Batch data verification method and device, computer equipment and program product

Abstract

The invention provides a batch data verification method. The method is applied to a verification device that needs to verify that the certification device has n secret values. And n public keys and n commitment values respectively calculated for the n secret values through the target commitment protocol from the attestation device. Generating a challenge value and sending the challenge value to the proving device, and receiving response values corresponding to the secret values calculated by the proving device for the challenge value. Finally, the verification device determines whether the attestation device has a corresponding secret value by verifying whether the first value and the second value corresponding to each secret value are equivalent. The first value is determined from an operational value of the challenge value and a commitment value of the secret value, and the second value is determined from a public key of the secret value and a response value. Wherein in the verification process of different secret values, the result of the operation value of the challenge value is multiplexed. In the verification process of different secret values, the operation value of the same challenge value is shared, so that the calculation amount during batch data verification is reduced.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computer application technology, and more particularly, to a method and apparatus. Background Art

[0002] Zero-Knowledge Proof (ZKP) is a cryptographic tool. When proving that a device has secret data, zero-knowledge proof allows: without leaking any information, the verification device verifies whether the device has the secret data. Zero-knowledge proof is widely used in financial transactions, identity authentication, blockchain technology, compliance and regulation.

[0003] When the verification device needs to verify multiple secret data based on zero-knowledge proof, it consumes more computing power and has low computing efficiency. Summary of the invention

[0004] In view of this, one or more embodiments of the present specification provide a batch data verification method, apparatus, computer device, and program product.

[0005] According to a first aspect of one or more embodiments of this specification, a batch data verification method is proposed, involving a verification device and a certification device, the method is applied to the verification device, and includes:

[0006] receiving, from the proving device, n public keys and n commitment values ​​calculated based on the target commitment protocol for n secret values ​​held by the proving device;

[0007] Generate and send a single challenge value to the proving device;

[0008] Receiving a response value sent by a proving device and calculated for each secret value using the challenge value;

[0009] For each secret value, verify whether the first value and the second value are equal. When they are equal, determine that the proving device has the secret value, wherein the first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value; wherein the first values ​​corresponding to the n secret values ​​share the operation value.

[0010] According to a second aspect of one or more embodiments of this specification, a batch data verification device is provided, which relates to a verification device and a certification device. The device is applied to the verification device, including:

[0011] A first receiving module, configured to receive, from a proving device, n public keys and n commitment values ​​calculated based on a target commitment protocol for n secret values ​​held by the proving device;

[0012] A generation module, configured to generate and send a single challenge value to a proving device;

[0013] A second receiving module, used for receiving a response value sent by a certification device and calculated for each secret value using the challenge value;

[0014] A data verification module is used to verify whether a first value and a second value are equal for each secret value, and when they are equal, determine that the proving device has the secret value, wherein the first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value; wherein the first values ​​corresponding to the n secret values ​​share the operation value.

[0015] According to a third aspect of the embodiments of this specification, a computer-readable storage medium is provided, on which computer instructions are stored. When the instructions are executed by a processor, the batch data verification method as described in the first aspect of the embodiments of this specification is implemented.

[0016] According to a fourth aspect of an embodiment of this specification, a computer device is provided, the computer device comprising:

[0017] processor;

[0018] a memory for storing processor-executable instructions;

[0019] The processor implements the batch data verification method as described in the first aspect of the embodiment of this specification by running the executable instructions.

[0020] According to a fifth aspect of the embodiments of this specification, a computer program product is provided, wherein when the computer program product is executed by a processor,

[0021] This specification provides a batch data verification method. The method is applied to a verification device, and the verification device needs to verify that the proving device has n secret values. The proving device calculates n public keys and n commitment values ​​for the n secret values ​​respectively through the target commitment protocol. A challenge value is generated and sent to the proving device, and the response values ​​corresponding to each secret value calculated by the proving device for the challenge value are received. Finally, the verification device determines whether the proving device has the corresponding secret value by verifying whether the first value and the second value corresponding to each secret value are equivalent. The first value is determined according to the calculated value of the challenge value and the commitment value of the secret value, and the second value is determined according to the public key of the secret value and the response value. In the verification process of different secret values, the result of the calculated value of the challenge value is reused.

[0022] By sharing the operation value of the same challenge value in the verification process of different secret values, the amount of calculation when batch data verification is performed is reduced, thereby accelerating the process of zero-knowledge proof and improving the operation efficiency. It should be understood that the above general description and the detailed description below are only exemplary and explanatory and cannot limit this specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

[0024] Figure 1 It is an application scenario diagram of a batch data verification method shown in this specification according to an exemplary embodiment.

[0025] Figure 2 It is a flow chart of a batch data verification method shown in this specification according to an exemplary embodiment.

[0026] Figure 3 It is a block diagram of a batch data verification device according to an exemplary embodiment of the present specification.

[0027] Figure 4 It is a hardware structure diagram of a computer device shown in this specification according to an exemplary embodiment. DETAILED DESCRIPTION

[0028] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0029] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0030] The Pedersen commitment protocol is a way to implement zero-knowledge proof. Through the Pedersen commitment protocol, an undeniable and unforgeable commitment can be created, so that the verification device can confirm the authenticity of the secret data without revealing the secret information. Pedersen commitment is generally constructed based on the elliptic curve discrete logarithm problem. The specific implementation of the Pedersen commitment protocol is described in detail below.

[0031] When the Pedersen commitment protocol is used to implement zero-knowledge proof in related technologies, each verification of a secret value requires multiple exponential operations in the elliptic curve group. However, the exponential operations in the elliptic curve group consume more computing power. When the number of secret values ​​is large, the workload of verifying the secret values ​​will increase linearly, which places extremely high demands on the computational efficiency of the verification.

[0032] The methods for accelerating zero-knowledge proof in related technologies mainly include: vectorization acceleration, batch processing acceleration and pre-computation acceleration, etc. The following will explain the three acceleration methods respectively.

[0033] Vectorization acceleration technology refers to the parallel processing of multiple calculations by combining multiple scalar operations into a single vector operation. For the Pedersen commitment protocol, related technologies can use the vectorization capabilities of modern processors (such as SSE and AVX instruction sets) to vectorize multiple exponential operations, thereby improving computational efficiency through parallel processing. However, this method does not reduce the amount of computation for each verification.

[0034] Batch processing technology refers to: reducing the number of overlapping calculations by processing multiple commitments at one time. Specific methods include merging the calculations of all public parameters involved in the operation, and merging multiple exponential operations and multiplication operations into one batch processing task. This method can reduce redundant calculations, make better use of hardware resources, and achieve the effect of optimizing computing performance. However, since the number of public parameters used in the verification process of the Pedersen commitment protocol is relatively small, and the calculation of public parameters is also relatively small, this method does not work well in the Pedersen commitment protocol.

[0035] Parameter precomputation technology refers to reducing the burden of real-time calculation by pre-calculating the invariant parameters. However, similar to the above method, in the native Pedersen commitment protocol, there are fewer invariant parameters that can be shared, so the acceleration effect of this method is limited.

[0036] In order to solve the above problems, this specification provides a batch data verification method, in which the verification device needs to verify that the proving device has n secret values. The proving device calculates n public keys and n commitment values ​​for the n secret values ​​respectively through the target commitment protocol and sends them to the verification device. The verification device generates a challenge value and sends it to the proving device, and receives the response values ​​corresponding to each secret value calculated by the proving device for the challenge value. Finally, the verification device determines whether the proving device has the corresponding secret value by verifying whether the first value and the second value corresponding to each secret value are equivalent. The first value is determined according to the operation value of the challenge value and the commitment value of the secret value, and the second value is determined according to the public key of the secret value and the response value. In the verification process of different secret values, the result of the operation value of the challenge value is reused.

[0037] By sharing the calculation value of the same challenge value in the verification process of different secret values, the amount of calculation during batch data verification is reduced, thereby accelerating the zero-knowledge proof process and improving calculation efficiency.

[0038] Next, a batch data verification method provided in this manual will be described.

[0039] First, the application architecture of this manual is described. Figure 1 As shown, this specification involves a verification device and a certification device, the certification device has n secret values, and the verification device is responsible for verifying whether the certification device has n secret values ​​without knowing the specific secret values. Figure 1 As shown, the proving device and the verifying device will interact to complete the zero-knowledge proof through interaction.

[0040] The number of the proving devices involved in the method may be 1, and correspondingly, the proving device has n secret values. In addition, the proving device may also be multiple proving devices, and correspondingly, the n secret values ​​are held by the multiple proving devices, and each proving device may hold at least one secret value.

[0041] In one case, if Figure 1 As shown, the plurality of proving devices are n proving devices, and each proving device has a secret value.

[0042] The above architecture can be applied to a variety of application scenarios. For example, in the scenario of identity authentication, the n secret values ​​can be the private keys of the n proving devices. The verification device verifies that the proving device i has the corresponding private key and confirms that the proving device i has a legitimate identity. For another example, in an anonymous voting scenario, the secret value can be the voting value, and the verification device and the proving device can ensure the immutability of the voting results through zero-knowledge proof. This method can also be applied to privacy transactions in blockchain. In privacy transactions, the transaction amount and the addresses of the two parties to the transaction need to be hidden. In this case, the secret value can be these transaction details that need to be hidden.

[0043] The above examples of specific scenarios do not limit the present specification.

[0044] Next, the specific implementation process of the batch data verification method will be explained.

[0045] Optionally, before the method is executed, the verification device and the proving device exchange public parameters such as public keys. Specifically, these public parameters may include: first, a prime number p greater than a preset value; second, a first generator g and a second generator h in the elliptic curve group, which have a rank q in the elliptic curve group respectively; third, a public key corresponding to each secret value. It should be noted that a proving device may have multiple secret values, and the public keys corresponding to the multiple secret values ​​owned by the proving device are different.

[0046] In addition, the generators in the elliptic curve group are two points in the elliptic curve group. Zero-knowledge proof is generally implemented based on calculations in the elliptic curve group, so the verification device and the proof device need to share the generators in the elliptic curve group to complete subsequent calculations.

[0047] The execution process of the method involves three stages, namely the commitment stage, the challenge stage and the response stage. In the commitment stage, the proving device calculates the commitment value and sends it to the verification device. In the challenge stage, the verification device generates a random challenge and sends it to the proving device. In the response stage, the proving device calculates the response value based on the challenge value and the secret value, and sends the response value to the verification device; correspondingly, after receiving the response value, the verification device verifies whether the proving device has n secret values ​​based on the response value, the commitment value and the public key.

[0048] Next, we will combine Figure 2 The above process is described in detail. Figure 2 As shown, Figure 2 is a flow chart of the method, comprising:

[0049] In step 201, the verification device receives from the proving device n public keys and n commitment values ​​calculated based on a target commitment protocol for n secret values ​​held by the verification device.

[0050] Correspondingly, the proving device needs to send to the verifying device: n public keys and n commitment values ​​calculated based on the target commitment protocol for the n secret values ​​it holds.

[0051] This step corresponds to the commitment phase mentioned above, as well as the phase of exchanging public parameters. The goal is to make a commitment based on the public parameters, secret values, and random numbers generated by the proving device. Correspondingly, these public parameters, secret values, and random numbers will also participate in the calculation of the response value, so that the final verification device can verify whether the commitment is true based on the response value, thereby determining whether the proving device has the secret value.

[0052] The target commitment protocol here may be a Pedersen commitment protocol, in which the public key corresponding to each secret value may be calculated based on the secret value and a random number generated by the proving device, and the commitment value corresponding to each secret value may be calculated based on other public parameters and a random number generated by the proving device.

[0053] Next, the specific calculation method of the public key and commitment value will be explained.

[0054] Public Key C i It can be determined by multiplying two factors. The first factor can be based on the first generator g and the secret value x. i The second factor can be the second generator h as the base, with the secret value x i The corresponding random number r i is the result of the exponential calculation. Where i is the number of the secret value, which is an integer ranging from 1 to n. From the above description, we can see that each secret value corresponds to a public key and a random number r. i (hereinafter referred to as the third random number) In addition, the third random number is generated by the certification device, and in order to ensure that the verification device cannot infer the size of the secret value based on the random number and the response value, the third random number is not sent to the verification device.

[0055] In addition, it should be noted that the two factors here are calculated based on the exponential operation in the elliptic curve group. The exponential operation in the elliptic curve group can also be called the multiplication operation of a scalar and a point.

[0056] Specifically, the public key calculation formula can refer to the following formula (1):

[0057]

[0058] As mentioned above, x i is the i-th secret value. If there are n proving devices, it is the secret value of the i-th proving device. i is the public key corresponding to the secret value, g is the first generator, h is the second generator, ri is the third random number corresponding to the secret value. mod is a modulo operation, i.e., modulo the entire content above. The above p is a prime number p greater than a preset value shared by the verification device and the proof device. As mentioned above, it is a public parameter; when calculating the public key during the data verification process, it is performed on a finite field of modulus p. The calculation can be limited to a finite field of the elliptic curve group through modulo, reducing the complexity of the calculation.

[0059] Commitment value a i It can be determined by multiplying two other factors. One factor can be based on the first generator g and the secret value x. i The corresponding first random number t i Another factor can be the second generator h as the base, with the secret value x i The corresponding second random number k i is the result of the index calculation.

[0060] It should be noted that the first random number, the second random number and the third random number are three independent random numbers generated for a secret value, and these random numbers will not be sent to the verification device.

[0061] Specifically, the commitment value calculation formula can refer to the following formula (2):

[0062]

[0063] The meaning of each value is detailed in the previous text and will not be repeated here.

[0064] Step 203: The verification device generates and sends a single challenge value to the proof device.

[0065] Accordingly, the proving device needs to receive a single challenge value from the verifying device.

[0066] This step corresponds to the challenge phase mentioned above. After the verification device obtains the commitment value and the public key, it can generate a random challenge (i.e., the challenge value e mentioned above), and the proving device receives the challenge. Thus, the verification device can determine whether the proving device has the secret value based on the response value of the proving device to the challenge value e.

[0067] It should be noted that, although the proving device has n secret values, the verification device does not generate n challenge values ​​for each of the n secret values, but only generates a single challenge value e for the n secret values.

[0068] As for the generation method of the challenge value e, it can be a generated random number. Of course, this example does not limit the present specification.

[0069] Step 205: The verification device receives a response value sent by the proving device and calculated for each secret value using the challenge value.

[0070] Accordingly, the proving device needs to use a single challenge value to calculate a response value for each secret value and send the response value corresponding to each secret value to the verification device.

[0071] Step 207: for each secret value, verify whether the first value is equal to the second value. If they are equal, determine that the certifying device has the secret value.

[0072] The first value is determined based on the calculation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value; wherein the first values ​​corresponding to the n secret values ​​share the calculation value.

[0073] Steps 205 and 207 correspond to the response phase described above. In this phase, the proving device calculates a response value based on the challenge value and the data it holds and sends it to the verification device. The verification device determines whether the proving device has the above-mentioned secret value based on the response value, challenge value and public parameters.

[0074] In step 207, since the calculation method of the response phase is changed, the same operation result is shared during the verification process of different secret values, thereby reducing the amount of calculation.

[0075] Next, the specific implementation of step 205 and step 207 will be described. There are differences between the response phase implementation method introduced above and the response phase calculation method of the Pedersen commitment protocol in the related art. For ease of understanding, the calculation method in the related art is first described here. The response value in the related art can be calculated according to the following formula (3):

[0076] z i =t i +e*x i modp

[0077] w i =k i +e*r i modp (3)

[0078] The meaning of each value is described in the previous section and will not be repeated here. The mod here refers to the modulus of p after the entire formula is calculated.

[0079] Correspondingly, the process of data verification by the verification device in the related art can be shown as formula (4):

[0080]

[0081] The meaning of each value is as described above and will not be repeated here. ≡ is a congruence symbol, indicating that the values ​​modulo p are the same after calculation on both sides of the equation.

[0082] The above method needs to calculate three exponential operations in the elliptic curve group during the verification process of each secret value (respectively)

[0083] Correspondingly, the implementation method of the response phase has been changed in this specification.

[0084] In an alternative embodiment, each secret value x i The corresponding response value may include a first response value z i and the second response value w i Among them, the proving device has a random number corresponding to each secret value, and the first response value z i The second response value w is determined according to the random number, the secret value and the challenge value. i According to the random number and the first response value z i It can be seen that the calculation method of the second response value in this method is different from that in the related art.

[0085] Furthermore, the first response value z i and the second response value w i The specific calculation method can be: for each secret value, there is a first random number t i , the second random number k i and the third random number r i In the case where the first random number t i and the second random number k i Used to calculate the corresponding commitment value a i , the third random number r i Used to calculate the corresponding public key C i ), the first response value z i According to the first random number t i The product of the sum of the challenge value e and the third factor is determined by the secret value x i The inverse of; the second response value w i According to the second random number x i The fourth factor is the third random number x. i and the first response value z i The product of .

[0086] Specifically, the calculation method of the response value in this specification can refer to the following formula (5):

[0087] z i =(t i +e)*x -1i modp

[0088] w i =k i -r i *z i modp (6)

[0089] Among them, z i is the secret value x i The corresponding first response value, t i The secret value x i The corresponding first random number, e is the random challenge value. i is the second response value, k i is the second random number, r i is the third random number. The mod here is the same as formula (3), which is the modulus of p after the entire formula is completed. p is a prime number p greater than a preset value shared by the verification device and the proof device, which is a public parameter; the process of calculating the response value of data verification is calculated on a finite field modulo p. This can limit the size of the response value, facilitate the subsequent calculation process, and reduce the amount of calculation.

[0090] In an optional implementation, the verification device and the proving device in this specification also share the first generator g and the second generator h in the elliptic curve group as common parameters; the operation value in step 207 is determined according to the first generator and the challenge value, and the second value is determined according to the second generator, the public key corresponding to the secret value, and the response value. It can be seen that there are differences in the calculation methods and related technologies of the first value and the second value in this specification.

[0091] Furthermore, the specific calculation method of the first value and the second value can be: the calculation value is a calculation result with the first generator g as the base and the challenge value e as the exponent; the second value is determined according to the product of the first factor and the second factor, wherein the first factor is the second generator g as the base and the second response value w as the exponent. i is the result of the exponential operation, and the second factor is the corresponding public key C i As the base, the first response value z i The result of the exponential operation.

[0092] The exponential operation and product mentioned above are also implemented in the elliptic curve group. The operation value can also be called the multiplication result of the scalar and point calculated by the first generator g and the challenge value e in the elliptic curve group. The corresponding operation value can actually be understood as the point in the elliptic curve group. The first factor and the second factor are also similar to the operation value.

[0093] Specifically, the verification performed by the verification device can be shown as formula (6):

[0094]

[0095] Among them, g is the first generator, e is the challenge value, a i is the secret value x i The corresponding commitment value, h is the second generator, w i is the second response value, C i is the public key, z i is the first response value. p is a public parameter, specifically a prime number greater than a preset value shared by the verification device and the proof device. By taking the modulus of p on both sides of the formula, data verification is calculated on a finite field modulo p, reducing the amount of calculation.

[0096] According to formulas (1), (2), (5) and (6), when the verification device does have the secret value x i In the case of, the operation results on both sides of the equation of formula (6) are the same. Correspondingly, in step 207, if the first value is equal to the second value, the verification device determines that the proving device has the corresponding secret value, and if the two are not equal, the verification device determines that the proving device does not have the corresponding secret value.

[0097] In the above formula (6), three exponential operations in the elliptic curve group are required to verify a single secret value, which are g e , and The calculated value g e It only depends on the challenge value e and the public parameters, and does not vary with the secret value, so it can be reused in the verification process of different secret values. In this way, when performing batch verification of n secret values, only 2n+1 exponential operations are required. The exponential operations in the elliptic curve group are more complicated. For verification devices with less computing resources, this method can greatly reduce the number of exponential operations. At the same time, the exponential operations in the elliptic curve group are the most time-consuming part of the verification device data verification process. The above process speeds up the verification process by nearly 33.33%.

[0098] Finally, it should be noted that the above operation process is zero-knowledge. That is, during the operation process, the verification device does not obtain any private data. Next, the zero-knowledge nature of the proof protocol will be explained.

[0099] It is necessary to describe how to build a simulator that does not need to know the prover's secret value x. i , you can generate a conversation that is indistinguishable from the real protocol execution process.

[0100] 1. Select simulation input and strategy:

[0101] The input includes public parameter p, generators g and h, and public key C. i.

[0102] 2. Simulation process:

[0103] (1) The simulator first selects a random z i ' and w i '.

[0104] (2) Calculation and

[0105] (3) Select a random challenge value e'.

[0106] (4) Calculation

[0107] 3. Analog output (a i ',e',z i ',w i ')

[0108] Through the above simulation process, it can be seen that for the verifier, the output of the simulator (a i ',e',z i ',w i ') and the actual implementation of the protocol dialogue (a i ,e,z i ,w i ) are indistinguishable.

[0109] Specifically, first, in the real agreement, is the random number t i and k i Generated. i and k i are all independently and uniformly distributed within an appropriate range, which means that a i is also evenly distributed in a certain subgroup. For i '、w i ' and e' are also uniformly distributed, so a i The distribution of ' is also uniform.

[0110] Second, the challenge values ​​e and e' are uniformly distributed, so they have the same distribution.

[0111] Third, in the real protocol, the two response values ​​(zi, wi) are obtained by random values ​​ti, ki, r i , e and the secret value xi, so the two response values ​​(z i ,w i ) is also uniformly distributed. The response generated by the simulator (z i ',w i') are uniform random numbers chosen directly. Therefore, the response pairs generated by the simulator are statistically identical to those generated by the real protocol.

[0112] In summary, the conversations generated by the simulator and the conversations in the real protocol execution are statistically identically distributed, so the above batch Pedersen commitment protocol is zero-knowledge.

[0113] Corresponding to the embodiments of the aforementioned method, this specification also provides embodiments of an apparatus and a computer device to which it is applied.

[0114] like Figure 3 As shown, Figure 3 This is a block diagram of a batch data verification device according to an exemplary embodiment of the present specification, which relates to a verification device and a certification device. The device is applied to the verification device, and the device includes:

[0115] A first receiving module 310 is used to receive, from a proving device, n public keys and n commitment values ​​calculated based on a target commitment protocol for n secret values ​​held by the proving device;

[0116] A generation module 320, configured to generate and send a single challenge value to a proving device;

[0117] A second receiving module 330 is used to receive a response value sent by a certification device and calculated for each secret value using the challenge value;

[0118] The data verification module 340 is used to verify whether the first value and the second value are equal for each secret value, and when they are equal, determine that the proving device has the secret value, wherein the first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value; wherein the first values ​​corresponding to the n secret values ​​share the operation value.

[0119] In an optional embodiment, the verification device and the proof device also share the first generator and the second generator in the elliptic curve group as common parameters; the operation value is determined based on the first generator and the challenge value, and the second value is determined based on the second generator, the public key corresponding to the secret value, and the response value.

[0120] In an optional embodiment, the response value includes a first response value and a second response value; the operation value is a calculation result with the first generator as the base and the challenge value as the exponent; the second value is determined according to the product of a first factor and a second factor, wherein the first factor is a calculation result with the second generator as the base and the second response value as the exponent, and the second factor is a calculation result with the corresponding public key as the base and the first response value as the exponent.

[0121] In an optional implementation, the proving device has a random number corresponding to each secret value, the first response value is determined according to the random number, the secret value and the challenge value, and the second response value is determined according to the random number and the first response value.

[0122] In an optional implementation, each secret value corresponds to a first random number, a second random number and a third random number, the first random number and the second random number are used to calculate the corresponding commitment value, and the third random number is used to calculate the corresponding public key; the first response value is determined based on the product of the sum of the first random number and the challenge value and a third factor, and the third factor is the inverse of the secret value; the second response value is determined based on the difference between the second random number and the fourth factor, and the fourth factor is the product of the third random number and the first response value.

[0123] In an optional implementation, the proving device is a plurality of proving devices; and the n secret values ​​are held by the plurality of proving devices.

[0124] In an optional implementation, the multiple certification devices are n certification devices; and the n secret values ​​are private keys of the n certification devices respectively.

[0125] In an optional implementation, the verification device and the proof device also share a prime number p greater than a preset value as a common parameter; and data verification is calculated over a finite field modulo p.

[0126] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0127] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0128] like Figure 4 As shown, Figure 4 A hardware structure diagram of a computer device in which the batch data verification device of the embodiment is located is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0129] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification. The processor implements the above method by running executable instructions.

[0130] The memory 1020 for storing processor executable instructions can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020.

[0131] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0132] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0133] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0134] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0135] The embodiments of this specification also provide a computer program product, which implements the above-mentioned batch data verification method when executed by a processor.

[0136] The embodiments of the present specification also provide a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned batch data verification method is implemented.

[0137] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0138] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0139] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0140] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

Claims

1. A batch data verification method, involving a verification device and a certification device, the method being applied to the verification device, comprising: receiving, from the proving device, n public keys and n commitment values ​​calculated based on the target commitment protocol for n secret values ​​held by the proving device; Generate and send a single challenge value to the proving device; Receiving a response value sent by a proving device and calculated for each secret value using the challenge value; For each secret value, verify whether the first value and the second value are equal. When they are equal, determine that the proving device has the secret value, wherein the first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value; wherein the first values ​​corresponding to the n secret values ​​share the operation value.

2. The method according to claim 1, wherein: The verification device and the proof device also share the first generator and the second generator in the elliptic curve group as public parameters; the operation value is determined based on the first generator and the challenge value, and the second value is determined based on the second generator, the public key corresponding to the secret value, and the response value.

3. The method according to claim 2, wherein: The response value includes a first response value and a second response value; The operation value is a result of an operation with the first generator as the base and the challenge value as the exponent; the second value is determined according to the product of the first factor and the second factor, wherein the first factor is a result of an operation with the second generator as the base and the second response value as the exponent, and the second factor is a result of an operation with the corresponding public key as the base and the first response value as the exponent.

4. The method according to claim 1, wherein: The proving device has a random number corresponding to each secret value, the first response value is determined according to the random number, the secret value and the challenge value, and the second response value is determined according to the random number and the first response value.

5. The method according to claim 4, wherein: Each secret value corresponds to a first random number, a second random number and a third random number, the first random number and the second random number are used to calculate the corresponding commitment value, and the third random number is used to calculate the corresponding public key; The first response value is determined based on the product of the sum of the first random number and the challenge value and a third factor, wherein the third factor is the inverse of the secret value; The second response value is determined according to the difference between the second random number and a fourth factor, and the fourth factor is the product of the third random number and the first response value.

6. The method according to claim 1, wherein: The proving device is a plurality of proving devices; the n secret values ​​are held by the plurality of proving devices.

7. The method according to claim 6, wherein: The multiple proving devices are n proving devices; the n secret values ​​are private keys of the n proving devices respectively.

8. The method according to any one of claims 1 to 7, wherein: The verification device and the proof device also share a prime number p greater than a preset value as a common parameter; data verification is calculated on a finite field modulo p.

9. A batch data verification device, involving a verification device and a certification device, the device is applied to the verification device, comprising: A first receiving module, configured to receive, from a proving device, n public keys and n commitment values ​​calculated based on a target commitment protocol for n secret values ​​held by the proving device; A generation module, configured to generate and send a single challenge value to a proving device; A second receiving module, used for receiving a response value sent by a certification device and calculated for each secret value using the challenge value; A data verification module is used to verify whether a first value and a second value are equal for each secret value, and when they are equal, determine that the proving device has the secret value, wherein the first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value; wherein the first values ​​corresponding to the n secret values ​​share the operation value.

10. A computer program product, wherein when the computer program product is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

11. A computer device comprising: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 1 to 8 by running the executable instructions.

Images