Circuit program execution track generation method based on ZKWASM

Abstract

A circuit program execution track generation method based on ZKWASM comprises the steps that a circuit program to be processed is compiled into a WASM format, that is, a corresponding WASM circuit byte code is obtained, and after an execution track is extracted from the WASM circuit byte code, the execution track is divided into a plurality of short execution tracks according to the number of instructions, function calling, control flow and / or memory access; multiple Miller cycles are utilized to merge paired elliptic curve input points generated by the split short execution trajectories, that is to say, for the proof generation process of each short execution trajectory, the Miller cycles involved in pairing calculation are merged into a large Miller cycle. According to the method, on the basis of multi-Miller circulation, a zero-knowledge virtual machine calculation protocol of a long execution track and a plurality of calculation examples is improved, calculation result verification for avoiding repeated calculation and supporting batch verification is supported, and the operation efficiency of an existing privacy calculation scheme based on ZKWASM can be improved under the condition that user data privacy is guaranteed.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, and specifically to a circuit program execution trajectory generation method based on ZKWASM. Background Art

[0002] ZKWASM is a WASM virtual machine based on ZKSNARK circuits, which allows developers to directly run existing network assembly language WASM applications without modifying the code. At the same time, it uses ZKSNARK technology to ensure the fairness and privacy protection of calculation results. However, the existing ZKWASM virtual machine often causes large repeated calculations and memory overhead when executing multiple WASM instances or processing calculations with long execution traces. Summary of the invention

[0003] In view of the shortcomings of the existing ZKWASM technology, such as its insufficient ability to handle large-scale computing, its inability to fully utilize the parallel capabilities of modern processors, and its unavailability on machines with small memory, this invention proposes a circuit program execution trace generation method based on ZKWASM. Based on multiple Miller cycles, this method improves the zero-knowledge virtual machine computing protocol for long execution traces and multiple computing instances, supports avoiding repeated calculations, and supports batch verification of computing results. It can improve the operating efficiency of the existing privacy computing scheme based on ZKWASM while ensuring the privacy of user data.

[0004] The present invention is achieved through the following technical solutions:

[0005] The present invention relates to a circuit program execution trajectory generation method based on ZKWASM, comprising:

[0006] Step 1) compile the circuit program to be processed into WASM format, that is, obtain the corresponding WASM circuit bytecode;

[0007] Step 2) Extract the execution trace from the WASM circuit bytecode, including:

[0008] 2.1 Initialize the state of the WebAssembly virtual machine, including setting the code segment (WASM code), initial content, entry function, stack, and global variables.

[0009] 2.2 Use static analysis tools to obtain WebAssembly code information, and use the WASMinterp interpreter to execute the WASM circuit bytecode one by one and record the instruction address, instruction opcode, stack operation, memory operation, global variable operation and call frame operation.

[0010] 2.3 After each instruction is executed, record the transition from the current state to the next state: the state transition function is si+1 =t i (s i ), where: i is the current state, s i+1 is the next state, t i is the state transition function, describing the transition from s i to i+1 changes.

[0011] 2.4. Combine all state transfer functions in order to generate a complete execution trace: [t0, t1, t2, ..., t n ]

[0012] Step 3) Splitting the execution trace obtained in step 2 into multiple short execution traces according to the number of instructions, function calls, control flows and / or memory accesses, specifically including:

[0013] The segmentation by the number of instructions refers to segmenting the long execution trace into multiple short execution traces by the number of instructions. For example, when the long execution trace contains 1000 instructions, it can be segmented into 10 short execution traces, each of which contains 100 instructions.

[0014] The segmentation by function call means that when the execution trace contains multiple function calls, the execution trace can be segmented by function call boundaries. For example, the execution trace of each function can be used as a short execution trace.

[0015] The control flow segmentation means that when the execution trace contains complex control flows (such as loops, conditional branches, etc.), it can be segmented according to the control flow boundaries. For example, the execution trace of each loop can be used as a short execution trace.

[0016] The segmentation by memory access means that when the execution trace contains a large number of memory access operations, the execution trace can be segmented by the memory access boundary. For example, the access trace of each memory block can be used as a short execution trace.

[0017] The segmentation preferably adopts a hybrid segmentation strategy, which specifically includes:

[0018] 3.1.1 Preliminarily split the execution trace into multiple short execution traces according to the function call boundary.

[0019] 3.1.2 When the length of the short execution trace after segmentation in step 3.1.1 exceeds the set threshold, it will be further segmented according to the control flow boundary.

[0020] 3.1.3 Count the memory access operations in the control flow blocks in step 3.1.2. When there are many memory access operations in any short execution trace, further segment them according to the boundaries of memory access.

[0021] Step 4) Use multiple Miller loops to merge the pairing elliptic curve input points generated by the short execution traces split in step 3. That is, for the proof generation process of each short execution trace, merge the Miller loops of the pairing calculations involved into a large Miller loop, specifically including:

[0022] 4.1 Collect the paired elliptic curve input point pairs of all short execution traces in step 3) {(P1, Q2), {P2, Q2}, ..., (P n , Q n )}, pre-calculate line coefficients (In online pairing calculations, line coefficients are used to represent the slope and intercept (λ, μ) of a straight line passing through two points T and Q. In ZKWASM, the KZG polynomial commitment scheme is used, so the second pairing parameter Q is fixed, and the line coefficients of Q can be pre-calculated and stored. In this way, in actual pairing calculations, the pre-calculated line coefficients can be used directly without recalculation).

[0001] 4.2 Construct the initial state of the multi-Miller loop: initialize an empty accumulator f = 1; initialize an empty point list T = [Q1, Q2, ..., Q n ]. The square accumulator is a value, specifically, an intermediate result that is accumulated step by step in the Miller loop. This value is squared in each step of the loop. The array T is used to store each non-fixed point Q j The current state of the accumulator is calculated and updated correctly at each step.

[0023] 4.3 Perform Miller cycle calculation, including:

[0024] For step i of the Miller cycle (i from L-2 to 0), you need (where L is the number of bits used to represent the binary representation of the Miller cycle, and the value of L is determined by the order of the elliptic curve.):

[0025] 4.3.1: Update the value of the square accumulator, i.e. f←f 2 The square accumulator f is a value defined in 4.2. It is an intermediate result accumulated step by step in the Miller loop, and this value is squared in each step of the loop.

[0026] 4.3.2: Calculate the evaluation line: For each point pair (P j , Q j), using precomputed line coefficients To evaluate l in P j The value at , and multiply it into the accumulator. The point T is a dynamically changing point that is updated at each step in the Miller loop, f is the intermediate result square accumulator, and the line evaluation function It is to construct a straight line through T and Q and evaluate the value of this line at point P.

[0027] 4.3.3: When point Q is non-fixed, the state of point T needs to be updated according to the current line l.

[0028] 4.3.4: When the current S i The value of is not 0, then according to S i The value of s is used to update the state of the accumulator f and point T. Where: the value of s is determined by the order of the elliptic curve, and s is converted to binary representation (length L), S i The number of binary digits.

[0029] 4.4 Perform the final line evaluation: After the Miller loop is completed, the final line evaluation is performed and the result is multiplied into the accumulator f. For each point pair (P j , Q j ), perform the final line evaluation, and update the state of point T.

[0030] 4.5 Verification result: Verify whether the accumulator f is equal to 1 after multiple cycles, that is, When it is equal to 1, the verification is passed, otherwise the verification fails. Where: e is the pairing function, which is used to pair two points P on the elliptic curve i ∈G1,Q i ∈G2 (G1, G2 are two elliptic curve groups) is mapped to a value on a target domain, This is the final result of multiple Miller cycles.

[0031] The present invention relates to a system for implementing the above method, comprising: a WASM circuit bytecode generation unit, an execution trace acquisition unit, an execution trace segmentation unit and a merging verification unit, wherein: the WASM circuit bytecode generation unit outputs corresponding WASM circuit bytecodes according to an input program to be processed by a WASM compilation tool; the execution trace acquisition unit obtains the execution trace of the WASM circuit bytecode through static analysis and dynamic execution analysis according to the WASM circuit bytecode; the execution trace segmentation unit segments the execution trace using a segmentation strategy, outputs multiple short execution traces, and calculates the corresponding elliptic curve pairing point for each short execution trace; the merging verification unit pre-calculates the line coefficients in the KZG commitment scheme according to the elliptic curve pairing points, performs multiple Miller cycles on the input points for pairing calculation, and finally verifies whether the calculation result passes. Technical Effects

[0032] The present invention uses a hybrid segmentation strategy to split a long execution trace into multiple short execution traces and generate proofs separately, making full use of the parallel processing capabilities of modern computers. In addition, due to the reduced hardware requirements, the method also shows good compatibility with small memory devices. By optimizing multiple Miller loops, multiple paired Miller loops are merged into a large Miller loop so that the calculation results can be shared, thereby reducing repeated calculations and significantly improving the efficiency of proof generation and verification. Compared with the prior art, the present invention can make full use of the parallel processing capabilities of modern computers, speed up the speed of proof generation, reduce the storage requirements of intermediate results, repeated calculations and storage of intermediate results, a large number of multiplication operations and square operations, and verification processes, and significantly reduce the verification complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1(a)-Figure 1(c) It is a flow chart of the present invention, wherein:

[0034] FIG1(a) illustrates compiling a circuit program implemented in a high-level language into WASM circuit bytecode, and obtaining the execution trace of the circuit program through the WASM circuit bytecode.

[0035] Figure 1(b) illustrates the process of generating short execution traces by segmenting the generated long execution traces using a hybrid segmentation strategy.

[0036] Figure 1(c) shows the generated short execution traces. Using the proof generation method in zero-knowledge proof, each short execution trace outputs a paired elliptic curve point pair, and finally outputs a set of paired point pairs. Based on the input paired point pair set, multiple Miller cycles are used for fast verification and the verification results are output.

[0037] Figure 2Flowchart of the segmentation strategy for short execution trajectories;

[0038] Figure 3 Schematic diagram of the implementation scenario. DETAILED DESCRIPTION

[0039] like Figure 1(a)-Figure 1(c) As shown, this embodiment relates to a circuit program execution trajectory generation method based on ZKWASM, combined with Figure 3 The implementation scenario is shown below:

[0040] There are three roles in this scenario: user, prover / computing service provider, and verifier / service provider. The user has his own private data, the prover / computing service provider can provide proof for the user's private data, and the verifier has verification capabilities and can decide whether to provide services to the user based on the verification results.

[0041] Step 1, as shown in Figure 1(a), before the user sends the encrypted data, the prover has implemented the calculation logic in a high-level programming language such as (Rust, C++, etc.), and converted it into a zero-knowledge circuit form, and compiled it into a WASM circuit bytecode file through the corresponding WASM compiler.

[0042] Step 2. In step 1, the bytecode file of the WASM circuit is obtained and analyzed using the tools in the WebAssembly BinaryTool Kit, including WASM-interp, WASM-objdump, and WASM2wat. First, WASM2wat is used to convert the WASM file into WAT (WebAssembly text format) to extract WASM's instruction address, stack status and other meta-information. Next, the stack-based dynamic interpreter WASM-interp is used to dynamically decode WASM, and combined with the meta-information obtained from WAT, its final execution trajectory is obtained.

[0043] Step 3. As shown in Figure 1(b), in step 2, the complete execution trace of each WASM circuit instance is obtained. According to the established strategy, it is first necessary to check the number of instructions for each complete execution trace. When the number of instructions in the trace is lower than the set threshold, there is no need to continue splitting; otherwise, a preliminary split is required based on the function call boundary. When the split execution trace is still higher than the set threshold at this time, it is necessary to further split it according to the execution flow characteristics (such as loops, conditional judgments, switches, etc.). On this basis, each shorter execution trace is statically analyzed to identify execution points containing a large number of memory access operations and further split them. Finally, several relatively uniform short execution traces are extracted from each longer execution trace. In order to avoid subsequent repeated calculations, it is necessary to perform pre-calculation in advance to calculate the line coefficients of the fixed points.

[0044] Step 4, as shown in Figure 1(c), at this point the computing service provider's preparation service has been completed. The user sends the homomorphically encrypted data to the computing service provider. The computing service provider generates a corresponding proof (i.e., a pair of points on the elliptic curve) for each short execution trace based on the encrypted data provided by the user.

[0045] Step 5: After receiving the proof and result, the verifier verifies the proof result provided by the computing server by using the multi-Miller cycle method. If the verification is successful, the service is provided to the user.

[0046] After a small sample experiment, each paired Miller cycle requires 1 square operation and 2 linear operations per step, and there are a total of 10 pairs that need to be calculated. The verification performance is improved by about 43% and the memory consumption is reduced by 60%.

[0047] Compared with the prior art, the present invention fully utilizes the parallelism of modern computers in the step of generating proof on the computing server side, splits the execution track of the computing logic, and can generate zero-knowledge proof more quickly. In the step of generating proof on the computing server side, pre-calculation is performed to avoid repeated calculations, thereby speeding up the subsequent verification speed. In the verifier verification step, multiple Miller cycles are used to reduce the amount of calculation while reducing memory consumption, thereby speeding up the verification speed.

[0048] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. A circuit program execution trajectory generation method based on ZKWASM, characterized in that: include: Step 1) compile the circuit program to be processed into WASM format, that is, obtain the corresponding WASM circuit bytecode; Step 2) extract the execution trace from the WASM circuit bytecode; Step 3) splitting the execution trace obtained in step 2 into multiple short execution traces according to the number of instructions, function calls, control flows and / or memory accesses; Step 4) Use multiple Miller loops to merge the pairing elliptic curve input points generated by the short execution traces split in step 3, that is, for the proof generation process of each short execution trace, merge the Miller loops of the pairing calculations involved into a large Miller loop.

2. The circuit program execution trace generation method based on ZKWASM according to claim 1, characterized in that: The step 2 specifically includes: 2.1 Initialize the state of the WebAssembly virtual machine: set the code segment (WASM code), initial content, entry function, stack, and global variables; 2.2 Use static analysis tools to obtain WebAssembly code information, and use the WASMinterp interpreter to execute the WASM circuit bytecode line by line and record the instruction address, instruction opcode, stack operation, memory operation, global variable operation, and call frame operation; 2.3 After each instruction is executed, record the transition from the current state to the next state: the state transition function is s i+1 =t i (s i ), where: i is the current state, s i+1 is the next state, t i is the state transition function, describing the transition from s i to i+1 changes; 2.

4. Combine all state transfer functions in order to generate a complete execution trace: [t0, t1, t2, ..., t n ].

3. The circuit program execution trajectory generation method based on ZKWASM according to claim 1 is characterized in that the segmentation adopts a hybrid segmentation strategy, specifically including: 3.1.1 Preliminarily split the execution trace into multiple short execution traces according to the function call boundary; 3.1.2 When the length of the short execution trace after segmentation in step 3.1.1 exceeds the set threshold, it will be further segmented according to the control flow boundary; 3.1.3 Count the memory access operations in the control flow blocks in step 3.1.

2. When there are many memory access operations in any short execution trace, further segment them according to the boundaries of memory access.

4. The circuit program execution trajectory generation method based on ZKWASM according to claim 1 or 3, characterized in that: The segmentation according to the number of instructions refers to segmenting a long execution trace into multiple short execution traces according to the number of instructions.

5. The circuit program execution trajectory generation method based on ZKWASM according to claim 1 or 3, characterized in that: The segmentation by function call means that when the execution trace contains multiple function calls, segmentation is performed according to the function call boundary.

6. The circuit program execution trajectory generation method based on ZKWASM according to claim 1 or 3, characterized in that: The segmentation by control flow means that when the execution trace contains a complex control flow, segmentation is performed according to the control flow boundary.

7. The circuit program execution trajectory generation method based on ZKWASM according to claim 1 or 3, characterized in that: The segmentation by memory access means that when the execution trace contains a large number of memory access operations, segmentation is performed according to the boundaries of memory access, for example, the access trace of each memory block is regarded as a short execution trace.

8. The circuit program execution trace generation method based on ZKWASM according to claim 1, characterized in that: The step 4 specifically includes: 4.1 Collect the paired elliptic curve input point pairs of all short execution traces in step 3) {(P1, Q2), {P2, Q2}, ..., (P n , Q n )}, pre-calculate line coefficients 4.2 Construct the initial state of the multi-Miller loop: initialize an empty square accumulator f = 1; initialize an empty point list T = [Q1, Q2, ..., Q n ], where square accumulation is the intermediate result accumulated step by step in the Miller loop. This value will be squared in each step of the loop. Array T is used to store each non-fixed point Q j The current status of 4.3 Perform Miller cycle calculation; 4.4 Perform the final line evaluation: After the Miller loop is finished, multiply the result into the accumulator f, for each point pair (P j , Q j ), perform the final line evaluation and update the state of point T; 4.5 Verification result: Verify whether the accumulator f is equal to 1 after multiple cycles, that is, When it is equal to 1, the verification is passed, otherwise the verification fails, where: e is the pairing function used to pair two points P on the elliptic curve i ∈G1,Q i ∈G2 is mapped to a value on a target domain, G1, G2 are two elliptic curve groups, This is the final result of multiple Miller cycles.

9. The circuit program execution trace generation method based on ZKWASM according to claim 8, characterized in that: The Miller cycle calculation, step i specifically includes the following steps, i from L-2 to 0, L is the number of bits representing the binary representation of the Miller cycle, which is determined by the order of the elliptic curve: 4.3.1: Update the value of the square accumulator, i.e. f←f 2 ; 4.3.2: Calculate the evaluation line: For each point pair (P j , Q j ), using precomputed line coefficients To evaluate I in P j The value at , and multiply it into the accumulator, that is, The point T is a dynamically changing point that is updated at each step in the Miller loop, f is the intermediate result square accumulator, and the line evaluation function It constructs a straight line through T and Q and evaluates the value of this line at point P; 4.3.3: When point Q is not fixed, the state of point T needs to be updated according to the current line l; 4.3.4: When the current s i If the value is not 0, then according to s i The value of s is used to update the state of the accumulator f and the point T, where: the value of s is determined by the order of the elliptic curve, and s is converted into a binary representation of length L, s i The number of binary digits.

10. A circuit program execution trace generation system based on ZKWASM for implementing any of the methods described in claims 1-9, characterized in that: include: WASM circuit bytecode generation unit, execution trace acquisition unit, execution trace segmentation unit and merge verification unit, wherein: the WASM circuit bytecode generation unit outputs the corresponding WASM circuit bytecode according to the input program to be processed by the WASM compilation tool; The execution trace acquisition unit obtains the execution trace of the WASM circuit bytecode through static analysis and dynamic execution analysis based on the WASM circuit bytecode; the execution trace segmentation unit segments the execution trace using a segmentation strategy, outputs multiple short execution traces, and calculates the corresponding elliptic curve pairing point for each short execution trace; the merge verification unit pre-calculates the line coefficients in the KZG commitment scheme based on the elliptic curve pairing points, performs multiple Miller cycles on the input points for pairing calculations, and finally verifies whether the calculation results pass.

Images