and provide a more effective dynamic audit solution for decentralized storage systems. Specifically, the innovations of this invention are mainly focused on the following aspects:

[0056] 1. This paper proposes an efficient pixel-level dynamic auditing method for decentralized storage. By integrating polynomial commitment and convolution into the authenticator construction, this paper also designs a pixel-based lightweight image authenticator to directly map image pixels to the authenticator.

[0057] 2. The present invention further designs a dynamic mechanism without an owner, which eliminates the extra overhead in dynamic auditing by utilizing zero-knowledge proof technology. The present invention constructs a dynamic update circuit through zero-knowledge proof, which proves the update and representation of the image in the authenticator. Not only can the image update process be recorded and guaranteed, but the validity of the original image can also be proved through the circuit and the authenticator. Therefore, by ensuring the dynamic process of auditing through zero-knowledge proof in DSP, the dynamic operation overhead incurred by the data owner due to auditing can be completely eliminated.

[0058] 3. Through extensive experimental evaluation, the present invention outperforms the existing technology in terms of audit performance, and the dynamic update speed is increased by 210 times. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 is a system structure diagram of an embodiment of the present invention;

[0060] Figure 2 A schematic diagram of generating a verification element in an embodiment of the present invention;

[0061] Figure 3 A schematic diagram of image updating in an embodiment of the present invention;

[0062] Figure 4 This is an example diagram of a dynamic update circuit design in an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0064] Example 1

[0065] like Figure 1 As shown in the figure, an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof is divided into two stages: 1. Image auditing stage 2. Image update stage. Before the two stages, a preprocessing stage is required to generate the parameters and data required for the process. The implementation steps are as follows:.

[0066] Step (1) Setup phase: Generate and store method parameters required for subsequent phases;

[0067] Step (2) Preprocessing stage: Generate and store authentication metadata and snapshot information based on file content;

[0068] Step (1) generates the method parameters and secret keys required for the subsequent stages, specifically:

[0069] 1.1) Splitting the image file: The data owner splits the image file I into multiple image blocks {Ii}, and all subsequent operations are performed in units of image blocks.

[0070] 1.2) Generator selection: Select generators g and h in the cyclic group G1. To use the polynomial commitment scheme, randomly select the commitment opening point o and the private value χ, and calculate the public parameter The common parameters N P is the degree of the polynomial P(x).

[0071] 1.3) Generate auxiliary verification information: For each image block I i , generate auxiliary verification information μ i ,in

[0072] 1.4) Create ZKP arithmetic circuit: Based on different image operations (such as image flipping, cropping, grayscale, etc.), create ZKP arithmetic circuit φ for image dynamic auditing and generate their key pairs (pk i , vk i, pk d , vk d ), the key pair will be involved in the subsequent evidence generation and verification. The specific design structure of the ZKP circuit is as follows:

[0073] DSP (Decentralized Storage Provide) selects different circuits according to the request of the image owner, updates the original image stored locally at the pixel level, and provides proof of the entire update process. The proof is then sent to the image owner for verification. However, this circuit cannot guarantee that the original image input into the circuit meets the requirements of the image owner. Therefore, this method also designs a circuit module to represent the original image, that is, to perform an audit on the original image, mainly to operate on the original image to obtain its correct representation. Finally, this representation information is sent to the image owner for verification. In the actual circuit implementation, this method divides these functions into two sub-circuits: an update sub-circuit and a representation sub-circuit.

[0074] Update subcircuit: Responsible for pixel-level processing of the original image according to different operation parameters. This design allows the image owner to simply send the operation parameters, and all logical operations for updating the authentication element are implemented by the remote DSP, effectively reducing the operation burden on the image owner.

[0075] Representation subcircuit: It mainly operates on the original image to obtain a representation that is closely related to the original image. By verifying this representation, the image owner can initiate a similar audit operation on the original image to determine whether the original image in the circuit is correct. Also note that the representation subcircuit can also participate in the image audit phase to generate evidence.

[0076] 1.5) Generate convolution kernels: In order to achieve pixel-level updates, this method also generates a set of convolution kernels {A i} is used for pixel representation of an image, where i∈[0, N P -1] and use a random confounding factor α to prevent direct exposure.

[0077] 1.6) Storing verification information: For subsequent verification, the image owner stores g locally α ,Apart from this, the image owner does not have to store any additional information.

[0078] Step (2) processes the image file, such as Figure 2 As shown, the parameters required for subsequent audits such as authentication elements are generated, specifically:

[0079] 2.1) The image owner takes each large image block I i ∈I is locally divided into NP×NH×NC small pixel matrices, where Ii = {I i，0,0 , I i，0,1 , ..., I i，0,NC×NH-1 , ..., I i，NP-1,NC×NH-1 Each group of NH pixel matrices is compressed to obtain a hash matrix H i ={H i，0,1 , ..., H i，0,NC-1 , ..., H i，NP-1,NC-1}, where H i，j，l Represents the hash operation H(I i，j，l×NH , ..., I i，j，(l+1)NH-1 ), j∈[0,NP-1],l∈[0,NC-1].

[0080] 2.2) Convolution operation: Use a convolution kernel of size NC to perform weighted aggregation on the hash matrix to obtain the convolution coefficient C i ={C i，0 , C i，1 , ..., C i,NP-1}, where C i ,m=Conv({H i}, {A i}), Conv means using {A i}In {H i} is a convolution operation performed on .

[0081] 2.3) Polynomial representation: Use polynomial commitment to represent each image block I i is the polynomial P i (x) = C i,0 +C i，1 x+C i，2 x 2 +…+C i，NP-1 x NP-1 , and finally get the commitment value P i (o), where using the commitment opening point o, the image owner computes the corresponding data authenticator for each image block as

[0082] 2.4) Calculate snapshot information: Use the authentication element generated in the above steps to calculate the snapshot information Finally, the file {I i}、Data Authenticator{τ i} and snapshot information sn are sent to DSP.

[0083] The above is the preprocessing process required for both stages. In addition, different operations are required according to different stages. The subsequent steps for the image audit stage are as follows:

[0084] Step (3) Challenge generation phase: The method uses a pseudo-random function to generate the challenge parameters required for the audit process based on the challenge parameters;

[0085] Step (4) Evidence generation phase: The method performs the audit task based on the challenge parameters and generates evidence of the audit process;

[0086] Step (5) Verification phase: Method verification of the correctness of the audit results;

[0087] The specific implementation steps are as follows:

[0088] 3.1) Image owner initiates a challenge

[0089] The image owner generates two random keys λ1 and λ2, and specifies the number of image blocks to be checked I. Afterwards, the image owner sends (λ1, λ2, I) to the data storage provider (DSP).

[0090] When DSP receives the challenge parameters, it will further generate audit evidence about the challenge. The specific steps are as follows:

[0091] 4.1) DSP generation challenge set:

[0092] DSP uses the received λ1 and λ2 to generate a challenge set Ω = (i, η i ). Where i is the index of the image block, using the pseudo-random permutation function π λ1 (k) generate; η i is a random coefficient, obtained by pseudo-random function f λ2 (k) Generation. DSP accepts these challenge image blocks {Ii}, random coefficient η i , and a convolution kernel matrix called αAi, which is used to process the image block.

[0093] 4.2) DSP calculation proves π:

[0094] DSP uses image audit circuit Ψ to calculate and prove π: π←Prove Ψ (pk d , {αA i},Ψ,{I i} i∈Ω , {η i} i∈Ω , C a ), where Ca is the linear polymerization coefficient

[0095] 4.3) DSP generates auxiliary proof ω τ :

[0096] DSP for the unchallenged image block I jGenerate auxiliary proof ω τ : in, It is worth noting that this proof is generated based on the remaining unchallenged image blocks, ensuring that all blocks that have not been directly checked are still valid.

[0097] 4.4) DSP packages all results and sends them to the image owner:

[0098] DSP will calculate the proof π and the auxiliary proof ω τ Packaged into a whole proof Prf and sent to the image owner.

[0099] Finally, in step (5), the Smart Contract (SC) performs a verification operation. It verifies the proof information sent by the DSP to determine whether the DSP has performed the correct audit operation according to the challenge. The specific steps in step (5) are as follows:

[0100] 5.1) Generate a challenge set and reconstruct the proof:

[0101] After receiving the proof, the SC first regenerates the challenge set Ω using the same challenge parameters (λ1, λ2, ,) to ensure that it is consistent with the calculation result of the DSP.

[0102] 5.2) Verify the correctness of the ZKP circuit:

[0103] SC uses vk d (circuit verification key), proof π, and public witness Ca (consisting of the coefficients of the proof polynomial P(×)) to verify that the ZKP circuit Ψ is correct: Make sure there are no miscalculations.

[0104] 5.3) Verify the calculation results of the circuit:

[0105] SC uses the locally stored public parameters γi and g α Verify the calculation results of the circuit. This step uses a bilinear pairing operation to ensure the correctness of the calculation results:

[0106] 5.4) Use auxiliary verification information μ to verify the auxiliary proof:

[0107] Since the SC cannot access the private value χ, the verification process relies on the auxiliary verification information μ to verify ω τ The correctness of SC can ensure that the data blocks that have not been challenged are also correct. If all verification formulas are established, the proof process is passed and the data integrity is confirmed. If any verification step fails, SC will report the failure and terminate the audit process.

[0108] At this point, the image audit phase is completed. Figure 3 As shown, the subsequent specific steps for dynamic update are as follows:

[0109] Step (3) Evidence generation phase: The method performs semantic-level updates based on the operation parameters and generates evidence of the update process;

[0110] Step (4) Verification phase: the method verifies the correctness of the update operation;

[0111] The specific implementation details are as follows:

[0112] In step (3), the image owner wants to update the image data. He first updates the image I locally. In order to update the image information stored in the DSP, the DSP needs to perform the update operation, that is, complete the operation expected by the image owner, and generate a proof of the operation process, and finally send it to the image owner for verification. However, the DSP update process in this method does not require the data owner to participate in addition. The specific description in step (3) is as follows:

[0113] 3.1) After receiving the modification information including image I, proof parameter λ3, operation type op and operation parameters, DSP loads the original image I and selects the appropriate dynamic update circuit φ from the library according to the operation type op op Then, the DSP determines the set Δ={(i, η i )}, where i is the image block {I i}, η i is the random coefficient corresponding to the index; the example diagram of the dynamic update circuit design is as follows Figure 4 shown.

[0114] 3.2) Select dynamic update circuit: Select the appropriate dynamic update circuit φ according to the operation type op op , and load the original image I.

[0115] 3.3) In order to ensure that the image being operated is what the user wants, it is also necessary to obtain the convolution coefficient of the current image I C i，j {i∈Δ, j∈[0, N P -1], and construct the polynomial And get the aggregated coefficient C a .

[0116] 3.4) Using the dynamic update circuit φ op , according to the original image I, the updated image I′, the coefficient C a and the blinded convolution kernel matrix αA i, DSP executes dynamic update circuit φ o p, and get the circuit proof:

[0117] 3.5) Computational assisted proof:

[0118]

[0119] Then, DSP will assist the evidence ω τ , circuit proof π, coefficient information C a and the authentication element τ of the image data {i} Sent to data owner for verification.

[0120] Finally, in step (4), the data owner performs a verification operation. He verifies the proof information sent by the DSP to determine whether the DSP has performed the correct update operation as he imagined. The specific steps in step (4) are as follows:

[0121] 4.1) Use the circuit’s verification key to verify the dynamically updated circuit calculation: If the verification is successful, it means that the image pixel operation performed by the DSP is consistent with the result performed locally by the image owner, which verifies the correctness of the operation.

[0122] 4.2) Verify the coefficient information sent by DSP to determine whether DSP operates on the original data. This step is equivalent to the verification of an audit process:

[0123]

[0124] 4.3) Check the supporting evidence at the same time:

[0125]

[0126] If all equations hold, the update verification passes. This means that the DSP's operation meets the data owner's expectations, and the user does not perform additional operations during the entire dynamic audit process, effectively reducing the data owner's computational overhead.

[0127] Example 2

[0128] Assume that there is a decentralized medical image storage platform. As the image owner, the hospital stores the patient's medical scan images on a decentralized storage service provider (DSP) to reduce storage costs and improve data availability and security. The hospital hopes to use a dynamic audit mechanism to ensure that the DSP cannot tamper with the image content without the hospital's permission. At the same time, it needs to be able to remotely update the image data, such as adding tags or annotations, and ensure the correctness of the update.

[0129] The following embodiment describes in detail how to use this method in reality to simulate the dynamic update process of a patient's scan image.

[0130] Scenario description:

[0131] The hospital uploads the MRI scan image of patient X to the decentralized storage platform. The hospital wants to operate on the tumor area in the image and update the image through the decentralized storage service (DSP). In order to ensure that the DSP correctly performs the image update operation and guarantees the integrity of the image during storage, the hospital uses a dynamic audit method to verify the update of the DSP.

[0132] Specific steps:

[0133] Step (1) Generate the required parameters and keys:

[0134] As the owner of the image, the hospital needs to first perform initialization operations to generate the parameters required in the audit process.

[0135] 1.1) Split image files:

[0136] The hospital divides the MRI scan image I of patient X into multiple pixel blocks {I i}, the image is divided into several 128*128 to 16*16 pixel blocks, so that different areas can be operated independently, and the image is usually stored in uint8 (8-bit unsigned integer) format, indicating that the pixel value range of the grayscale image is 0-255. Each 128×128 pixel block occupies 16KB of space.

[0137] 1.2) Select the generator:

[0138] Select generators g and h in the cyclic group G1. Randomly select a commitment opening point o and a private value χ, where o is a random number in the finite field F_p, χ is also in the finite field F_p, and the size is usually 256 bits, and calculate the public parameter Here N P is the degree of the polynomial P(x). i is the exponential operation of the generator in the polynomial commitment scheme, These parameters will be used in a polynomial commitment scheme to ensure the integrity of each pixel block.

[0139] 1.3) Generate auxiliary verification information:

[0140] For each pixel block I i , the hospital generates 256-bit auxiliary verification information This auxiliary information will be used to verify the authenticity and integrity of the pixel blocks in subsequent audits.

[0141] 1.4) Create a ZKP circuit:

[0142] The hospital designed two types of zero-knowledge proof circuits (ZKP circuits) for dynamic image auditing:

[0143] Update subcircuit: Processes pixel-level update operations, such as image labeling instructions sent by the hospital, such as image grayscale processing, image cropping, image contrast adjustment, etc.

[0144] Representation subcircuit: Ensure that the image stored on the DSP has not been tampered with and is consistent with the original image in the hospital. This is very important for the patient's condition. Any related forgery or modification will have immeasurable consequences.

[0145] The hospital generates a ZKP circuit based on specific image operations (such as adding tags) and generates a key pair (pk i , vk i ), where pk i is the proof generation key used to update the image, vk i It is the key used to verify the update, and its length can be 256 to 512 bits depending on the security requirements.

[0146] 1.5) Generate convolution kernel:

[0147] The hospital generates a set of random convolution kernels {A i} to represent each pixel block I i , usually a 3×3 or 5×5 matrix, the size depends on the requirements of the convolution operation. Each element is an integer in a finite field, and the convolution kernel is protected by a confusion factor α to avoid directly exposing the content of the convolution operation.

[0148] 1.6)Store verification information:

[0149] The hospital will α Stored locally as necessary information for subsequent verification of pixel block authentication. The hospital does not need to store any additional information, reducing the local storage burden.

[0150] Step (2): Process the image and generate authentication elements:

[0151] 2.1) Image Segmentation and Hashing:

[0152] The hospital will each pixel block I i Further divide it into multiple small pixel matrices and generate a hash value H for each pixel matrix i To ensure the integrity of the image data, the hash operation here can use hash functions such as SHA-256 or SHA-3 to generate a 256-bit hash value.

[0153] 2.2) Convolution operation:

[0154] The hospital's hash matrix H for each pixel block i Perform convolution operation to generate convolution coefficient C i These convolution coefficients will be used in the subsequent generation of the image authenticator.

[0155] 2.3) Polynomial Commitment:

[0156] The hospital uses polynomial commitment to represent each pixel block as a polynomial P i (x), and calculate the commitment value P i (o). The hospital then generates an authentication element for each pixel block. For subsequent auditing, each authentication element is an element in group G_1 and has a size of 256 bits.

[0157] 2.4) Calculate snapshot information:

[0158] Hospital Computing Snapshot Information And send the pixel block, authentication element and snapshot information to DSP.

[0159] After performing the above preprocessing process, the hospital should send random challenges from time to time to check whether the data stored on the DSP is complete. The steps of the audit phase are as follows:

[0160] Step (3): Challenge generation:

[0161] 3.1) Image owner initiates a challenge

[0162] The hospital (image owner) generates two random keys λ1 and λ2. These two keys will be used to generate image block indexes and random coefficients to ensure the randomness of the challenge. For example, λ1 and λ2 can be 128-bit random numbers. At the same time, the hospital decides the number of image blocks I to be checked. Suppose the hospital wants to check 5 image blocks. I is an integer, such as type uint32, indicating the number of blocks to be checked. The hospital sends (λ1, λ2, I) to the DSP. These parameters will be used to generate the challenge set Ω.

[0163] Step (4) Evidence generation:

[0164] 4.1) DSP generation challenge set:

[0165] DSP uses the received keys λ1 and λ2 to generate the challenge set Ω. Using the pseudo-random permutation function π λ1 (k) Generate the index i of the image block (i.e., randomly select I blocks from image blocks 1 to n). Pseudo-random coefficient η i By pseudo-random function f λ2(k) is generated to provide randomness in subsequent calculations. Assume that the image block index to be challenged is Ω = (3, η3), (5, η5), (7, η7), (11, η 11 ), (15, η 15 ). Each η i is a finite field F p The elements in .

[0166] In addition, the DSP accepts the challenged image block {Ii} and the corresponding convolution kernel matrix αAi, which are used for subsequent calculations. The size of the convolution kernel matrix αAi is 3×3 or 5×5, each element is located in a finite field, and the matrix size is related to the processing requirements of the image block.

[0167] 4.2) DSP calculation proof π :

[0168] DSP uses the audit circuit Ψ to process the above image blocks, random coefficients and convolution kernel matrix to calculate the proof π The proof process is performed through the linear aggregation coefficient Ca and the challenge block set: π ←Prove Ψ (pk d , {αA i},Ψ,{I i} i∈Ω , {η i} i∈Ω , C a ), where Ca is the linear polymerization coefficient

[0169] 4.3) DSP generates auxiliary proof ω τ :

[0170] DSP generates auxiliary proof ω for the unchallenged image block {lj} τ , ensuring that blocks not directly checked are also complete. Auxiliary Proof ω τ Generated by the coefficients θ of the remaining blocks. θ is the coefficient of the polynomial used to represent these unchallenged blocks

[0171] 4.4) DSP packaging certificate:

[0172] DSP will prove π and auxiliary proof ω τ The data is packaged into a whole certificate Prf and sent to the hospital (image owner). The certificate is a data packet containing all the calculation results.

[0173] Step (5) Verification phase:

[0174] 5.1) Generate a challenge set and reconstruct the proof:

[0175] After receiving the proof, the SC (smart contract) regenerates the challenge set Ω using the previous challenge parameters (λ1, λ2, I) to ensure that it is consistent with the calculation result of the DSP.

[0176] 5.2) Verify the correctness of the ZKP circuit:

[0177] SC uses the verification key vk d , prove π and the public witness Ca verifies that the calculation of circuit Ψ is correct: vk d is the key for circuit authentication, which may be 256 or 512 bits in size.

[0178] Step 5.3) Verify the calculation results of the circuit:

[0179] SC uses locally stored public parameters γ i and = g α Verify the calculation results of the circuit. This step uses a bilinear pairing operation to ensure the correctness of the calculation results:

[0180] 5.4) Use auxiliary verification information μ to verify ωτ:

[0181] Since the SC cannot access the private value χ, the verification process relies on the auxiliary verification information μ to verify ω τ The correctness of Verification is performed to ensure that the data blocks that have not been challenged are also complete. If all verification formulas are established, the proof process passes and the data integrity is confirmed. If any verification step fails, the SC will report the failure and terminate the audit process.

[0182] The above is the entire process of the audit stage. In addition to the audit process, the hospital should also be able to dynamically update the data on the DSP. The specific implementation steps of this stage are as follows:

[0183] Step (3): Image update:

[0184] The hospital decides to update the MRI images of patient X stored in the DSP and adjust the contrast of the images to increase the visibility of the images.

[0185] 3.1) Submit an update request:

[0186] The hospital submits an image update request to the DSP. The update content includes the updated proof parameter λ3 (used to generate random values ​​in the audit), the operation type op (such as contrast adjustment operation), and the operation parameters (such as the value of the α parameter in the adjustment process, etc.).

[0187] 3.2) DSP selects update circuit:

[0188] DSP selects the corresponding dynamic update circuit φ according to the operation type op op To handle image updates. For example, in a contrast adjustment scenario, the update circuit selected by the DSP will handle the color changes in the specified area.

[0189] 3.3) DSP obtains convolution coefficients:

[0190] DSP calculates the convolution coefficients of the current image. And construct the polynomial And get the aggregated coefficient C a . Used to confirm that the image update results are consistent with expectations.

[0191] 3.4) Execute the update circuit:

[0192] DSP uses update circuit φ op , based on the original image I and the update parameters specified by the hospital, an update operation is performed to generate a new image I′. The DSP also generates a proof of the circuit π: To prove the correctness of the update operation, its size is usually 512 bits or longer, depending on the complexity of the ZKP.

[0193] 3.5) Computational assisted proof:

[0194] DSP generates auxiliary proof ω τ : And we will prove that π, the convolution coefficient C a and authentication element τ i Sent to the hospital for verification.

[0195] Step (4): The hospital verifies the DSP update operation:

[0196] 4.1) Verify the dynamic update circuit calculation:

[0197] After the hospital receives the updated results and certification from the DSP, it uses the verification key vk i Verify that the dynamic update circuit is calculated correctly: If the verification passes, the hospital can confirm that the DSP performed the changes correctly.

[0198] 4.2) Verify the convolution coefficients:

[0199] The hospital verifies the convolution coefficient C sent by DSP a , to confirm whether the DSP has updated the image according to the hospital's instructions. This step is equivalent to an audit operation to ensure that the DSP has not tampered with the original data:

[0200]

[0201] 4.3) Check the supporting evidence:

[0202] Hospital examination auxiliary certificate τ To verify the behavior of DSP in the update operation. The hospital verifies the auxiliary evidence through the following equation:

[0203]

[0204] If all verifications pass, the hospital can confirm that the update operation performed by the DSP is correct and there is no unauthorized tampering.

[0205] This paper proposes an efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof, which can support semantic level updates during the audit process and eliminate the dynamic operation overhead generated by the audit of the data owner. Experimental results show that the scheme has advantages in storage overhead and computational overhead.

[0206] The above-mentioned embodiments only express the specific implementation of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. An efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof, characterized in that: The following steps are involved: Step 1, preprocessing stage: process the image file to generate and store the method parameters required for the subsequent stages, as well as the authentication metadata and snapshot information based on the file content; Step 2, Image Audit Phase: Use a pseudo-random function to generate the challenge parameters required for the audit process, perform the audit task based on the challenge parameters, generate evidence of the audit process, and verify the correctness of the audit results; Step 3, image update phase: perform semantic-level updates based on operation parameters and generate evidence of the update process to verify the correctness of the update operation.

2. The efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof according to claim 1 is characterized in that: In step 1, the method for generating method parameters specifically includes the following steps: A. Splitting image files: The data owner splits the image file I into multiple image blocks {I i }; B. Select the generator: Select generators g and h in the cyclic group G1; in order to use the polynomial commitment scheme, randomly select the commitment opening point o and the private value χ, and calculate the public parameters The common parameters N P is the degree of the polynomial P(x); C. Generate auxiliary verification information: For each image block I i , generate auxiliary verification information μ i ,in D. Create ZKP arithmetic circuit: Based on different image operations, create ZKP arithmetic circuit φ for dynamic image audit and generate key pair (pk i ,vk i ,pk d ,vk d ), the key pair is used to participate in the subsequent evidence generation and verification process; E. Generate convolution kernel: Generate a set of convolution kernels {A i } is used for pixel representation of an image, where i∈[0,N P -1], and a random confounding factor α was used to prevent direct exposure; F. Storage verification information: The image owner stores g locally α .

3. The efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof according to claim 2 is characterized in that: In step D, the method for creating the ZKP arithmetic circuit is as follows: The storage service provider DSP selects different circuits based on the request of the image owner, performs pixel-level updates on the locally stored original image, and provides proof of the entire update process; the proof is then sent to the image owner for verification; a circuit module is designed to represent the original image, that is, an audit is performed on the original image, the original image is operated to obtain its correct representation, and the representation information is sent to the image owner for verification.

4. The efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof according to claim 3 is characterized in that: The ZKP arithmetic circuit specifically includes: Update subcircuit: used to process the original image at pixel level according to different operation parameters; Representation subcircuit: used to operate on the original image to obtain a representation that is closely related to the original image.

5. The efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof according to claim 3 or 4, characterized in that: In step 1, the method for generating authentication metadata and snapshot information based on file content specifically includes the following steps: a. The image owner converts each large image block I i ∈I is locally divided into NP×NH×NC small pixel matrices, where I i = {I i,0,0 ,I i,0,1 ,…,I i,0,NC×NH-1 ,…,I i,NP-1,NC×NH-1 Each group of NH pixel matrices is compressed to obtain a hash matrix H i ={H i,0,1 ,…,H i,0,NC-1 ,…,H i,NP-1,NC-1 }, where H i,j,l Represents the hash operation H(I i,j,l×NH ,…,I i,j,(l+1)NH-1 ), j∈[0,NP-1],l∈[0,NC-1]; b. Convolution operation: Use a convolution kernel of size NC to perform weighted aggregation on the hash matrix to obtain the convolution coefficient C i ={C i,0 ,C i,1 ,…,C i,NP-1 }, where C i ,m=Conv({H i },{A i }),Conv means using {A i }In {H i }Convolution operation performed on c. Polynomial representation: Use polynomial commitment to represent each image block I i is the polynomial P i (x) = C i,0 +C i,1 x+C i,2 x 2 +…+C i,NP-1 x NP-1 , and finally get the commitment value P i (o), where using the commitment opening point o, the image owner computes the corresponding data authenticator for each image block as d. Calculate snapshot information: Use the generated authentication element to calculate the snapshot information Finally, the file {I i }、Data Authenticator{τ i } and snapshot information sn are sent to the service provider DSP.

6. The efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof according to claim 5 is characterized in that: In step 2, generating evidence of the audit process specifically includes the following steps: (1) The image owner initiates a challenge: The image owner generates two random keys λ1 and λ2, and specifies the number of image blocks I that need to be checked. After that, the image owner sends (λ1, λ2, I) to the data storage provider DSP. (2) DSP generates a challenge set: DSP uses the received λ1 and λ2 to generate a challenge set Ω = (i, η i ), where i is the index of the image block, using the pseudo-random permutation function π λ1 (k) generate; η i is a random coefficient, obtained by pseudo-random function f λ2 (k) Generate; DSP accepts the challenged image block {Ii} and random coefficient η i , and a convolution kernel matrix called αAi, which is used to process the image block; (3) DSP calculates and proves π: DSP uses the image audit circuit Ψ to calculate and prove π: π←Prove Ψ (pk d ,{αA i },Ψ,{I i } i∈Ω ,{η i } i∈Ω ,C a ), where Ca is the linear polymerization coefficient (4) DSP generates auxiliary proof ω τ :DSP for the unchallenged image block I j Generate auxiliary proof ω τ : in, (5) DSP packages all the results and sends them to the image owner: DSP sends the calculated proof π and auxiliary proof ω τ Packaged into a whole proof Prf and sent to the image owner.

7. The efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof according to claim 6 is characterized in that: In step 2, when verifying the correctness of the audit results, the smart contract SC performs a verification operation to determine whether the DSP has performed the correct audit operation according to the challenge by verifying the proof information sent by the DSP. Specifically, the following steps are included: 1) Generate a challenge set and reconstruct the proof: After receiving the proof, the SC first regenerates the challenge set Ω using the same challenge parameters (λ1, λ2, I) to ensure that it is consistent with the calculation result of the DSP; 2) Verify the correctness of the ZKP circuit: SC uses the circuit to verify the key vk d , prove π and public witness Ca to verify that the ZKP circuit Ψ is correct: Make sure there are no miscalculations; 3) Verify the calculation results of the circuit: SC uses the locally stored public parameter γ i and g α Verify the calculation results of the circuit to ensure the correctness of the calculation results: 4) Use the auxiliary verification information μ to verify the auxiliary proof: through the formula SC ensures that unchallenged data blocks are also correct; if all verification formulas are valid, the proof process passes and data integrity is confirmed; if any verification step fails, SC reports the failure and terminates the audit process.

8. The efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof according to claim 7 is characterized in that: In step 3, generating evidence of the update process specifically includes the following steps: ① After receiving the modification information including image I, proof parameter λ3, operation type op and operation parameters, DSP loads the original image I and selects the appropriate dynamic update circuit φ from the library according to the operation type op op Perform subsequent calculations; then, DSP determines the set Δ={(i,η i )}, where i is the image block {I i }, η i is the random coefficient corresponding to that index; ②Select dynamic update circuit: Select the appropriate dynamic update circuit φ according to the operation type op op , and load the original image I; ③It is necessary to obtain the convolution coefficient of the current image I C i,j {i∈Δ,j∈[0,N P -1], and construct the polynomial And get the aggregated coefficient C a ; ④Use dynamic update circuit φ op , according to the original image I, the updated image I′, the coefficient C a and the blinded convolution kernel matrix αA i ,DSP executes dynamic update circuit φ o p, and get the circuit proof: ⑤Computation-assisted proof: Then, DSP will assist the evidence ω τ , circuit proof π, coefficient information C a and the authentication element τ of the image data {i} Sent to data owner for verification.

9. The efficient pixel-level dynamic image auditing method in decentralized storage based on zero-knowledge proof according to claim 8 is characterized in that: In step 3, verifying the correctness of the update operation specifically includes the following steps: i. Use the circuit's verification key to verify the dynamically updated circuit calculation: If the verification is successful, it means that the image pixel operation performed by the DSP is consistent with the result performed locally by the image owner, verifying the correctness of the operation; ii. Verify the coefficient information sent by DSP to determine whether DSP operates on the original data, which is equivalent to the verification of an audit process: iii. Check the supporting evidence at the same time: If all equalities hold, the update verification passes.

Images