Data Verification Method and System Constructed Based on Non-Interactive Zero-Knowledge Proof

Abstract

The present disclosure provides a data verification method and system based on non-interactive zero-knowledge proof, which relates to the field of information security technology and includes: for verification data, initializing the zk-SNARKs protocol, encoding the evaluation of a polynomial at a certain point using a secure coding algorithm on a ring to generate a common reference string and a verification key, and constructing a QRP problem for a computing task; based on the common reference string, generating a proof for the satisfiability of the arithmetic circuit on the ring corresponding to the executed computation; using the secret key in the verification key to decode the encoded content in the generated proof in combination with a decoding algorithm, and verifying the validity of the data in the received proof and the divisibility relationship of the polynomial in the QRP problem corresponding to the computing task on the plaintext, so as to verify the correctness of data computation, and at the same time ensure that the time required to execute the verification algorithm is less than the time required to re-execute the computing task.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and particularly to a data verification method and system constructed based on non-interactive zero-knowledge proof. Background Art

[0002] The statements in this part merely provide background technical information related to the present disclosure and do not necessarily constitute prior art.

[0003] In recent years, with the development of emerging technologies such as blockchain and cryptocurrency, as well as the rise of privacy computing requirements, zero-knowledge proof technology has once again become the focus of attention in related industries such as fintech and big data. For example, in a blending transaction, a user hopes to hide transaction details while still being able to prove the legitimacy of the transaction; in a smart contract, it is necessary to verify the correctness of contract execution while not exposing the privacy data during the execution process.

[0004] Zero-knowledge proof technology provides a secure way to verify the authenticity of information, allowing users to verify their identities without revealing sensitive information and preventing fraud. Some zero-knowledge proof schemes, such as zk-SNARKs and zk-STARKs, can prove the correctness of the calculations performed without revealing sensitive data, and the proof length is short, and the verification time is also much less than the time required to re-execute the original calculation. Therefore, zero-knowledge proof technology enables users to delegate calculations to untrusted servers, such as cloud servers, thus solving problems such as outsourcing of computing tasks and scalability of centralized ledgers in the case of limited computing resources and storage space. This provides an innovative solution for protecting privacy and enhancing security, and currently also shows great potential and value in practical applications.

[0005] The main content and existing problems of the current existing solutions are as follows:

[0006] 1) Existing SNARK structures usually assume that the calculations to be proven can be effectively expressed as arithmetic circuits over a finite field, and further represented as a satisfiability problem of arithmetic circuits over the field. The calculations are carried out over a prime field, which is not general enough in scenarios such as proving calculations on encrypted data such as BGV ciphertexts or proving arithmetic operations under a standard CPU architecture in reality, because simulating arithmetic over a ring in a finite field operation environment will significantly increase the overhead;

[0007] 2) Data in many practical problems naturally exists in a ring structure, such as polynomial operations, integer operations, etc. At the same time, currently widely used zk-SNARKs schemes, such as publicly verifiable schemes like Pinocchio, Groth16, etc., usually use bilinear pairings in the verification algorithm for verification. Bilinear pairings usually involve complex mathematical calculations, including large integer multiplication and modular operations, and the calculation of pairings is relatively slow, especially when multiple pairings are required.

[0008] 3) The NTRU-GSW homomorphic encryption scheme is an NTRU-based GSW-like homomorphic scheme constructed based on the NTRU problem and the GSW (Gentry-Sahai-Waters) scheme, which combines the advantages of both. NTRU encryption is based on the NTRU lattice problem, which involves solving the short vector problem on a polynomial ring. Generalizing the domain-restricted non-interactive zero-knowledge proof scheme to the ring requires finding a secure coding scheme on the ring that is compatible with the ciphertext space of the underlying homomorphic encryption scheme, and the NTRU-GSW homomorphic encryption scheme provides an idea for this. Summary of the Invention

[0009] To solve the above problems, the present disclosure proposes a data verification method and system based on non-interactive zero-knowledge proof, generalizes the domain-restricted zk-SNARK scheme to the ring, executes a zero-knowledge proof protocol on encrypted data, and proposes a construction method for a designated verifier's succinct non-interactive zero-knowledge proof based on NTRU-GSW homomorphic encryption, without the need to convert data to a finite field, and at the same time can verify complex computational relationships and mathematical propositions without revealing the original data.

[0010] According to some embodiments, the present disclosure adopts the following technical solutions:

[0011] A data verification method based on non-interactive zero-knowledge proof, comprising:

[0012] For the verification data, initialize the zk-SNARKs protocol, use a secure coding algorithm on the ring to encode the evaluation of a polynomial at a certain point, generate a common reference string and a verification key, and construct a QRP problem regarding the computational task;

[0013] Based on the common reference string, generate a proof for the satisfiability of the arithmetic circuit on the ring corresponding to the executed calculation;

[0014] Use the secret key in the verification key to decode the encoded content in the generated proof in combination with the decoding algorithm, verify the validity of the data in the received proof on the plaintext, and verify the divisibility relationship of the polynomials in the QRP problem corresponding to the computing task, so as to verify the correctness of the data calculation, and at the same time ensure that the time required to execute the verification algorithm is less than the time required to re-execute the computing task.

[0015] According to some embodiments, the present disclosure adopts the following technical solutions:

[0016] A data verification system constructed based on non-interactive zero-knowledge proofs, including:

[0017] An initialization setting module, used to initialize the zk-SNARKs protocol for the verification data, encode the evaluation of the polynomial at a certain point using a secure coding algorithm on the ring, generate a common reference string and a verification key, and construct a QRP problem for the computing task;

[0018] A proof generation module, used to generate a proof for the satisfiability of the arithmetic circuit on the ring corresponding to the executed calculation based on the common reference string;

[0019] A verification module, used to use the secret key in the verification key to decode the encoded content in the generated proof in combination with the decoding algorithm, verify the validity of the data in the received proof on the plaintext, and verify the divisibility relationship of the polynomials in the QRP problem corresponding to the computing task, so as to verify the correctness of the data calculation, and at the same time ensure that the time required to execute the verification algorithm is less than the time required to re-execute the computing task.

[0020] According to some embodiments, the present disclosure adopts the following technical solutions:

[0021] A computer program product, including a computer program, which when executed by a processor implements the data verification method constructed based on non-interactive zero-knowledge proofs.

[0022] According to some embodiments, the present disclosure adopts the following technical solutions:

[0023] A non-transitory computer-readable storage medium, which is used to store computer instructions, and when the computer instructions are executed by a processor, the data verification method constructed based on non-interactive zero-knowledge proofs is implemented.

[0024] According to some embodiments, the present disclosure adopts the following technical solutions:

[0025] An electronic device, comprising: a processor, a memory, and a computer program; wherein, the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device runs, the processor executes the computer program stored in the memory, so that the electronic device executes the data verification method based on non-interactive zero-knowledge proof.

[0026] Compared with the prior art, the beneficial effects of the present disclosure are as follows:

[0027] The data verification method based on non-interactive zero-knowledge proof of the present disclosure can provide verifiable computing on encrypted data. Users with relatively weak computing power can share their data in plaintext or ciphertext form with the staff and outsource the computing tasks to the staff. The staff can be a powerful server or cloud platform. The staff uses this solution to give proofs, and the user, as the verifier, can quickly verify the correctness of the calculation. At the same time, the workload required for verification is significantly less than that of directly running the computing task; if the data given by the user is FHE ciphertext data, such as BGV ciphertext, the original data can be better hidden.

[0028] The data verification method based on non-interactive zero-knowledge proof of the present disclosure is statistically zero-knowledge. Except for the prover and the verifier, others cannot obtain valid information from the proof, which can effectively protect the data privacy of users. It can resist attacks by quantum computers. The encoding method of the present disclosure is based on NTRU-GSW homomorphic encryption, and its security is based on the NTRU lattice problem. Compared with encryption or encoding schemes based on traditional mathematical problems, the encoding scheme based on lattice hard problems still maintains high security when quantum computers appear.

[0029] The data verification method based on non-interactive zero-knowledge proof of the present disclosure provides a new type of designated-verifier succinct non-interactive zero-knowledge proof scheme. Based on this design, the verification time of zk-SNARK is effectively reduced; a polynomial encoding scheme is designed using NTRU-GSW homomorphic encryption. Compared with using bilinear pairing or JL encryption schemes, the encoding scheme of this solution is based on lattice hard problems and has stronger security, especially when facing quantum computing attacks.

[0030] The data verification method based on non-interactive zero-knowledge proof of the present disclosure combines FHE and zk-SNARKs technologies, and uses the zk-SNARKs protocol on the ring to perform efficient zero-knowledge proof on encrypted data, without the need to convert the data to a finite field, and at the same time, complex computational relationships and mathematical propositions can be verified without revealing the original data. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings forming a part of this disclosure are used to provide a further understanding of this disclosure. The schematic embodiments of this disclosure and their descriptions are used to explain this disclosure and do not constitute an improper limitation of this disclosure.

[0032] Figure 1 It is a schematic diagram of the initialization setting algorithm for the embodiments of this disclosure;

[0033] Figure 2 It is a schematic diagram of the proof generation algorithm for the embodiments of this disclosure;

[0034] Figure 3 It is a schematic diagram of the verification algorithm for the embodiments of this disclosure;

[0035] Figure 4 It is the overall framework diagram of the method for the embodiments of this disclosure. Detailed implementation manners

[0036] The following further describes this disclosure in conjunction with the accompanying drawings and embodiments.

[0037] It should be noted that the following detailed descriptions are all exemplary and are intended to provide a further description of this disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which this disclosure belongs.

[0038] It should be noted that the terms used herein are only for describing specific implementation manners and are not intended to limit the exemplary embodiments according to this disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0039] Embodiment 1

[0040] In one embodiment of this disclosure, a data verification method based on non-interactive zero-knowledge proof construction is provided, including:

[0041] Step 1: For the verification data, initialize the zk-SNARKs protocol, encode the evaluation of the polynomial at a certain point using the secure coding algorithm on the ring, generate a common reference string and a verification key, and construct a QRP problem regarding the computing task;

[0042] Step 2: Based on the common reference string, generate a proof for the satisfiability of the arithmetic circuit on the ring corresponding to the executed computation;

[0043] Step 3: Use the secret key in the verification key to decode the encoded content in the generated proof in combination with the decoding algorithm, verify the validity of the data in the received proof on the plaintext, and verify the divisibility relationship of the polynomials in the QRP problem corresponding to the computing task, so as to verify the correctness of the data calculation, and at the same time ensure that the time required to execute the verification algorithm is less than the time required to re-execute the computing task.

[0044] As an embodiment, a data verification method based on non-interactive zero-knowledge proof construction of the present disclosure includes a secure encoding algorithm for rings with linear homomorphisms, an initialization setting algorithm, a proof generation algorithm, and a verification algorithm; the secure encoding algorithm is used to encode data on the ring for subsequent use in the zk-SNARKs protocol; the initialization setting algorithm is used for the verifier to initialize the protocol, construct a QRP problem about the computing task, and call the encoding algorithm to generate a common reference string and a verification key; the proof generation algorithm is used for the prover to generate a proof for the satisfiability of the arithmetic circuit on the ring corresponding to the executed calculation, and this proof is used for the verifier to verify that the prover has correctly executed the calculation, and at the same time the given proof is short; the verification algorithm is used to verify the proof of the computing correctness provided by the prover, and at the same time the time required to execute the verification algorithm is much less than the time required to re-execute the computing task, where the secure encoding method for rings with linear homomorphisms is implemented through the NTRU-GSW homomorphic encryption scheme, and the key generation, encoding, and decoding algorithms of the secure encoding algorithm for rings with linear homomorphisms on the ring are respectively The specific implementation process of the method of the present disclosure is as follows:

[0045] Step 1: For the verification data, initialize the zk-SNARKs protocol, use the secure encoding algorithm for rings to encode the evaluation of the polynomial at a certain point, generate a common reference string and a verification key, and construct a QRP problem about the computing task;

[0046] Specifically, the verifier executes the initialization setting algorithm, generates a secret key according to the key generation algorithm in the secure encoding algorithm and generates a challenge point and the required random parameters;

[0047] Use the secure polynomial encoding algorithm for rings with linear homomorphisms designed based on NTRU-GSW homomorphic encryption to encode the powers of, the evaluation of the QRP polynomial obtained by converting the computing task at the challenge point s, the evaluation of the product of the polynomial and the random parameter as an offset at the challenge point s, and the evaluation of the linear combination of polynomials at the challenge point s as the common reference string ;

[0048] Furthermore, construct the QRP problem for the computing task. The method of reducing the computing task on the ring to the QRP polynomial is similar to the method of reducing the task on the field to the QAP polynomial. Both are achieved by first expressing it as an arithmetic circuit to obtain the R1CS circuit constraints, that is, obtaining the assignment vector of all variables and the multi-dimensional vector regarding the circuit structure, and further obtaining the polynomial through interpolation. The QRP polynomial is in the form of the combination operation of the assignment vector and the polynomial; the secret key , the common reference string , the challenge point s, and the random parameter together constitute the verification cipher. The verification key is private to the verifier and is used in the verification stage; as Figure 1 shown, the specific implementation of the above process is as follows:

[0049] Step A1.1: The verifier calls the key generation algorithm in the linear homomorphic encoding algorithm to generate the secret key , randomly selects the challenge point on , randomly selects the parameter on , sets , and randomly selects the parameter on ;

[0050] The ring is a commutative ring with unity, all the invertible elements on constitute , and the exceptional set satisfies

[0051] Step A1.2: The computing task on the ring can be expressed as an arithmetic circuit on the ring with inputs and outputs. For the arithmetic circuit , the processing method is similar to the classical zk-SNARKs scheme. The verifier can convert the circuit constraints into the QRP polynomial constraints on the ring according to the R1CS circuit constraint system and Lagrange interpolation, that is and a target polynomial . These polynomials are all elements in the ring . The verifier can only obtain the input values and output values of the circuit in the variable assignment vector and cannot know the values of the circuit intermediate variables;

[0052] The verifier uses the encoding algorithm for Encode the evaluation of the power, polynomial at s, the evaluation of the polynomial multiplied by a random parameter as an offset at s, and the evaluation of the linear combination of polynomials at s to obtain:

[0053]

[0054]

[0055]

[0056]

[0057]

[0058] These encoded values form a common reference string ;

[0059] Among them, represents the set of subscripts of the variables controlled by the prover, that is, the set of subscripts of the intermediate variables. The linear homomorphic encoding algorithm for polynomials on the ring designed based on the NTRU-based GSW-like homomorphic encryption scheme is described by the parameter to describe, is 's dimension, and are the moduli of the plaintext and ciphertext respectively, is the standard deviation of the key:

[0060] : Select and set until exists in , that is needs to be invertible in , output ;

[0061] : Given and polynomial , select , set , calculate , return 's encrypted value c as the encoded value;

[0062] : Calculate , and are both very short polynomials, the noise in the ciphertext is small enough, and the plaintext can be extracted from by scaling and rounding, calculate , output As the plaintext after decryption ;

[0063] Step A1.3: The verifier publicly , and combines the challenge point , the parameter { }, , the private key together to form the verifier's private verification key ;

[0064] Step 2: Based on the common reference string, generate a proof for the satisfiability of the ring arithmetic circuit corresponding to the performed computation, including: In the proof generation phase, the prover uses valid assignments of circuit inputs, outputs, and intermediate variables, and linearly homomorphically computes the encoding of the polynomial linear combination. At the same time, for the case where random parameters are used as offsets, the encoding is recalculated to provide reliability for the proof;

[0065] The prover uses the computed encoding ( in the following step A2.5), the encoding with offsets ( in the following step A2.6 and in the following step A2.7), the encoding of the quotient polynomial at the challenge point s and its encoding with offsets as evidence to form a proof, and sends the result obtained by correctly performing the computational task to the verifier. The verifier can confirm the correctness of the computation performed by the prover according to the and verification algorithm, and thus believe the computation result; As Figure 2 shown, the specific implementation process is as follows:

[0066] Step A2.1: The prover computes the computational task according to the input specified by the verifier (i.e., the customer), and obtains the output result of the computational task;

[0067] Step A2.2: Express as a ring arithmetic circuit with inputs and outputs. According to the performed computation, in addition to knowing the input and output values, the prover can also obtain the values of the intermediate variables. That is to say, the prover has a set of input / output values , and at the same time, the prover knows a set of intermediate variable values satisfying is divisible by , that is, the satisfiability of the corresponding arithmetic circuit holds;

[0068] Among them, , where it can be regarded as ;

[0069] Step A2.3: The prover calculates , calculates , and then calculates the quotient polynomial . The existence of the quotient polynomial indicates the existence of polynomial divisibility;

[0070] Step A2.4: The prover uses the rerandomization technique to provide zero - knowledge for the scheme, that is, the prover randomly selects a parameter for polynomial blinding;

[0071] Step A2.5: According to the encoding of the polynomial evaluated at point s in , using the linear homomorphic property of the encoding scheme, the prover calculates the blinded polynomial encoding value , and calculates the quotient polynomial after blinding it to and the encoding at point s ;

[0072] Among them, ;

[0073] Step A2.6: For the case where a random parameter is used as an offset, that is, the prover, according to , for the case where a random parameter crs is used as an offset, in a similar way to calculating in Step A2.5, repeats the calculation to obtain the encoding with an offset : , because the use of the offset can force the prover to use the encoding value at the point given by the verifier, and at the same time, the use of different guarantees the non - interchangeability of the multi - variable polynomial operands;

[0074]

[0074] Step A2.7: The prover uses to ensure the consistency of cross - operand variables. According to , calculates the polynomial linear combination of the blinded encoding , where ;

[0075] Step A2.8: The prover generates a short proof ;

[0076] Step 3: Use the secret key in the verification key to decode the encoded content in the generated proof with the decoding algorithm, verify the validity of the data in the received proof on the plaintext, and verify the divisibility relationship of the polynomials in the QRP problem corresponding to the computing task, so as to verify the correctness of the data calculation. At the same time, ensure that the time required to execute the verification algorithm is less than the time required to re-execute the computing task, including: In the verification phase, the verifier uses the secret key to decode the proof , and combine the part of the computing input it controls and the received computing output result to form a complete QRP polynomial, verify that the polynomial divisibility relationship holds, thereby proving that the arithmetic circuit on the ring is satisfiable, that is, the computing task is correctly executed;

[0077] In addition, the verifier also needs to verify the offset relationship of the decoded polynomial to ensure that the polynomial encoded in the proof is correctly generated by the prover at the challenge point s, rather than forged, that is, the data in the proof is valid, as Figure 3 shown, the specific implementation process is as follows:

[0078] Step A3.1: The verifier calls the decoding algorithm of the encoding algorithm for the proof given by the prover , and decrypts to obtain ;

[0079] Step A3.2: The verifier calculates the polynomial combination corresponding to the part of the variables it knows or can control, that is, the subscript represents the polynomial linear combination corresponding to the input variables and output variables that the verifier knows: , and uses the value obtained by decrypting to calculate and ;

[0080] Step A3.3: Verify whether the offset holds, so as to check the correctness of the proof given by the prover : ;

[0081] Here, take as an example to explain the correctness of the verification. The other 5 verification equations in the verification algorithm are the same. According to the encoded values given in : , where are the randomly selected polynomials in the encoding algorithm respectively. The prover can calculate , and the verifier calculates according to and the decoding algorithm for and Decode to obtain , so for a valid proof, the verification will pass;

[0082] Step A3.4: The verifier verifies whether the offset of the polynomial linear combination holds: , thus ensuring the consistency of cross-operand variables;

[0083] Step A3.5: The verifier verifies whether the quotient polynomial is correct: , thus verifying the correctness of the prover's calculation.

[0084] Embodiment 2

[0085] An embodiment of the present disclosure provides a data verification system based on non-interactive zero-knowledge proof construction, including:

[0086] An initialization setting module, which is used to initialize the zk-SNARKs protocol for verification data, encode the evaluation of a polynomial at a certain point using a secure coding algorithm on a ring, generate a common reference string and a verification key, and construct a QRP problem for the computing task;

[0087] A proof generation module, which is used to generate a proof for the satisfiability of the arithmetic circuit on the ring corresponding to the executed calculation based on the common reference string;

[0088] A verification module, which is used to decode the encoded content in the generated proof using the secret key in the verification key in combination with a decoding algorithm, verify the validity of the data in the received proof and the divisibility relationship of the polynomials in the QRP problem corresponding to the computing task on the plaintext, thereby verifying the correctness of the data calculation, and at the same time ensuring that the time required to execute the verification algorithm is less than the time required to re-execute the computing task.

[0089] Embodiment 3

[0090] An embodiment of the present disclosure provides a computer program product, characterized in that when the computer program is executed by a processor, it implements the data verification method based on non-interactive zero-knowledge proof construction.

[0091] Embodiment 4

[0092] An embodiment of the present disclosure provides a non-transitory computer-readable storage medium, and the non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the data verification method based on non-interactive zero-knowledge proof construction is implemented.

[0093] Embodiment 5

[0094] In one embodiment of the present disclosure, an electronic device is provided, including: a processor, a memory, and a computer program; wherein, the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device runs, the processor executes the computer program stored in the memory, so that the electronic device executes the data verification method based on non-interactive zero-knowledge proof construction described above.

[0095] The present disclosure is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present disclosure. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the functions specified in one Figure 1 flow or multiple flows and / or blocks Figure 1 or multiple blocks.

[0096] These computer program instructions can also be loaded onto a computer or other programmable data processing devices, so that a series of operation steps are executed on the computer or other programmable devices to generate computer-implemented processing, and thus the instructions executed on the computer or other programmable devices provide steps for implementing the functions specified in one Figure 1 flow or multiple flows and / or blocks Figure 1 or multiple blocks.

[0097] Although the specific embodiments of the present disclosure have been described above in conjunction with the accompanying drawings, it is not a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that, based on the technical solutions of the present disclosure, various modifications or deformations that can be made by those skilled in the art without creative efforts are still within the protection scope of the present disclosure.

Claims

1. A data verification method constructed based on non-interactive zero-knowledge proof, characterized in that Including: For the verification data, initialize the zk-SNARKs protocol, encode the evaluation of the polynomial at the challenge points using the secure coding algorithm on the ring, generate the common reference string and the verification key, construct the QRP problem for the computing task, the QRP problem reduces the computing task on the ring to the QRP polynomial, by expressing the computing task as an arithmetic circuit, obtain the R1CS circuit constraints, that is, obtain the assignment vector of all variables and the multi-dimensional vector about the circuit structure, and further obtain the polynomial by interpolation; the QRP polynomial is in the form of the combination operation of the assignment vector and the polynomial; Based on the common reference string, generate a proof for the satisfiability of the arithmetic circuit on the ring corresponding to the executed computation; including: in the proof generation stage, the prover uses the valid assignments of the circuit inputs, outputs and intermediate variables and the common reference string to linearly homomorphically compute the encoding of the linear combination of polynomials, and at the same time uses random parameters as offsets, repeatedly computes the encoding with offsets, and the prover uses the computed encoding, the encoding with offsets, and the encoding of the quotient polynomial at the challenge points as evidence to form the proof; Use the secret key in the verification key to decode the encoded content in the generated proof, verify the validity of the data in the received proof and the divisibility relationship of the polynomials in the QRP problem corresponding to the computing task on the plaintext, so as to verify the correctness of the data computation, and at the same time ensure that the time required to execute the verification algorithm is less than the time required to re-execute the computing task; Initialize the zk-SNARKs protocol, including: the verifier executes the initialization setting algorithm, and uses the linearly homomorphic secure coding algorithm for polynomials on the ring designed based on NTRU-GSW homomorphic encryption to encode the powers of the challenge points, the evaluations of the QRP polynomials obtained by converting the computing tasks at the challenge points, the evaluations of the polynomials multiplied by random parameters as offsets at the challenge points, and the evaluations of the linear combinations of polynomials at the challenge points as the common reference string.

2. The data verification method based on non-interactive zero-knowledge proof construction according to claim 1, characterized in that, The secret key, the common reference string, the challenge points and the random parameters together form the verification key, which is private to the verifier and is used in the verification stage.

3. The data verification method based on non-interactive zero-knowledge proof construction according to claim 1, characterized in that The verifier decodes the proof using the secret key, and combines the computing input part controlled by itself and the received computing output result to combine the complete QRP polynomial, and verifies that the polynomial divisibility relationship holds, so as to prove that the arithmetic circuit on the ring is satisfiable, that is, the computing task is correctly executed.

4. The data verification method based on non-interactive zero-knowledge proof construction according to claim 3, wherein The verifier also needs to verify the offset relationship of the polynomials obtained by decoding to ensure that the polynomial values encoded in the proof are correctly generated by the prover at the challenge points, or the data in the proof is valid.

5. A data verification system constructed based on non-interactive zero-knowledge proofs, characterized in that, Including: Initialization setting module, which is used to initialize the zk-SNARKs protocol for verification data, encode the evaluation of polynomials at challenge points using the secure coding algorithm on the ring, generate a common reference string and a verification key, and construct a QRP problem for the computing task; the QRP problem reduces the computing task on the ring to a QRP polynomial. By expressing the computing task as an arithmetic circuit, an R1CS circuit constraint is obtained, that is, an assignment vector of all variables and a multi-dimensional vector regarding the circuit structure are obtained, and further a polynomial is obtained through interpolation; the QRP polynomial is in the form of a combination operation of the assignment vector and the polynomial. Proof generation module, which is used to generate a proof for the satisfiability of the arithmetic circuit on the ring corresponding to the executed computation based on the common reference string; including: in the proof generation stage, the prover linearly homomorphically calculates the encoding of the linear combination of polynomials using the valid assignments of the circuit inputs, outputs and intermediate variables and the common reference string, and at the same time uses random parameters as offsets, repeatedly calculates the encoding with offsets. The prover uses the calculated encoding, the encoding with offsets, and the encoding of the quotient polynomial at the challenge point as evidence to form a proof. Verification module, which is used to decode the encoded content in the generated proof using the secret key in the verification key combined with the decoding algorithm, verify the validity of the data in the received proof on the plaintext and the divisibility relationship of the polynomials in the QRP problem corresponding to the computing task, so as to verify the correctness of the data calculation, and at the same time ensure that the time required to execute the verification algorithm is less than the time required to re-execute the computing task. Initialize the zk-SNARKs protocol, including: the verifier executes the initialization setting algorithm, and uses the linearly homomorphic secure coding algorithm of polynomials on the ring designed based on NTRU-GSW homomorphic encryption to encode the powers of the challenge points, the evaluations of the QRP polynomials obtained by converting the computing tasks at the challenge points, the evaluations of the polynomials multiplied by random parameters as offsets at the challenge points, and the evaluations of the linear combinations of polynomials at the challenge points as the common reference string.

6. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the data verification method based on non-interactive zero-knowledge proof construction according to any one of claims 1-4.

7. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, it implements the data verification method based on non-interactive zero-knowledge proof construction according to any one of claims 1-6.

8. An electronic device, characterized in that, Including: A processor, a memory, and a computer program; wherein, the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device runs, the processor executes the computer program stored in the memory so that the electronic device executes the data verification method based on non-interactive zero-knowledge proof construction according to any one of claims 1-4.

Images