High-performance increment verifiable calculation method suitable for block chain capacity expansion

Abstract

The invention relates to the technical field of information security, discloses a high-performance increment verifiable calculation method suitable for blockchain capacity expansion, and can solve the problems that recursion overhead is too high and high-order constraints are difficult to support in a PCD scheme. The method comprises the following steps: jointly defining an augmented circuit by a prover and a verifier, and expressing calculation to be proven and recursive operation required for realizing the verifiable increment; the augmentation circuit is used for executing local calculation, namely a certification algorithm, of a certifier and executing recursion operation, and the recursion operation comprises Hash operation and a verification algorithm of a multiple folding scheme; the proving algorithm comprises the following steps: analysis proving, multiple folding, Hash compression, circuit execution and output proving respectively in the following steps 1-5; the verification algorithm comprises the following steps: analysis proof, hash verification, instance witness pair verification and verification result output in the following steps 6-9.

Description

Technical Field

[0001] The present invention relates to the field of information security technologies, and in particular to a high-performance incremental verifiable computing method suitable for blockchain expansion. Background Art

[0002] Blockchain is a technology that can perform computations securely in a decentralized open network system. It has been widely used in finance, supply chain management, data sharing, decentralized identity authentication and other scenarios. However, as the transaction volume grows, blockchain faces the need for expansion with low throughput and high costs. Traditional blockchain expansion solutions (such as zk-Rollup) significantly reduce the on-chain burden by batch processing simple transactions and generating zero-knowledge proofs, but are usually limited to specific transaction scenarios.

[0003] Zero-Knowledge Virtual Machine (zkVM) is an innovative computing system that combines zero-knowledge proof technology with virtual machine architecture. It is designed to efficiently and privately perform general computing tasks and generate verifiable zero-knowledge proofs in a decentralized network. Compared with traditional blockchain virtual machines, zkVM does not disclose the specific content of input, execution status or results during the calculation process, and only generates zero-knowledge proofs that can prove the correctness of program execution and calculation, thereby protecting user data privacy. zkVM is compatible with complex smart contracts and any general computing logic, breaking through the limitation that traditional expansion solutions such as zk-Rollup only support specific transaction types. zkVM generates a single recursive zero-knowledge proof for all operations in the calculation process, so that the verifier does not need to re-execute the calculation, and can confirm the correctness of the calculation only by verifying the proof, thereby significantly reducing the on-chain computing and storage costs. zkVM maintains compatibility with the Ethereum Virtual Machine (EVM), supports the direct migration of existing smart contracts, and lowers the threshold for deploying new technologies.

[0004] With the above features, zkVM is widely regarded as an important development direction for blockchain expansion, providing a flexible and efficient solution to meet the growing throughput and computing needs of decentralized systems.

[0005] The core of zkVM is to combine zero-knowledge proof technology with the state transition mechanism of the virtual machine. In zkVM, smart contracts or arbitrary programs are divided into several instructions, each of which corresponds to a state transition. The execution process of zkVM can be described as a series of state transitions, from the initial state to the final result state, to generate a zero-knowledge proof that can prove the correctness of the complete computation path.

[0006] Incrementally Verifiable Computation (IVC) and its generalized variant, Proof-Carrying Data (PCD), are one of the key technologies for constructing zkVM. They regard the program execution process of zkVM as a series of state transitions, each of which corresponds to the execution of an instruction. IVC / PCD can provide recursive proofs for these state transitions without the need to preset static loop boundaries, and each step of the proof only requires the memory space required for the current execution. At the same time, IVC / PCD proofs can be generated in parallel and aggregated in a tree structure, greatly improving the efficiency of verifying large-scale program execution. The role of IVC / PCD in zkVM is reflected in the following aspects:

[0007] The program execution of zkVM is modeled as a series of state transitions, with each state corresponding to the execution of an instruction. IVC / PCD generates a zero-knowledge proof for each state transition to prove the correctness of the current calculation, while recursively nesting the proof of the previous stage to finally form a unified proof. Through recursive proof, the verifier only needs to verify the final proof to confirm the correctness of the entire calculation process, without having to gradually verify all the intermediate state transitions, thereby achieving efficient verification.

[0008] The recursive proof mechanism of IVC / PCD enables zkVM to dynamically support arbitrarily complex computing logic without presetting fixed loop boundaries. This dynamic recursive feature not only reduces the workload of developers, but also makes zkVM more flexible and adaptable to various complex computing scenarios. At the same time, the generation of recursive proofs can be further optimized through parallel computing, so that the verification scale can remain controllable as the computing scale expands.

[0009] To support seamless integration with virtual machines, zkVM uses IVC / PCD technology to build a recursive proof scheme compatible with EVM bytecode. Each bytecode instruction is modeled as an independent computing circuit, and IVC / PCD generates a recursive proof chain for these circuits, compressing the execution results of the EVM bytecode into the final proof, ensuring the correctness and efficiency of the calculation.

[0010] zkVM, combined with IVC / PCD technology, can support general computing in all scenarios from simple transactions to complex smart contracts, making up for the limitations of traditional zk-Rollup. The recursive proof feature of IVC / PCD makes the verification efficiency of zkVM extremely high. No matter how the scale of the program grows, the verifier only needs to verify a single concise final proof, which significantly reduces the on-chain computing and storage costs. IVC / PCD supports the parallel generation of proofs, and further optimizes the proof generation performance of large-scale programs through a tree-like aggregation structure, which is suitable for blockchain scenarios with high throughput requirements. By supporting various bytecode execution and recursive proof generation, zkVM provides a solution for smooth migration of existing blockchain applications, providing strong technical support for actual implementation.

[0011] In 2010, Chiesa et al. extended the concept of IVC to PCD for the first time and constructed a specific scheme based on the hearsay argument of the auxiliary prover. However, the scheme relies on the signature scheme and the general argument with high complexity, and has poor performance and is difficult to apply in practice. In order to further promote the PCD scheme from theory to practice, scholars have been committed to improving the construction technology and implementation architecture of PCD in recent years to improve its actual performance. However, the existing research schemes still face two problems.

[0012] The first is the problem of high recursive overhead. The calculations targeted by zero-knowledge proofs are usually expressed as circuits. In order to achieve incremental verifiability, in addition to proving the circuit corresponding to the calculation, it is also necessary to prove the circuit that expresses the verification algorithm, and the size of this circuit is measured as the recursive overhead. The recursive overhead reflects the number of additional operations that need to be proved to achieve incremental verifiability, and in order to make PCD more practical, the size of the computational circuit is usually significantly higher than the recursive overhead. Therefore, the recursive overhead is an important performance indicator of the PCD scheme. However, the recursive overhead of the current best-performing PCD scheme is still about 23r-9 group power operations, which limits the widespread application of the PCD scheme, where r represents the number of input messages of a prover.

[0013] The second is the problem of difficulty in supporting high-order constraints. Traditional circuits generally only contain addition gates and multiplication gates, which require a larger circuit scale when expressing complex calculations. In recent years, circuit gates that express high-order constraints have become popular in industry and academia. By adding high-order constraint gates, the scale of the circuit expressing the same calculation can be greatly reduced, thereby improving the proof and verification performance. However, all current PCD solutions do not provide support for high-order constraints, making the application of PCD inefficient. Summary of the invention

[0014] In order to solve the problem of high recursive overhead and difficulty in supporting high-order constraints in the above PCD solution, the present invention provides a high-performance incremental verifiable calculation method suitable for blockchain expansion. The technical solution of the method is as follows:

[0015] The prover and the verifier jointly define an augmented circuit to express the computation to be proved and the recursive operations required to achieve incremental verifiability;

[0016] The augmented circuit is used to: perform the prover's local computation, i.e., the proof algorithm, and perform recursive operations, including hash operations and the verification algorithm of the multi-folding scheme;

[0017] The proof algorithm includes the following steps 1-5:

[0018] Step 1: Parse the proof: parse the input proof into several instance witness pairs;

[0019] Step 2, multi-folding: call the proof algorithm of the multi-folding scheme to fold multiple instance witness pairs into one;

[0020] Step 3, hash compression: use the hash function to compress the output of the augmented circuit;

[0021] Step 4, execute the circuit: execute the augmented circuit according to all the data obtained in the previous steps, and express the result as an instance witness pair of the customizable constraint system;

[0022] Step 5: Output proof: Output the instance witness pair obtained by multiple folding and the instance witness pair obtained by executing the circuit;

[0023] The verification algorithm includes the following steps 6-9:

[0024] Step 6: Parse the proof: Parse the input proof into two instance witness pairs;

[0025] Step 7: Verify the hash: verify the hash relationship that the instance witness should satisfy;

[0026] Step 8: Verify the instance witness pair: verify whether the instance witness pair is satisfied according to the definition of the corresponding relationship;

[0027] Step 9: Output verification results: Output verification results according to the checks in steps 7 and 8 above.

[0028] Optionally, in a possible implementation, the augmented circuit is represented as Mainly performs the prover's local operations and recursive operations, and locally calculates the message of the input previous node and the prover's local message z loc , output a new message z, using the predicate Indicates the satisfiability of computation, and the recursive operations mainly include hash operations and verification algorithms of multiple folding schemes; The specific definition is as follows:

[0029]

[0030] (1) Check the predicate Is it satisfyable?

[0031] (2) If for all i∈[r], there is z i =⊥, then check h = hash(fvk, z, U ⊥ ), where U ⊥ is a trivially satisfiable LCCCS instance; otherwise check:

[0032] (a) For i∈[r], u i .x=hash(fvk,z i , U i ), where u i .x is u i Public input and output of

[0033] (b)

[0034] (c) h = hash(fvk, z, U);

[0035] (3) If all the above checks pass, output 1, otherwise output 0.

[0036] Optionally, in one possible implementation, the proof algorithm is Input the proof key pk=fpk, r messages from the previous node and the proof Local Message loc and the generated new message z, output a new proof Π, which incrementally proves the correctness of the local computation and all previous computations;

[0037] The proof algorithm includes five steps: analytical proof, multiple folding, hash compression, execution circuit, and output proof. The specific definitions are as follows:

[0038] Step 1. Analytical proof: For i∈[r], replace Π i Parsed as (U i , W i ), (u i , w i ), where (u i , W i ) is a satisfiable LCCCS instance witness pair, (u i , w i ) is a satisfiable CCCS instance witness pair.

[0039] Step 2: Multiple folds: If for any i∈[r], there is z i =⊥, then let (U, W, π): = (U ⊥ , W⊥ , ⊥), where (U ⊥ , W ⊥ ) is a trivially satisfiable LCCCS instance witness pair; otherwise, compute:

[0040]

[0041] Step 3, hash compression: calculate h←hash(fvk, z, U).

[0042] Step 4: Execute the circuit: The trace algorithm augments the circuit The execution result of is expressed as a satisfiable CCCS instance witness pair.

[0043] Step 5. Output proof: Output Π: =((U, W), (u, w)).

[0044] Optionally, in a possible implementation, the verification algorithm is 0 / 1←PCD.V(vk, z, Π), inputs the verification key vk=fvk, the message z and the proof Π, and outputs the verification result;

[0045] The parsing proof, verification hash, verification instance witness pair, and output verification in the verification algorithm are specifically defined as follows:

[0046] Step 6, analytical proof: Parse Π as ((U, W), (u, w)).

[0047] Step 7, verify the hash: check whether ux=hash(fvk, z, U) holds.

[0048] Step 8. Verify the instance witness pair: Check that W is a LCCCS witness that satisfies U and w is a CCCS witness that satisfies u.

[0049] Step 9: Output verification result: If all the above checks are true, output 1; otherwise, output 0.

[0050] Optionally, in a possible implementation, the prover's local calculation, hash operation, all operations except group operation in the multiple folding scheme verification algorithm, and the verification algorithm called multiple times by the folding scheme are executed through the main circuit; and the group operation in the multiple folding scheme verification algorithm is executed through the secondary circuit.

[0051] Furthermore, the present invention also provides a zero-knowledge virtual machine, which implements the high-performance incremental verifiable computing method described in any of the above items through four steps: executing encoding instructions, constructing augmented circuits, calling proof algorithms, and calling verification algorithms.

[0052] The present invention adopts the above technical solution to achieve the following technical effects:

[0053] 1) Low recursive overhead. The recursive operation of the scheme of the present invention is mainly a verification algorithm of the multiple folding scheme, which contains only about 2r-1 group power operations, greatly reducing the recursive overhead of the existing scheme.

[0054] 2) Support for high-order constraints. The solution of the present invention expresses the execution of the augmented circuit as an instance witness pair of a customizable constraint system, which can flexibly express constraints of any order and greatly reduce the circuit scale.

[0055] 3) High practical performance. The solution of the present invention avoids domain simulation operations in the circuit and avoids the problem of circuit scale expansion by dividing the main circuit and the secondary circuit.

[0056] Therefore, the implementation architecture of the present invention can fully unleash the performance of the PCD solution, allowing it to be efficiently applied to more complex scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The accompanying drawings exemplarily illustrate the embodiments and constitute a part of the specification, and together with the text description of the specification, are used to explain the exemplary implementation of the embodiments. The embodiments shown are for illustrative purposes only and do not limit the scope of the claims. In all drawings, the same reference numerals refer to similar but not necessarily identical elements.

[0058] Figure 1 It is the basic structure diagram of PCD in the present invention;

[0059] Figure 2 It is a schematic diagram of the PCD circuit implementation in the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0061] It should be noted that the descriptions of "first", "second", etc. in the present invention are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0062] In the description of the present invention, it should be understood that the numerical labels before the steps do not identify the order of executing the steps, but are only used to facilitate the description of the present invention and distinguish each step, and therefore cannot be understood as a limitation of the present invention.

[0063] The computations targeted by zero-knowledge proofs are usually expressed as circuits. In order to achieve incremental verifiability, in addition to proving the circuit corresponding to the computation, it is also necessary to prove the circuit that expresses the verification algorithm, and the size of this circuit is measured as the recursive overhead. The recursive overhead reflects the number of additional operations that need to be proved to achieve incremental verifiability, and in order to make PCD more practical, the size of the computational circuit is usually significantly higher than the recursive overhead. Therefore, the recursive overhead is an important performance indicator of the PCD scheme. However, the recursive overhead of the current best-performing PCD scheme is still about 23r-9 group power operations, which limits the widespread application of the PCD scheme, where r represents the number of input messages by a prover. Therefore, the traditional scheme has the problem of too high recursive overhead.

[0064] Traditional circuits generally only contain addition gates and multiplication gates, which require a large circuit scale when expressing complex calculations. In recent years, circuit gates that express high-order constraints have become popular in industry and academia. By adding high-order constraint gates, the scale of the circuit expressing the same calculation can be greatly reduced, thereby improving the proof and verification performance. However, all current PCD schemes do not provide support for high-order constraints, making the application of PCD inefficient. Therefore, traditional methods have the problem of difficulty in supporting high-order constraints.

[0065] To facilitate those skilled in the art to understand the technical solution provided by the present invention, the symbols and their meanings involved in the present invention are explained as follows:

[0066]

[0067]

[0068] The main purposes of the present invention are as follows: first, to reduce the recursive overhead of the existing PCD scheme and improve the actual performance of PCD; second, to solve the problem that the existing PCD scheme is difficult to support high-order constraints and improve the flexibility of the scheme in actual scenarios.

[0069] In order to achieve the above objectives, the present invention proposes a high-performance incremental verifiable calculation method suitable for blockchain expansion, and its specific scheme is as follows:

[0070] It includes two entities: the prover and the verifier. The prover inputs r messages and corresponding proofs, performs local calculations, and generates proofs to prove the validity of local calculations and all input proofs. The verifier inputs a message and corresponding proof to verify the correctness of the message.

[0071] The technical solution of the present invention is based on three constraint systems: Committed Customizable Constraint System (CCCS), Linearized Committed Customizable Constraint System (LCCCS) and Committed Relaxed Rank-1 Constraint System (CRR1CS), and relies on two cryptographic schemes: non-interactive multiple folding scheme and non-interactive folding scheme. CCCS, LCCCS and CRR1CS respectively define different algebraic relations that instances and witnesses should satisfy.

[0072] The technical solution of the present invention abandons the construction method of the existing PCD scheme based on SNARK or accumulation scheme, and instead constructs the PCD scheme based on a multiple folding scheme to reduce the recursive overhead and support high-order constraints.

[0073] The multi-folding scheme can fold multiple CCCS and LCCCS instance witness pairs into one, that is, reduce the verification of multiple instances to the verification of one instance. The folding scheme can fold two CRR1CS instance witness pairs into one, that is, reduce the verification of two instances to the verification of one instance.

[0074] Specifically,

[0075] 1. The proof algorithm and verification algorithm of the non-interactive multi-folding scheme are expressed as follows:

[0076] Proof Algorithm Input the proof key fpk, r LCCCS instance witness pairs {(U i , W i )} i∈[r] , r CCCS instance witness pairs {(u i , w i )} i∈[r] , output an instance witness pair (U, W) of LCCCS and proof π.

[0077] Verification Algorithm Input verification key fvk, r instances of LCCCS {U i} i∈[r] , r CCCS instances {u i} i∈[r] And prove π, output an instance U of LCCCS.

[0078] 2. The proof algorithm and verification algorithm of the non-interactive folding scheme are as follows:

[0079] Proof Algorithm Input the proof key fpk′, two CRR1CS instance witness pairs (U′1, W′1), (U′2, W ′ 2), output a CRR1CS instance witness pair (U′, W′) and proof π′.

[0080] Verification algorithm U′←NIFS.V(fvk′, U′1, U′2, π′): inputs the verification key fvk′, two CRR1CS instances U′1, U′2 and proof π′, and outputs an instance U′ of CRR1CS.

[0081] By calling the non-interactive folding scheme multiple times, multiple CRR1CS instance witness pairs can also be folded into one. At this time, the proof algorithm and verification algorithm can be expressed as:

[0082]

[0083] See also Figure 1 The PCD basic structure diagram shown in the present invention is a high-performance incremental verifiable calculation method suitable for blockchain expansion, including:

[0084] The prover and the verifier jointly define an augmented circuit to express the computation to be proved and the recursive operations required to achieve incremental verifiability;

[0085] The prover inputs the message and proof from the previous node, performs local calculations, and generates a new proof, which incrementally proves the correctness of the local calculation and all previous calculations. The verifier inputs the message and proof generated by a prover, and verifies the correctness of all previous calculations that generated the message.

[0086] The augmented circuit is used to: perform the prover's local computation (i.e., the proof algorithm), perform recursive operations, and the recursive operations include hash operations and the verification algorithm of the multi-folding scheme;

[0087] The proof algorithm includes the following steps 1-5:

[0088] Step 1: Parse the proof: parse the input proof into several instance witness pairs;

[0089] Step 2, multi-folding: call the proof algorithm of the multi-folding scheme to fold multiple instance witness pairs into one;

[0090] Step 3, hash compression: use the hash function to compress the output of the augmented circuit;

[0091] Step 4, execute the circuit: execute the augmented circuit according to all the data obtained in the previous steps, and express the result as an instance witness pair of the customizable constraint system;

[0092] Step 5: Output proof: Output the instance witness pair obtained by multiple folding and the instance witness pair obtained by executing the circuit;

[0093] The verification algorithm includes the following steps 6-9:

[0094] Step 6: Parse the proof: Parse the input proof into two instance witness pairs;

[0095] Step 7: Verify the hash: verify the hash relationship that the instance witness should satisfy;

[0096] Step 8: Verify the instance witness pair: verify whether the instance witness pair is satisfied according to the definition of the corresponding relationship;

[0097] Step 9: Output verification results: Output verification results according to the checks in steps 7 and 8 above.

[0098] To be more specific, the augmented circuit is expressed as Mainly performs the prover's local operations and recursive operations, and locally calculates the message of the input previous node and the prover's local message z loc , output a new message z, using the predicate Indicates the satisfiability of computation, and the recursive operations mainly include hash operations and verification algorithms of multiple folding schemes; The specific definition is as follows:

[0099]

[0100] (1) Check the predicate Is it satisfyable?

[0101] (2) If for all i∈[r], there is z i =⊥, then check h = hash(fvk, z, U ⊥ ), where U ⊥ is a trivially satisfiable LCCCS instance; otherwise check:

[0102] (a) For i∈[r], u i .x=hash(fvk,z i , U i ), where u i .x is u i Public input and output of

[0103]

[0104] (c) h = hash(fvk, z, U);

[0105] (3) If all the above checks pass, output 1, otherwise output 0.

[0106] To be more specific, the proof algorithm is Input the proof key pk=fpk, r messages from the previous node and the proof Local Message loc and the generated new message z, output a new proof Π, which incrementally proves the correctness of the local computation and all previous computations;

[0107] The proof algorithm includes five steps: analytical proof, multiple folding, hash compression, execution circuit, and output proof. The specific definitions are as follows:

[0108] Step 1. Analytical proof: For i∈[r], replace Π i Parsed as (U i , W i ), (u i , w i ), where (U i , W i ) is a satisfiable LCCCS instance witness pair, (u i , w i ) is a satisfiable CCCS instance witness pair.

[0109] Step 2: Multiple folds: If for any i∈[r], there is z i =⊥, then let (U, W, π): =(U ⊥ , W ⊥ , ⊥), where (U ⊥ , W ⊥ ) is a trivially satisfiable LCCCS instance witness pair; otherwise, compute:

[0110]

[0111] Step 3, hash compression: calculate h←hash(fvk, z, U).

[0112] Step 4: Execute the circuit: The trace algorithm augments the circuit The execution result of is expressed as a satisfiable CCCS instance witness pair.

[0113] Step 5. Output proof: Output Π: =((U, W), (u, w)).

[0114] More specifically, the verification algorithm is 0 / 1←PCD.V(vk, z, Π), which inputs the verification key vk=fvk, the message z and the proof Π, and outputs the verification result;

[0115] The parsing proof, verification hash, verification instance witness pair, and output verification in the verification algorithm are specifically defined as follows:

[0116] Step 6, analytical proof: Parse Π as ((U, W), (u, w)).

[0117] Step 7, verify the hash: check whether ux=hash(fvk, z, U) holds.

[0118] Step 8. Verify the instance witness pair: Check that W is a LCCCS witness that satisfies U and w is a CCCS witness that satisfies u.

[0119] Step 9: Output verification result: If all the above checks are true, output 1; otherwise, output 0.

[0120] Specifically, the prover's local calculation, hash operation, all operations except the group operation in the multiple folding scheme verification algorithm, and the verification algorithm called multiple times by the folding scheme are executed through the main circuit; the group operation in the multiple folding scheme verification algorithm is executed through the secondary circuit.

[0121] Through the high-performance incremental verifiable computing method suitable for blockchain expansion in the present invention, the instance witness pairs in the folding proof of the multiple folding scheme are used, the augmented circuit is expressed using a customizable constraint system, and the implementation architecture of the main circuit plus the secondary circuit is used, and its advantages and effects are: 1) It has a low recursive overhead. The recursive operation of the scheme of the present invention is mainly the verification algorithm of the multiple folding scheme, which only contains about 2r-1 group power operations, which greatly reduces the recursive overhead of the existing scheme; 2) Support high-order constraints. The scheme of the present invention expresses the execution of the augmented circuit as an instance witness pair of a customizable constraint system, which can flexibly express constraints of any order and greatly reduce the circuit scale; 3) It has high actual performance. The scheme of the present invention avoids the domain simulation operation in the circuit by dividing the main circuit and the secondary circuit, and avoids the problem of circuit scale expansion. Therefore, the implementation architecture of the present invention can fully release the performance of the PCD scheme and enable it to be efficiently applied to more complex scenarios.

[0122] like Figure 2 As shown, in order to realize the PCD solution, it is necessary to realize the augmentation circuit Since the verification algorithm includes local computation and multiple folding schemes, direct trivial implementation will bring some performance issues. Specifically, given a prime-order elliptic curve cyclic group G defined on field F2, according to the properties of cyclic groups, the order of G can induce another field F1, and the order of F1 is different from that of F2. F1 is called the scalar field of group G, and F2 is called the base field of group G. Assuming that the local computation is defined on field F1 (the same is true for field F2), since the multiple folding scheme requires commitment to the elements in the field where the circuit is located and the commitment scheme used is based on the elliptic curve group, the verifier's operation is mainly group operation, and each element in the group is defined on field F2, so the verification algorithm should be defined on field F2. If the local computation and verification algorithm are treated as a whole for proof, it is necessary to use one field to simulate the operation of another field, which will greatly expand the circuit scale and bring huge additional overhead.

[0123] In order to solve this problem, the present invention proposes an implementation architecture based on a cycle of elliptic curves. The cycle contains two elliptic curve groups, where the base domain of one group is the scalar domain of the other group, and the scalar domain of the group is the base domain of the other group. In order to utilize the properties of the elliptic curve cycle to avoid domain simulation operations in the circuit, the present invention designs the following circuit implementation architecture.

[0124] Let (E1, E2) denote an elliptic curve cycle, and use superscripts 1 and 2 to denote the elements defined on (E1, E2). The implementation architecture of the present invention includes two circuits, a main circuit and a secondary circuit, which are defined on the scalar domain of (E1, E2). The main circuit performs local calculations, hash operations, and part of the operations of the multi-folding scheme verification algorithm. In particular, the group operations in the multi-folding scheme verification algorithm It is defined on the base domain of E1, which is different from the domain of the main circuit. In order to avoid domain simulation, the present invention uses a subcircuit to express this group operation. Since the subcircuit is defined on the scalar domain of E2 and by the property of the elliptic curve cycle, the scalar domain of E2 is exactly the base domain of E1, so the subcircuit does not need domain simulation. In order to prove that the subcircuit correctly expresses the corresponding group operation, the present invention expresses the execution result of the subcircuit as a satisfiable CRR1CS instance witness pair (u′ (2) , w′ (2) ). At this time, for i∈[r], each message z i Carrying proof i for in is the LCCCS instance witness pair defined on E1, It is the CCCS instance witness pair defined on E1. It is a CRR1CS instance witness pair defined on E2. In order to incrementally prove the correctness of the calculation of the secondary circuit, the present invention makes the main circuit call the verification algorithm of the folding scheme multiple times to fold the multiple CRR1CS instance witness pairs in the proof and the CRR1CS instance witness pairs expressing the secondary circuit into one as part of the new proof.

[0125] Specifically, the main circuit and sub-circuit of the architecture of the present invention are defined as follows:

[0126] Main circuit:

[0127] (1) Check the predicate Is it satisfyable?

[0128] (2) Perform a hash check;

[0129] (3) Execute multiple folding scheme verification algorithm All operations except group operations;

[0130] (4) Execute the verification algorithm of multiple calls to the folding scheme:

[0131]

[0132] Secondary Circuit:

[0133] Perform group operations

[0134] The technical solution of the present invention also provides a zero-knowledge virtual machine, which implements the above-mentioned high-performance incremental verifiable computing method suitable for blockchain expansion by executing coding instructions, constructing augmented circuits, calling proof algorithms, and calling verification algorithms.

[0135] 1) Encoding instructions: Parse each instruction of the virtual machine into a low-level circuit representation.

[0136] This step maps logical operations to underlying polynomial or Boolean constraints. Arithmetic operations are converted to polynomial operation constraints, while conditional jump operations are decomposed into Boolean constraints and selector logic.

[0137] 2) Construct an augmented circuit: On the basic instruction circuit, further add sub-circuits related to recursive calls to support the generation of recursive proofs.

[0138] The constructed augmented circuit generates a complete instruction set expression by integrating the execution paths of each instruction, forming a recursive link with constraint consistency, and expresses the execution of the augmented circuit as an instance witness pair of CCCS.

[0139] 3) Call the proof algorithm: Based on the constructed augmented circuit, call the proof algorithm PCD.P to generate a recursive proof.

[0140] Each proof verifies the execution result of the current instruction and includes the proof verification of the previous state. The proof not only covers the current state, but also ensures the integrity of the execution path.

[0141] 4) Call the verification algorithm: After executing the proof generation of each stage, verify its validity through the verification algorithm PCD.V.

[0142] After verification, the legitimacy of the virtual machine state is ensured, and the result is used for subsequent state updates or recursive operations.

[0143] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by general-purpose computer devices, they can be concentrated on a single computer device, or distributed on a network composed of multiple computer devices, and optionally, they can be implemented by executable program codes of computer devices, so that they can be stored in a storage device and executed by the computer device, and in some cases, the steps shown or described can be executed in a different order from that here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0144] It should be noted that the above are only preferred embodiments of the present invention, and the patent protection scope of the present invention is not limited thereto. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A high-performance incremental verifiable computing method suitable for blockchain expansion, characterized in that: include: The prover and the verifier jointly define an augmented circuit to express the computation to be proved and the recursive operations required to achieve incremental verifiability; The augmented circuit is used to: perform the prover's local computation, i.e., the proof algorithm, and perform recursive operations, including hash operations and the verification algorithm of the multi-folding scheme; The proof algorithm includes the following steps 1-5: Step 1: Parse the proof: parse the input proof into several instance witness pairs; Step 2, multi-folding: call the proof algorithm of the multi-folding scheme to fold multiple instance witness pairs into one; Step 3, hash compression: use the hash function to compress the output of the augmented circuit; Step 4, execute the circuit: execute the augmented circuit according to all the data obtained in the previous steps, and express the result as an instance witness pair of the customizable constraint system; Step 5: Output proof: Output the instance witness pair obtained by multiple folding and the instance witness pair obtained by executing the circuit; The verification algorithm includes the following steps 6-9: Step 6: Parse the proof: Parse the input proof into two instance witness pairs; Step 7: Verify the hash: verify the hash relationship that the instance witness should satisfy; Step 8: Verify the instance witness pair: verify whether the instance witness pair is satisfied according to the definition of the corresponding relationship; Step 9: Output verification results: Output verification results according to the checks in steps 7 and 8 above.

2. The high-performance incremental verifiable computing method according to claim 1, characterized in that: The augmented circuit is represented as Mainly performs the prover's local operations and recursive operations, and locally calculates the message of the input previous node and the prover's local message z loc , output a new message z, using the predicate Indicates the satisfiability of computation, and the recursive operations mainly include hash operations and verification algorithms of multiple folding schemes; The specific definition is as follows: (1) Check the predicate Is it satisfyable? (2) If for all i∈[r], there is z i =⊥, then check h = hash(fvk, z, U ⊥ ), where U ⊥ is a trivially satisfiable LCCCS instance; Otherwise check: (a) For i∈[r], u i .x=hash(fvk,z i , U i ), where u i .x is u i Public input and output of (b) (c) h = hash(fvk, z, U); (3) If all the above checks pass, output 1, otherwise output 0.

3. The high-performance incremental verifiable computing method according to claim 1, characterized in that: The proof algorithm is Input the proof key pk=fpk, r messages from the previous node and the proof Local Message loc and the generated new message z, output a new proof Ώ, which incrementally proves the correctness of the local computation and all previous computations; The proof algorithm includes five steps: analytical proof, multiple folding, hash compression, execution circuit, and output proof. The specific definitions are as follows: Step 1. Analytical proof: For i∈[r], replace ∏ i Parsed as (U i , W i )(u i , w i ), where (U i , W i ) is a satisfiable LCCCS instance witness pair, (u i , w i ) is a satisfiable CCCS instance witness pair. Step 2: Multiple folds: If for any i∈[r], there is z i =⊥, then let (U, W, π): =(U ⊥ , W ⊥ , ⊥), where (U ⊥ , W ⊥ ) is a trivially satisfiable LCCCS instance witness pair; otherwise, compute: Step 3, hash compression: calculate h←hash(fvk, z, U). Step 4: Execute the circuit: The trace algorithm augments the circuit The execution result of is expressed as a satisfiable CCCS instance witness pair. Step 5. Output proof: Output Π: =((U, W), (u, w)).

4. The high-performance incremental verifiable computing method according to claim 1, characterized in that: The verification algorithm is 0 / 1←PCD.V(vk, z, Π), inputs the verification key vk=fvk, the message z and the proof Π, and outputs the verification result; The specific definitions of the parsing proof, verification hash, verification instance witness pair, and output verification in the verification algorithm are as follows: Step 6, analytical proof: Parse Π as ((U, W), (u, w)). Step 7, verify the hash: check whether ux=hash(fvk, z, U) holds. Step 8. Verify the instance witness pair: Check that W is a LCCCS witness that satisfies U and w is a CCCS witness that satisfies u. Step 9: Output verification result: If all the above checks are true, output 1; otherwise, output 0.

5. The high-performance incremental verifiable computing method according to claim 1, characterized in that: Perform local computation of the prover, hash operations, all operations except group operations in the verification algorithm of the multiple folding schemes, and the verification algorithm of multiple calls of the folding schemes through the main circuit; The group operations in the multi-folding scheme verification algorithm are performed through subcircuits.

6. A zero-knowledge virtual machine, which implements the high-performance incremental verifiable computing method described in any one of claims 1 to 5 by executing encoding instructions, constructing augmented circuits, calling a proof algorithm, and calling a verification algorithm; Encoding instructions: Parse each instruction of the virtual machine into a low-level circuit representation; Construct augmented circuit: On the basic instruction circuit, further add recursive call related subcircuits to support the generation of recursive proofs; Call the proof algorithm: Based on the constructed augmented circuit, call the proof algorithm to generate a recursive proof; Call verification algorithm: After executing the proof generation of each stage, verify its validity through the verification algorithm.

Images