A batch data verification method, device, computer equipment and program product

Abstract

The present specification provides a batch data verification method. The method is applied to a verification device, which needs to verify that a proving device has n secret values. The verification device receives n public keys and n commitment values calculated by the proving device through a target commitment protocol for the n secret values respectively. A challenge value is generated and sent to the proving device, and the verification device receives a response value corresponding to each secret value calculated by the proving device for the challenge value. Finally, the verification device determines whether the proving device has the corresponding secret value by verifying whether the first value and the second value corresponding to each secret value are equivalent. The first value is determined according to the operation value of the challenge value and the commitment value of the secret value, and the second value is determined according to the public key of the secret value and the response value. In the verification process of different secret values, the operation value of the challenge value is reused. By sharing the operation value of the same challenge value in the verification process of different secret values, the calculation amount is reduced when batch data verification is performed.

Description

Technical Field

[0001] This specification relates to the field of computer application technology, and more particularly to a method and apparatus. Background Technology

[0002] Zero-knowledge proof (ZKP) is a cryptographic tool. In proving a device possesses secret data, ZKP allows verification of whether a device possesses that secret data without revealing any information. ZKP has wide applications in financial transactions, identity verification, blockchain technology, compliance, and regulation.

[0003] When the verification device needs to verify multiple secret data based on zero-knowledge proofs, it requires a lot of computing power and has low computational efficiency. Summary of the Invention

[0004] In view of the above, one or more embodiments of this specification provide a batch data verification method, apparatus, computer equipment, and program product.

[0005] According to a first aspect of one or more embodiments of this specification, a batch data verification method is proposed, relating to a verification device and a verification device, the method being applied to the verification device, comprising:

[0006] Receive n public keys and n commitment values ​​from the proof device, calculated based on the target commitment protocol for the n secret values ​​it holds;

[0007] Generate and send a single challenge value to the proof device;

[0008] The receiving device sends a response value calculated for each secret value using the challenge value;

[0009] For each secret value, verify whether the first value and the second value are equal. If they are equal, determine that the device has the secret value. The first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value. The first values ​​corresponding to the n secret values ​​share the operation value.

[0010] According to a second aspect of one or more embodiments of this specification, a batch data verification apparatus is provided, relating to verification equipment and verification equipment, the apparatus being applied to the verification equipment, comprising:

[0011] The first receiving module is used to receive from the proof device n public keys and n commitment values ​​calculated based on the target commitment protocol for the n secret values ​​it holds;

[0012] The generation module is used to generate and send a single challenge value to the proof device;

[0013] The second receiving module is used to receive the response value sent by the proof device, which is calculated for each secret value using the challenge value;

[0014] The data verification module is used to verify whether a first value and a second value are equal for each secret value. If they are equal, it is determined that the device has the secret value. The first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value. The first values ​​corresponding to the n secret values ​​share the operation value.

[0015] According to a third aspect of the embodiments of this specification, a computer-readable storage medium is provided having computer instructions stored thereon that, when executed by a processor, implement the batch data verification method as described in the first aspect of the embodiments of this specification.

[0016] According to a fourth aspect of the embodiments of this specification, a computer device is provided, the computer device comprising:

[0017] processor;

[0018] Memory used to store processor-executable instructions;

[0019] The processor executes the executable instructions to implement the batch data verification method as described in the first aspect of the embodiments of this specification.

[0020] According to a fifth aspect of the embodiments of this specification, a computer program product is provided that, when executed by a processor, implements...

[0021] This specification provides a batch data verification method. This method is applied to a verification device that needs to verify that a proving device possesses n secret values. The method involves the proving device calculating n public keys and n commitment values ​​for each of the n secret values ​​using a target commitment protocol. A challenge value is generated and sent to the proving device, and the device receives the response values ​​calculated by the proving device for each secret value in response to the challenge value. Finally, the verification device determines whether it possesses the corresponding secret value by verifying whether the first and second values ​​corresponding to each secret value are equivalent. The first value is determined based on the calculated value of the challenge value and the commitment value of the secret value, while the second value is determined based on the public key of the secret value and the response value. Notably, the calculated value of the challenge value is reused during the verification process for different secret values.

[0022] By sharing the computational value of the same challenge value during verification processes of different secret values, the computational load during batch data verification is reduced, thereby accelerating the zero-knowledge proof process and improving computational efficiency. It should be understood that the above general description and the following detailed description are merely exemplary and explanatory and do not limit this specification. Attached Figure Description

[0023] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this specification and, together with the description, serve to explain the principles of this specification.

[0024] Figure 1 This is an application scenario diagram illustrating a batch data verification method according to an exemplary embodiment of this specification.

[0025] Figure 2 This is a flowchart illustrating a batch data verification method according to an exemplary embodiment of this specification.

[0026] Figure 3 This is a block diagram illustrating a batch data verification apparatus according to an exemplary embodiment of this specification.

[0027] Figure 4 This is a hardware structure diagram of a computer device illustrated in this specification according to an exemplary embodiment. Detailed Implementation

[0028] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0029] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0030] The Pedersen commitment protocol is a method for implementing zero-knowledge proofs. It allows the creation of non-repudiable and unforgeable commitments, enabling verification devices to confirm the authenticity of secret data without revealing the secret information. Pedersen commitments are generally constructed based on the elliptic curve discrete logarithm problem. The specific implementation of the Pedersen commitment protocol is detailed below.

[0031] In related technologies, when using the Pedersen commitment protocol to implement zero-knowledge proofs, each verification of a secret value requires multiple exponential operations in the elliptic curve group. Exponential operations in the elliptic curve group are computationally intensive. When the number of secret values ​​is large, the workload of verifying secret values ​​will increase linearly, which places extremely high demands on the computational efficiency of verification.

[0032] The main methods for accelerating zero-knowledge proofs in related technologies include vectorization acceleration, batch processing acceleration, and pre-computation acceleration. The following sections will explain these three acceleration methods.

[0033] Vectorization acceleration technology refers to the parallel processing of multiple computations by merging multiple scalar operations into a single vector operation. For the Pedersen commitment protocol, related technologies can leverage the vectorization capabilities of modern processors (such as SSE and AVX instruction sets) to vectorize multiple exponentiation operations, thereby improving computational efficiency through parallel processing. However, this method does not reduce the computational load of each verification.

[0034] Batch processing refers to reducing the number of overlapping computations by processing multiple commitments at once. Specific methods include merging the computation of all common parameters involved in the calculations and combining multiple exponentiation and multiplication operations into a single batch task. This method can reduce redundant computations, make more efficient use of hardware resources, and optimize computational performance. However, because the Pedersen commitment protocol verification process uses relatively few common parameters, and the computation of these parameters is also relatively infrequent, this method is not very effective in the Pedersen commitment protocol.

[0035] Precomputation techniques refer to reducing the burden of real-time computation by pre-compiling invariant parameters. However, similar to the methods mentioned above, the native Pedersen commitment protocol has a limited number of shareable invariant parameters, thus limiting the speedup effect of this method.

[0036] To address the aforementioned issues, this specification provides a batch data verification method, in which the verification device needs to verify that the proving device possesses n secret values. The proving device calculates n public keys and n commitment values ​​for each of the n secret values ​​using a target commitment protocol and sends them to the verification device. The verification device generates a challenge value and sends it to the proving device, receiving the response values ​​calculated by the proving device for each secret value in response to the challenge value. Finally, the verification device determines whether the proving device possesses the corresponding secret value by verifying whether the first and second values ​​corresponding to each secret value are equivalent. The first value is determined based on the calculated value of the challenge value and the commitment value of the secret value, while the second value is determined based on the public key of the secret value and the response value. Notably, the calculated value of the challenge value is reused during the verification process for different secret values.

[0037] By sharing the same challenge value during verification of different secret values, the computational load during batch data verification is reduced, thereby accelerating the zero-knowledge proof process and improving computational efficiency.

[0038] The following section will describe a batch data verification method provided in this manual.

[0039] First, the application architecture of this manual will be explained, such as... Figure 1 As shown, this specification involves a verification device and a proof device. The proof device has n secret values, and the verification device is responsible for verifying whether the proof device has n secret values ​​without knowing the specific secret values. Figure 1 As shown, the proof device and the verification device interact to complete zero-knowledge proofs.

[0040] In this method, the number of proof devices involved can be one, and correspondingly, the proof device has n secret values. Alternatively, there can be multiple proof devices, and correspondingly, the n secret values ​​are held by these multiple proof devices, with each proof device holding at least one secret value.

[0041] In one case, such as Figure 1 As shown, there are n proof devices, and each proof device has a secret value.

[0042] The above architecture can be applied to various scenarios. For example, in identity verification, the n secret values ​​can be the private keys of n proof devices. The verification device confirms the legitimate identity of proof device i by verifying that it possesses the corresponding private key. As another example, in anonymous voting, the secret values ​​can be the vote values, and the verification and proof devices can guarantee the immutability of the voting results through zero-knowledge proofs. This method can also be applied to privacy transactions on the blockchain. In privacy transactions, it is necessary to hide the transaction amount and the addresses of the transacting parties; in this case, the secret values ​​can be these transaction details that need to be hidden.

[0043] The specific examples described above are not intended to limit this specification.

[0044] The following section will explain the specific implementation process of the batch data validation method.

[0045] Optionally, before execution of this method, the verification device and the proof device exchange public parameters such as public keys. Specifically, these public parameters may include: first, a prime number p greater than a preset value; second, the first generator g and the second generator h in the elliptic curve group, each with rank q in the elliptic curve group; and third, the public key corresponding to each secret value. It should be noted that a proof device may possess multiple secret values, and the public keys corresponding to these multiple secret values ​​are different.

[0046] Furthermore, generators in an elliptic curve group are simply two points within that group. Zero-knowledge proofs are generally implemented based on computations within an elliptic curve group, so the verification and proof devices need to share generators in the elliptic curve group to complete subsequent calculations.

[0047] The method involves three phases: the commitment phase, the challenge phase, and the response phase. In the commitment phase, the proving device calculates the commitment value and sends it to the verifying device. In the challenge phase, the verifying device generates a random challenge and sends it to the proving device. In the response phase, the proving device calculates the response value based on the challenge value and secret values, and sends the response value to the verifying device. Correspondingly, upon receiving the response value, the verifying device verifies whether the proving device possesses n secret values ​​based on the response value, the commitment value, and the public key.

[0048] Next, we will combine Figure 2 The above process will be explained in detail. For example... Figure 2 As shown, Figure 2 This is a flowchart of the method, including:

[0049] Step 201: The verification device receives from the proof device n public keys and n commitment values ​​calculated based on the target commitment protocol for the n secret values ​​it holds.

[0050] Correspondingly, the proving device needs to send to the verifying device: n public keys and n commitment values ​​calculated based on the target commitment protocol for the n secret values ​​it holds.

[0051] This step corresponds to the commitment phase mentioned above, as well as the phase of exchanging public parameters. The goal is to make a commitment based on the public parameters, the secret value, and the random number generated by the proving device. Correspondingly, these public parameters, the secret value, and the random number also participate in the calculation of the response value, so that the final verification device can verify whether the commitment is true based on the response value, thereby determining whether the proving device possesses the secret value.

[0052] The target commitment protocol here can be the Pedersen commitment protocol. In this protocol, the public key corresponding to each secret value can be calculated based on the secret value and a random number generated by the proof device, and the commitment value corresponding to each secret value can be calculated from other public parameters and a random number generated by the proof device.

[0053] The specific calculation methods for the public key and commitment value will be explained next.

[0054] Public key C i It can be determined by the product of two factors. The first factor can be based on the first generator g, with the secret value x as the base. i This is the result of the exponent calculation. The second factor can be based on the second generator h, with the secret value x. i The corresponding random number r i The result of the exponent calculation is given. Here, i is the index of the secret value, ranging from 1 to n. As described above, each secret value corresponds to a public key and a random number r. i (Hereinafter referred to as the third random number). In addition, this third random number is generated by the verification device. In order to ensure that the verification device cannot deduce the size of the secret value from the random number and the response value, this third random number is not sent to the verification device.

[0055] It should also be noted that both factors here are calculated based on the exponential operation in the elliptic curve group, which can also be called the multiplication of scalars and points.

[0056] Specifically, the public key calculation formula can be found in the following formula (1):

[0057]

[0058] Among them, as mentioned above, x i Let be the i-th secret value, and in the case of n proof devices, let be the secret value of the i-th proof device. C i Let g be the public key corresponding to the secret value, h be the first generator, and r be the second generator.i This is the third random number corresponding to the secret value. `mod` is the modulo operation, which modulo the entire preceding content. The `p` mentioned above is a prime number greater than a preset value shared by both the verification and proof devices; as mentioned above, it is a common parameter. The calculation of the public key during the data verification process is performed over a finite field modulo `p`. The calculation using `mod` restricts the elliptic curve group to a finite field, reducing computational complexity.

[0059] Commitment value a i It can be determined by the product of two other factors. One factor can be a product of the first generator g and the secret value x. i The corresponding first random number t i This is the result of the exponent calculation. Another factor could be based on the second generator h, with the secret value x. i The corresponding second random number k i This is the result of the exponent calculation.

[0060] It should be noted that the first, second, and third random numbers are three independent random numbers generated for a secret value, and these random numbers are not sent to the verification device.

[0061] Specifically, the formula for calculating the commitment value can be found in the following formula (2):

[0062]

[0063] The meaning of each value is detailed above and will not be repeated here.

[0064] Step 203: Verify the device generates and sends a single challenge value to the certifying device.

[0065] Accordingly, the proof device needs to receive a single challenge value from the verification device.

[0066] This step corresponds to the challenge phase mentioned earlier. After obtaining the commitment value and public key, the verification device can generate a random challenge (i.e., the challenge value e mentioned above) to prove that the device has accepted the challenge. Therefore, the verification device can determine whether the proving device possesses the secret value based on the proving device's response to the challenge value e.

[0067] It should be noted that although the proving device has n secret values, the verifying device does not generate n challenge values ​​for each of the n secret values, but rather generates only a single challenge value e for each of the n secret values.

[0068] The challenge value 'e' can be generated as a random number. This example is not intended to limit the scope of this specification.

[0069] Step 205: The verification device receives the response value sent by the proof device, which is calculated for each secret value using the challenge value.

[0070] Accordingly, the proving device needs to use a single challenge value to calculate a response value for each secret value, and then send the response value corresponding to each secret value to the verification device.

[0071] Step 207: For each secret value, verify whether the first value and the second value are equal. If they are equal, determine that the device has the secret value.

[0072] The first value is determined based on the computational value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value; wherein the first value corresponding to the n secret values ​​shares the computational value.

[0073] Steps 205 and 207 correspond to the response phase described above. In this phase, the proving device calculates a response value based on the challenge value and the data it possesses, and sends it to the verifying device. The verifying device then uses the response value, the challenge value, and common parameters to determine whether the proving device possesses the aforementioned secret value.

[0074] In step 207, the calculation method in the response phase was changed, so that the same calculation result was shared in the verification process of different secret values, thus reducing the amount of calculation.

[0075] The specific implementation methods of steps 205 and 207 will be explained next. The response phase implementation method described above differs from the response phase calculation method of the Pedersen commitment protocol in related technologies. For ease of understanding, the calculation method in related technologies will be explained first. The response value in related technologies can be calculated using the following formula (3):

[0076] z i =t i +e*x i modp

[0077] w i =k i +e*r i modp (3)

[0078] The meaning of each value is explained in detail above and will not be repeated here. Here, "mod" refers to taking the modulus of the entire expression modulo p after calculation.

[0079] Correspondingly, the data verification process performed by the verification equipment in the related technology can be shown in formula (4):

[0080]

[0081] The meanings of each value are detailed above and will not be repeated here. ≡ represents the congruence symbol, indicating that both sides of the expression have the same value modulo p after calculation.

[0082] The above method requires three exponentiation operations in the elliptic curve group during the verification of each secret value (namely...).

[0083] Correspondingly, the implementation of the response phase has been changed in this specification.

[0084] In one alternative implementation, each secret value x i The corresponding response value may include the first response value z. i Second response value w i Among them, the proof device has a random number corresponding to each secret value, and the first response value z i The second response value w is determined based on the random number, the secret value, and the challenge value. i Based on the random number and the first response value z i Confirmed. It is evident that this method differs from related techniques in its calculation of the second response value.

[0085] Furthermore, the first response value z i Second response value w i The specific calculation method can be: for each secret value, there is a first random number t. i The second random number k i and the third random number r i In the case of (where the first random number t) i Second random number k i Used to calculate the corresponding commitment value a i The third random number r i Used to calculate the corresponding public key C i ), first response value z i Based on the first random number t i The secret value x is determined by multiplying the sum of the challenge value e and a third factor. i The inverse; the second response value w i Based on the second random number x i The difference between the first and fourth factors is determined, and the fourth factor is the third random number x. i and the first response value z i The product of.

[0086] Specifically, the method for calculating the response value in this specification can be found in the following formula (5):

[0087] z i =(t i +e)*x -1i modp

[0088] w i =k i -r i *z i modp (6)

[0089] Among them, z i For the secret value x i The corresponding first response value, t i Let the secret value be x i The corresponding first random number, e, is the random challenge value. i For the second response value, k i r is the second random number. i The third randomization. Here, mod is the same as in formula (3), which is the modulo of p after the entire formula is calculated. p is a prime number p that is greater than the preset value and is shared by the verification device and the proof device. It is a common parameter. The process of calculating the response value of data verification is performed on the finite field modulo p. This can limit the size of the response value, facilitate the subsequent calculation process, and reduce the amount of calculation.

[0090] In an optional embodiment, the verification device and the proof device in this specification also share a first generator g and a second generator h in the elliptic curve group as common parameters; the calculated value in step 207 is determined based on the first generator and the challenge value, and the second value is determined based on the second generator, the public key corresponding to the secret value, and the response value. It is evident that the calculation methods for the first and second values ​​in this specification differ from related technologies.

[0091] Furthermore, the specific calculation method for the first and second values ​​can be as follows: the calculated value is the result of calculation with the first generator g as the base and the challenge value e as the exponent; the second value is determined based on the product of the first factor and the second factor, wherein the first factor is with the second generator g as the base and the second response value w as the exponent. i The result of the exponentiation is the second factor, which is the corresponding public key C. i With the base as the first response value z i This is the result of the exponentiation operation.

[0092] The exponential and product operations mentioned above are also implemented in elliptic curve groups. The operands can also be referred to as the result of multiplying a scalar and a point in the elliptic curve group by the first generator g and the challenge value e. The corresponding operands can actually be understood as points in the elliptic curve group. The first and second factors are similar to the operands.

[0093] Specifically, the verification performed by the verification equipment can be as shown in formula (6):

[0094]

[0095] Where g is the first generator, e is the challenge value, and a i For the secret value x i The corresponding commitment value, h is the second generator, w i C is the second response value. i For public key, z i Let p be the first response value. p is a common parameter, specifically a prime number greater than a preset value shared by both the verification and proof devices. By taking the modulo of p on both sides of the equation, the data verification is calculated over a finite field modulo p, reducing the computational load.

[0096] According to formulas (1), (2), (5), and (6), it can be seen that the verification device does indeed possess the secret value x. i In the case of the first value, the result of the operation on both sides of the equation (6) is the same. Correspondingly, in step 207, if the first value is equal to the second value, the verification device determines that the proof device has the corresponding secret value; if the two are not equal, the verification device determines that the proof device does not have the corresponding secret value.

[0097] In the above formula (6), the verification of a single secret value requires three exponential operations in the elliptic curve group, namely g e , and And the operand g e Relying solely on the challenge value *e* and common parameters, and remaining independent of different secret values, this method can be reused across verification processes with different secret values. This allows for batch verification of n secret values ​​with only 2n+1 exponentiation operations. Given the complexity of exponentiation operations in elliptic curve groups, this method significantly reduces the number of exponentiation operations for verification devices with limited computational resources. Furthermore, since exponentiation operations in elliptic curve groups are the most time-consuming part of the data verification process, the above approach results in a verification speedup of approximately 33.33%.

[0098] Finally, it should be noted that the above calculation process is zero-knowledge-based. That is, the verification device does not obtain any privacy data during the calculation. The zero-knowledge nature of the proof protocol will be explained next.

[0099] You need to describe how to build a simulator that does not need to know the prover's secret value x. i This allows the generation of a dialogue that is indistinguishable from the actual protocol execution process.

[0100] 1. Select analog input and strategy:

[0101] The input includes a common parameter p, generators g and h, and a public key C. i.

[0102] 2. Simulation process:

[0103] (1) The simulator first selects a random z i 'and w i '.

[0104] (2) Calculation and

[0105] (3) Select a random challenge value e'.

[0106] (4) Calculation

[0107] 3. Analog output (a) i ',e',z i ',w i ')

[0108] Through the above simulation process, it can be seen that, for the verifier, the simulator's output (a) i ',e',z i ',w i ') and the dialogue in the actual implementation agreement (a i ,e,z i ,w i They are indistinguishable.

[0109] Specifically, firstly, in the actual agreement, It is through random number t i and k i Generated. Due to t i and k i All are independently and uniformly distributed within an appropriate range, which means that a i It is also evenly distributed within a certain subgroup. (For simulator-generated data...) In terms of z i '、w i ' and e' are also uniformly distributed, therefore a i The distribution of ' is also uniform.

[0110] Second, the challenge values ​​e and e' are both uniformly distributed, therefore they have the same distribution.

[0111] Third, in the actual protocol, the two response values ​​(zi, wi) are obtained by using random values ​​ti, ki, and r. i The two response values ​​(z) are calculated from e and the secret value xi. i ,w i The response (z) generated by the simulator is also uniformly distributed. i ',w i') is a directly selected uniformly random number. Therefore, the response pairs generated by the simulator are statistically identical to those generated by the real protocol.

[0112] In summary, the dialogues generated by the simulator and the dialogues in actual protocol execution have the same distribution statistically. Therefore, the above-mentioned batch Pedersen commitment protocol is zero-knowledge.

[0113] Corresponding to the embodiments of the foregoing methods, this specification also provides embodiments of the apparatus and the computer equipment to which it is applied.

[0114] like Figure 3 As shown, Figure 3 This specification is a block diagram illustrating a batch data verification apparatus according to an exemplary embodiment, relating to verification equipment and verification equipment. The apparatus is applied to the verification equipment and includes:

[0115] The first receiving module 310 is used to receive from the proof device n public keys and n commitment values ​​calculated based on the target commitment protocol for the n secret values ​​it holds;

[0116] Generation module 320 is used to generate and send a single challenge value to the proof device;

[0117] The second receiving module 330 is used to receive the response value sent by the proof device, which is calculated for each secret value using the challenge value;

[0118] The data verification module 340 is used to verify whether a first value and a second value are equal for each secret value. If they are equal, it is determined that the device has the secret value. The first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value. The first values ​​corresponding to the n secret values ​​share the operation value.

[0119] In an optional implementation, the verification device and the proof device also share a first generator and a second generator in the elliptic curve group as common parameters; the computational value is determined based on the first generator and the challenge value, and the second value is determined based on the second generator, the public key corresponding to the secret value, and the response value.

[0120] In one optional implementation, the response value includes a first response value and a second response value; the calculated value is the result of an operation with the first generator as the base and the challenge value as the exponent; the second value is determined based on the product of a first factor and a second factor, wherein the first factor is the result of an operation with the second generator as the base and the second response value as the exponent, and the second factor is the result of an operation with the corresponding public key as the base and the first response value as the exponent.

[0121] In one alternative implementation, the device is shown to have a random number corresponding to each secret value, a first response value is determined based on the random number, the secret value, and the challenge value, and a second response value is determined based on the random number and the first response value.

[0122] In one optional implementation, each secret value corresponds to a first random number, a second random number, and a third random number. The first and second random numbers are used to calculate the corresponding commitment value, and the third random number is used to calculate the corresponding public key. The first response value is determined by multiplying the sum of the first random number and the challenge value by a third factor, where the third factor is the inverse of the secret value. The second response value is determined by the difference between the second random number and a fourth factor, where the fourth factor is the product of the third random number and the first response value.

[0123] In one alternative implementation, the proof device is a plurality of proof devices; the n secret values ​​are held by the plurality of proof devices.

[0124] In one optional implementation, the plurality of proof devices are n proof devices; the n secret values ​​are the private keys of the respective n proof devices.

[0125] In one optional implementation, the verification device and the proof device also share a common parameter, a prime number p greater than a preset value; the data verification is performed on a finite field modulo p.

[0126] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0127] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the solution in this specification according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0128] like Figure 4 As shown, Figure 4 The diagram illustrates a hardware structure of a computer device housing the batch data verification apparatus of an embodiment. This device may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0129] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification. The processor implements the above-described methods by running executable instructions.

[0130] The memory 1020 for storing processor-executable instructions can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1020.

[0131] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0132] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0133] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0134] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0135] This specification also provides a computer program product that, when executed by a processor, implements the above-described batch data verification method.

[0136] This specification also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described batch data verification method.

[0137] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0138] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0139] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0140] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

Claims

1. A batch data verification method, involving verification equipment and verification equipment, the method being applied to the verification equipment, comprising: Receive n public keys and n commitment values ​​from the proof device, calculated based on the target commitment protocol for the n secret values ​​it holds; Generate and send a single challenge value to the proof device; The receiving device sends a response value calculated for each secret value using the challenge value; For each secret value, verify whether the first value and the second value are equal. If they are equal, determine that the device has the secret value. The first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value. The first values ​​corresponding to the n secret values ​​share the operation value.

2. The method according to claim 1, wherein, The verification device and the proof device also share a first generator and a second generator in the elliptic curve group as common parameters; the operation value is determined based on the first generator and the challenge value, and the second value is determined based on the second generator, the public key corresponding to the secret value, and the response value.

3. The method according to claim 2, wherein, The response value includes a first response value and a second response value; The calculated value is the result of an operation with the first generator as the base and the challenge value as the exponent; the second value is determined based on the product of the first factor and the second factor, wherein the first factor is the result of an operation with the second generator as the base and the second response value as the exponent, and the second factor is the result of an operation with the corresponding public key as the base and the first response value as the exponent.

4. The method according to claim 1, wherein, The device is proven to have a random number corresponding to each secret value. The first response value is determined based on the random number, the secret value, and the challenge value, and the second response value is determined based on the random number and the first response value.

5. The method according to claim 4, wherein, Each secret value corresponds to a first random number, a second random number, and a third random number. The first and second random numbers are used to calculate the corresponding commitment value, and the third random number is used to calculate the corresponding public key. The first response value is determined by multiplying the sum of the first random number and the challenge value by a third factor, which is the inverse of the secret value; The second response value is determined based on the difference between the second random number and the fourth factor, which is the product of the third random number and the first response value.

6. The method according to claim 1, wherein, The proof device is a plurality of proof devices; the n secret values ​​are held by the plurality of proof devices.

7. The method according to claim 6, wherein, The plurality of proof devices are n proof devices; the n secret values ​​are the private keys of the n proof devices respectively.

8. The method according to any one of claims 1-7, wherein, The verification device and the proof device also share a common parameter, a prime number p greater than a preset value; the data verification is performed on a finite field modulo p.

9. A batch data verification apparatus, relating to verification equipment and verification equipment, the apparatus being applied to the verification equipment, comprising: The first receiving module is used to receive from the proof device n public keys and n commitment values ​​calculated based on the target commitment protocol for the n secret values ​​it holds; The generation module is used to generate and send a single challenge value to the proof device; The second receiving module is used to receive the response value sent by the proof device, which is calculated for each secret value using the challenge value; The data verification module is used to verify whether a first value and a second value are equal for each secret value. If they are equal, it is determined that the device has the secret value. The first value is determined based on the operation value of the challenge value and the commitment value corresponding to the secret value, and the second value is determined based on the public key corresponding to the secret value and the response value. The first values ​​corresponding to the n secret values ​​share the operation value.

10. A computer program product that, when executed by a processor, implements the method as described in any one of claims 1-8.

11. A computer device, comprising: processor; Memory used to store processor-executable instructions; The processor implements the method as described in any one of claims 1-8 by executing the executable instructions.

Images