Zero-knowledge proof method and device among multiple parties

Abstract

The embodiment of the invention provides a zero-knowledge proof method and device among multiple parties. Wherein the certifier has the first privacy data. The prover determines a first task to be subjected to zero-knowledge certification, the first task being used for certifying the first privacy data to the verifier through a first equation relationship. Wherein the first public data and the first private data contained in the first equation relation belong to an integer ring, and the data in the integer ring does not meet the requirements of the polynomial interpolation method. Thirdly, the prover maps data contained in the first equation relation to a Galois ring obtained based on an integer ring, and a second equation relation is obtained; the data in the Galois ring can meet the requirements of the polynomial interpolation method. And the prover adopts the polynomial interpolation method to execute zero-knowledge proof based on the second equation relationship, and sends the proof to the verifier. And the verifier receives the certification sent by the certifier and determines a certification result based on the certification. The proof result is used for determining a proof result for the first task.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of encryption technology, and in particular to a zero-knowledge proof method and apparatus among multiple parties. Background Art

[0002] Zero-Knowledge Proof is a cryptographic protocol that allows a Prover to prove the truth of a statement to a Verifier without revealing any additional information about the content of the statement. The Verifier cannot obtain any information other than the truth of the statement from the proof process. If the statement is true, an honest Prover can always convince the Verifier; if the statement is false, no Prover can deceive the Verifier. When constructing a zero-knowledge proof, complex computational problems can be decomposed into simple constraints, and zero-knowledge proof of the statement can be achieved based on these constraints. Currently, existing zero-knowledge proof schemes for constraints cannot be implemented in some fields.

[0003] Therefore, it is hoped that there can be an improved scheme that can solve the problem that zero-knowledge proof based on constraints cannot be implemented in some fields. Summary of the Invention

[0004] One or more embodiments of this specification describe a zero-knowledge proof method and apparatus among multiple parties to solve the problem that zero-knowledge proof based on constraints cannot be implemented in some fields and improve the generalization of zero-knowledge proof. The specific technical solutions are as follows.

[0005] In a first aspect, an embodiment provides a zero-knowledge proof method among multiple parties, which is executed by a Prover and a Verifier, and the Prover has first private data; the method includes:

[0006] The Prover determines a first task to be subjected to zero-knowledge proof, and the first task is used to prove the first private data to the Verifier through a first equality relationship; wherein, several first public data and the first private data included in the first equality relationship belong to an integer ring, and the data in the integer ring does not meet the requirements of the polynomial interpolation method;

[0007] The Prover maps the data included in the first equality relationship to a Galois ring obtained based on the integer ring, and obtains a second equality relationship; the data in the Galois ring can meet the requirements of the above polynomial interpolation method;

[0008] The Prover uses the above polynomial interpolation method to perform zero-knowledge proof based on the second equality relationship and sends the proof to the Verifier;

[0009] The verifier receives the proof sent by the prover, determines a proof result based on the proof, and the proof result is used to determine the proof result for the first task.

[0010] In a second aspect, an embodiment provides a zero-knowledge proof method among multiple parties, which is executed by a prover who has first private data; the method includes:

[0011] Determine a first task for which zero-knowledge proof is to be performed, and the first task is used to prove the first private data to the verifier through a first equation relationship; wherein, a number of first public data included in the first equation relationship and the first private data belong to an integer ring, and the data in the integer ring does not meet the requirements of the polynomial interpolation method;

[0012] Map the data included in the first equation relationship to a Galois ring obtained based on the integer ring to obtain a second equation relationship; the data in the Galois ring can meet the requirements of the above polynomial interpolation method;

[0013] Adopt the above polynomial interpolation method to perform zero-knowledge proof based on the second equation relationship and send the proof to the verifier; wherein, the proof result obtained based on the second equation relationship is used to determine the proof result for the first task.

[0014] In one implementation, the step of obtaining the second equation relationship includes:

[0015] Map the data included in the first equation relationship to the Galois ring to obtain an intermediate equation relationship;

[0016] Add a first constraint term to the intermediate equation relationship, and the value of the first constraint term is selected from the data included in the kernel set; the data in the kernel set belongs to the Galois ring, and when the data in the kernel set is mapped to the integer ring, it is 0;

[0017] The method further includes: using the method of zero-knowledge proof to prove to the verifier that the value of the first constraint term comes from the kernel set.

[0018] In one implementation, the step of proving to the verifier that the value of the first constraint term comes from the kernel set includes:

[0019] Generate a first random number, and send the first product result of the first random number and the value of the first constraint term to the verifier, so that the verifier proves that the value of the first constraint term comes from the kernel set based on the first product result.

[0020] In one implementation, the first private data is a vector of the first dimension. The step of mapping the data included in the first equation relationship to the Galois ring includes: mapping the first private data to the Galois ring to obtain second private data;

[0021] The method further includes: using a zero-knowledge proof method to prove to the verifier that the vector dimension of the second private data is the first dimension.

[0022] In one implementation, the step of proving to the verifier that the vector dimension of the second private data is the first dimension includes:

[0023] Generating a second random number and sending the second product result of the second random number and the second private data to the verifier, so that the verifier verifies that the vector dimension of the second private data is the dimension corresponding to the first dimension based on the second product result.

[0024] In one implementation, the step of mapping the first private data to the Galois ring includes:

[0025] Using a multiplication-friendly embedding algorithm to map the first private data to the Galois ring.

[0026] In one implementation, the polynomial interpolation method includes the Lagrange interpolation method.

[0027] In a third aspect, an embodiment provides a zero-knowledge proof device among multiple parties, deployed in a prover, and the prover has first private data; the device includes:

[0028] A task determination module, configured to determine a first task to be subjected to zero-knowledge proof, where the first task is used to prove the first private data to a verifier through a first equation relationship; wherein, several first public data and the first private data included in the first equation relationship belong to the integer ring, and the data in the integer ring does not meet the requirements of the polynomial interpolation method;

[0029] A data mapping module, configured to map the data included in the first equation relationship to a Galois ring obtained based on the integer ring to obtain a second equation relationship; the data in the Galois ring can meet the requirements of the polynomial interpolation method;

[0030] A zero-knowledge proof module, configured to perform zero-knowledge proof based on the second equation relationship by using the above polynomial interpolation method and send a proof to the verifier; wherein, the proof result obtained based on the second equation relationship is used to determine the proof result for the first task.

[0031] Fourthly, an embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed on a computer, the computer is made to execute the method described in any one of the first aspect and the second aspect.

[0032] Fifthly, an embodiment provides a computing device, including a memory and a processor. An executable code is stored in the memory. When the processor executes the executable code, the method described in any one of the first aspect and the second aspect is implemented.

[0033] In the method and device provided in the embodiments of this specification, the prover needs to prove to the verifier through zero-knowledge proof that the first private data held by the prover satisfies the first equality relationship. Since both the first private data and the first public data are data in the integer ring, and the data in the integer ring does not meet the requirements of the polynomial interpolation method and cannot use this polynomial interpolation method for zero-knowledge proof. The prover maps the data included in the first equality relationship to the corresponding Galois ring of the integer ring, obtaining a second equality relationship. The data in the Galois ring can meet the requirements of the polynomial interpolation method, and the polynomial interpolation method can be used to perform zero-knowledge proof to the verifier for the second equality relationship. And the proof result of the second equality relationship can be used to determine the proof result for the first task. Therefore, the embodiments of this specification can solve the problem that the polynomial interpolation method cannot be used for zero-knowledge proof due to the data in the integer ring not meeting the requirements, and improve the generalization of this zero-knowledge proof. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for description in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0035] Figure 1 It is a schematic diagram of an implementation scenario of an embodiment disclosed in this application;

[0036] Figure 2 It is a schematic flowchart of a zero-knowledge proof method among multiple parties provided by an embodiment;

[0037] Figure 3 It is a schematic diagram of an execution process of a zero-knowledge proof provided by an embodiment;

[0038] Figure 4 It is a schematic diagram of another execution process of a zero-knowledge proof provided by an embodiment;

[0039] Figure 5 It is a schematic diagram of a principle of a proof task conversion process provided by an embodiment;

[0040] Figure 6 Schematic block diagram of a zero - knowledge proof device among multiple parties provided for an embodiment. Detailed implementation manners

[0041] The following describes the solution provided in this specification in conjunction with the accompanying drawings.

[0042] Figure 1 Schematic diagram of an implementation scenario of an embodiment disclosed in this application. Among them, it includes a prover P and a verifier V. The prover P holds z containing private data and converts the proof in the integer ring into a proof in the Galois ring, that is, converts the data (including data z) in the integer ring used for zero - knowledge proof into data in the Galois ring. Perform zero - knowledge proof in the Galois ring and send the obtained proof to the verifier V. The verifier V verifies whether the prover P has z, but cannot obtain z from the proof and other data. The number of verifiers V can be one or more. Figure 1 The implementation scenario in

[0043] Both the prover P and the verifier V can perform the above - mentioned data processing operations through the computing devices owned by each party. The computing device can be implemented by any device, equipment, platform, device cluster, etc. with computing and processing capabilities.

[0044] The following combines Figure 1 The implementation scenario shown to explain the related technologies and some related concepts involved in this application.

[0045] As mentioned above, in the field of zero - knowledge proof, the prover (abbreviated as party P) needs to prove the truth of a certain statement z containing private data to the verifier (abbreviated as party V), but cannot send z in plaintext to the verifier. At this time, specific proof processes can be achieved through some constraints. For example, the Rank - 1 Constraint System (R1CS) is such a constraint. R1CS is a tool used to represent and process computational problems in zero - knowledge proof. Problems in many fields can be converted into R1CS constraints for zero - knowledge proof. R1CS constraints provide a standardized mathematical representation for zero - knowledge proof, enabling the prover P to generate proofs based on these constraints and thus prove to the verifier V. R1CS constraints make the construction of zero - knowledge proof more efficient and scalable by decomposing complex computational problems into simple constraints.

[0046] An R1CS instance contains three public matrices A, B, C and a secret vector z. The prover P can prove to the verifier V that the data it holds satisfies the following constraints:

[0047] Az * Bz = Cz (1)

[0048] Among them, A, B, and C are publicly known data known to both parties, and z is the private data owned by the prover P. This equation (1) relationship is called the R1CS constraint. * is element-wise multiplication. That is, taking the inner product of each row in matrices A, B, and C with vector z can respectively obtain the left input, right input, and output of a certain multiplication relationship. By constraining Az * Bz = Cz, the correctness of the entire calculation process can be constrained.

[0049] In some application fields, A, B, and C are generally public matrices, z(x, w) can be a vector, and z contains two parts, x and w, where w is the private data held by the prover P. For example, A, B, C, and z can be the following specific data respectively:

[0050]

[0051] When proving equation (1), when A, B, and C are matrices, A, B, and C can be split into multiple vectors; or A, B, and C themselves can also be vectors. Then, convert the vectors in equation (1) into polynomials, and prove equation (1) based on the polynomials. A vector contains multiple elements.

[0052] When converting a vector or a set of points into a polynomial, multiple polynomial conversion methods can be used. Among them, a commonly used method is the Lagrange interpolation method. The following takes the vector y = (y0, y1,..., y n-1 ) as an example to illustrate the specific conversion method. The Lagrange interpolation method uses the Lagrange interpolation formula to construct a polynomial P with a degree not exceeding n - 1 from the n data points in vector y, making it exactly pass through all the given points. The polynomial P is expressed as follows:

[0053]

[0054]

[0055] Among them, P(x) is the constructed Lagrange basis polynomial, and L i (x) is the basis polynomial defined for x i The abscissas x corresponding to the elements in vector y i take values from the finite field H.

[0056] Before performing zero-knowledge proof, generally first select the finite field H used for Lagrange interpolation, and then select its elements as x i . Assume that the finite field H is modulo (mod) p g, p is a prime number, g is a positive integer, and the finite field H contains a finite number of integer elements. This finite field H is x i The range of the value of is also the range of the elements in the vector y. Generally speaking, a sufficiently large finite field H is selected so that when performing the calculation of formula (1), all the calculation processes do not exceed the finite field H, that is, no overflow will occur and no modulo p will occur. g At the same time, in order to use formula (4) for Lagrange interpolation, it is necessary to have enough reversible elements in the finite field H to ensure that the denominator of formula (4) is not zero. This is the requirement of the polynomial interpolation method. That is, it is required that there are enough reversible elements in the finite field H to ensure that the selected x i It makes sense to calculate and modulo the formula (4), that is, to require the denominator x i -x k In the model g There exists a multiplicative inverse when x i -x k It is reversible.

[0057] Generally, the prime field Fp is used as the finite field H, where p is a prime number and g = 1. The prime field Fp is modulo p, where p also represents the number of elements in the field. For example, modulo 2 61 The prime number range of -1 contains 2 61 -1 integer element. Then, randomly select n elements from the elements 0 to p-1 contained in the prime field Fp as x i For example, 0 to n-1 are generally selected as n values of xi. Among them, p ≥ n. The x obtained by arbitrarily selecting n elements is i -x k There is a multiplicative inverse modulo p, which means it is reversible.

[0058] However, in practice, data types in computers are usually not defined on the prime field, but on mod 2. 32 (int) or mod 2 64 (long) integer ring, and the elements of the integer ring do not necessarily have inverses. For example, suppose the integer ring is mod 2 3 , that is, mod 8, when L i When (x) = 1 / 2, 1 / 2 mod 8 is meaningless, that is, the denominator 2 has no multiplicative inverse in the case of mod 8, and 2 is irreversible in this integer ring; and when L i When (x)=1 / 3, the result of 1 / 3 mod 8 is 3, which is meaningful. The denominator 3 has a multiplicative inverse when mod 8, and 3 is reversible in this integer ring.

[0059] That is to say, the data in A, B, C, and z for performing zero-knowledge proofs in a computer are defined on an integer ring, and there may not be enough invertible elements among the elements in this integer ring, that is, there are many non-invertible elements. This brings a problem of mismatch, resulting in the inability to apply the Lagrange interpolation method to perform zero-knowledge proofs based on R1CS constraints under the data types in a computer.

[0060] Of course, the polynomial transformation method does not only include the Lagrange interpolation method. There are other methods that may also require enough invertible elements in the domain.

[0061] To solve the problem that the polynomial transformation method cannot be used for zero-knowledge proofs due to the non-invertibility of the data in the integer ring, the embodiment provides a zero-knowledge proof method among multiple parties. This method can be applied in Figure 1 the illustrated implementation scenario or other implementation scenarios obtained based on this implementation scenario.

[0062] The following combines Figure 2 to describe the present application in detail from the perspective of the method.

[0063] Figure 2 FIG. is a schematic flowchart of a zero-knowledge proof method among multiple parties provided by the embodiment. This method involves the prover P and the verifier V. The prover P executes this method through the first computing device, and the verifier V executes this method through the second computing device. The prover P has the first private data w. The method includes:

[0064] Step S210, the prover P determines the first task to be subjected to zero-knowledge proof.

[0065] Among them, the first task can be understood as being used to prove the first private data to the verifier through the first equality relationship. Several first public data and the first private data included in the first equality relationship belong to the integer ring. When using this integer ring as the finite field H, the data in the integer ring does not meet the requirements of the above polynomial interpolation method.

[0066] The following is an example. A number of first public data include the first matrix A, the second matrix B, and the third matrix C. These three matrices are public, that is, both the prover P and the verifier V know these matrices. The first private data w is owned by the prover P. The first task can specifically be that the prover P needs to prove to the verifier V that it owns an evidence w such that the first equation relationship, namely Equation (1) Az * Bz = Cz, holds, and w cannot be leaked. The first private data w is a part of the vector z, and the vector z contains a vector x part and a vector w part. For example, z can be the vector (1, 3, 35, 9, 27, 30), x can be the vector (1, 3), and w can be the vector (35, 9, 27, 30). The vector x and the vector w are concatenated to form z. The sum of the dimensions of the vector x and the vector w is equal to the dimension of the vector z.

[0067] Zero-knowledge proof can be applied in a variety of application scenarios. In different application scenarios, the meaning of the first private data w may be different. For example, the first private data w can be a certain specific information of a user. By performing zero-knowledge proof on the first task, a financial institution can prove the user's identity or authority while hiding the user's specific information. In blockchain transactions, the first private data w can be some detailed information of the transaction, such as the transaction amount, the identities of the two parties to the transaction, etc. By performing zero-knowledge proof on the first task, the nodes in the blockchain can ensure the legality and validity of the transaction while hiding the above-mentioned detailed information of the transaction.

[0068] In the above data, the matrices A, B, and vector vector z = (x, w) The matrices A, B, C, and the vector x are all public data, and the vector w is private data held by the prover. When a proof task, such as the first task, is determined, the dimensions of the matrices A, B, C, and the vectors x, w, and z are all determined.

[0069] Integer ring where k is an arbitrary integer and p is a prime number. In a computer, p generally takes 2. This integer ring is a data type used in a computer, and k can take values such as 32 or 64, etc. Therefore, it can be said that the data in a computer is a ring of integers (int type) modulo (mod) 2 32 or a ring of long integers (long int type) modulo 2 64 Integer ring contains all integers from 0 to 2 k - 1, and addition and multiplication operations are defined on this set, and the results of these operations are all taken modulo 2 k .

[0070] represent the integer ring a matrix with dimension n1×n2 in represent the integer ring a vector with dimension n3 in represent the integer ring a vector with dimension n2 - n3 in

[0071] When the modulus is 2 k this ring is the integer ring, rather than a prime field. And the integer ring contains a lot of non - invertible data. Usually, in the integer ring half of the elements are invertible and half are non - invertible. In the following description, the integer ring is taken as an example for illustration. When there are not enough invertible elements in this integer ring or rather, it contains a lot of non - invertible elements, it cannot meet the requirements of the polynomial interpolation method. When performing polynomial interpolation of equations (3) and (4), there may be a non - invertible situation where the denominator does not have a multiplicative inverse

[0072] When there are not enough invertible data in this integer ring the Lagrange interpolation method shown in equation (4) cannot be used to convert the data into the corresponding polynomial, and thus the zero - knowledge proof based on R1CS constraints cannot be executed

[0073] Step S220, the prover P maps the data included in the first equation relationship to the Galois ring obtained based on the above - mentioned integer ring, obtaining a second equation relationship. When using this Galois ring as the finite field H, the data in the Galois ring can meet the requirements of the Lagrange interpolation method, that is, there are enough invertible elements in the Galois ring. That is to say, when arbitrarily selecting x in the Galois ring i the denominator of equation (4) obtained has a multiplicative inverse under the corresponding modulus and is invertible

[0074] Among them, the first equation relationship is, for example, Az*Bz = Cz in equation (1). The first equation relationship contains the first private data w and several first public data, including: A, B, C, and x. The data included in the first equation relationship is the data in the integer ring where the data type in the computer is located

[0075] Mapping the data included in the first equation relationship to the Galois ring means mapping each of the several data included in the first equation relationship to the Galois ring. For example, mapping the first private data w to the Galois ring, obtaining the second private data Mapping the several first public data to the Galois ring respectively, obtaining several corresponding second public data, that is, mapping A to mapping B to mapping C to Map x to The symbols with circumflex represent the data in the Galois ring.

[0076] Among them, the Galois ring GR(p k , d) corresponds to this integer ring and is obtained by expanding this integer ring d times. The elements in the Galois ring GR are polynomials of degree d - 1, and the coefficients of the polynomials belong to the integer ring Each polynomial in the Galois ring GR can be represented as a vector of dimension d. k in the Galois ring is equal to k in the integer ring. d is the expansion coefficient, which is a preset value. The Galois ring GR(p k , d) is a finite ring containing p kd elements and has important applications in coding theory and cryptography.

[0077] In this step, in order to be able to perform zero-knowledge proof on the first equation relationship in the integer ring, each data can be mapped to the Galois ring GR. Since the data in GR is invertible, zero-knowledge proof based on R1CS constraints can be performed in the Galois ring based on Equation (4).

[0078] When the prover P does not act maliciously, the first private data w it owns can satisfy Equation (1). When the data in Equation (1) is mapped to the Galois ring GR respectively, the following relationships are still satisfied for each data:

[0079]

[0080] Among them, Equation (5) can be used as the second equation relationship.

[0081] When mapping, in order to improve the mapping efficiency, a multiplication-friendly embedding algorithm (Reverse-Multiplicative Friendly Embedding, RMFE) can be used to map the data in the integer ring to the Galois ring GR. The RMFE algorithm is also a coding algorithm. It contains a pair of RMFE encodings (φ, ψ) with 4 multiplications, and the mapping is performed for m elements, where m is a preset integer. Among them, the φ transformation is to map the data in the integer ring to the Galois ring, that is:

[0082]

[0083] Among them, represents a vector of dimension m in the integer ring .

[0084] The ψ transformation is to map the data in the Galois ring to the integer ring, that is:

[0085]

[0086] The above two mappings (6) and (7) are linear mappings and satisfy that for any the following equation holds:

[0087] ψ(φ(x1)φ(x2)φ(x3)φ(x4)) = x1 * x2 * x3 * x4 (8)

[0088] where m and d are the dimension parameters of the RMFE encoding.

[0089] In one implementation, the RMFE can be used to map several first public data to the Galois ring respectively to obtain corresponding second public data. Acting φ on the m elements of each vector included in matrices A, B, and C in sequence, for example, acting on every m elements of the row vectors included in matrices A, B, and C, we get:

[0090]

[0091] where Im(φ) is the image set of the φ transformation and is also the range. Denote the range of φ as Im(φ), x belongs to the integer ring as the preimage. n1×n2 / m is the matrix dimension they respectively have.

[0092] Similarly, the RMFE can be used to map the first private data w to the Galois ring to obtain the second private data That is, acting φ on every m elements of x and w in sequence, we get:

[0093]

[0094] where n3 / m is the dimension of the range Im(φ) of the dimension of the range Im(φ) of

[0095] In this implementation, using the RMFE encoding to map matrix and vector data can map every m elements, thereby improving the efficiency of the mapping process. Of course, the above mapping method is not the only one, and other mapping methods can also be adopted. For example, mapping can be performed on each element in the matrix and vector.

[0096] Step S230, the prover P uses the above polynomial interpolation method to perform zero-knowledge proof based on the second equation relationship and sends the proof C to the verifier V.

[0097] Step S240: The verifier V receives the above proof C sent by the prover P, determines a proof result based on the proof C, and the proof result is used to determine the proof result for the first task.

[0098] Among them, the proof result obtained based on the second equation relationship can be used to determine the proof result for the first task. The proof result includes passing the proof and failing the proof. Passing the proof indicates that the prover P has successfully proved and the statement of the prover P is true. Failing the proof indicates that the prover P has failed to prove and the statement of the prover P is false.

[0099] When obtaining Equation (5), this equation can be used as the second equation relationship. The prover P can use the above polynomial interpolation method to convert Equation (5) into a polynomial, perform a series of calculations, obtain the proof C, and send the proof C to the verifier V. After obtaining the proof C, the verifier V can perform some simple calculations to obtain the proof result.

[0100] Among them, the polynomial interpolation method can be the Lagrange interpolation method, see Equation (4); it can also be other interpolation methods, and the other interpolation methods also require that there are enough invertible elements in the finite field, that is, the requirements are the same as those of the Lagrange interpolation method. The prover P converts the second equation relationship into a polynomial and performs a series of calculations, and the calculation process of the verifier V after receiving the proof C can be carried out in the existing manner based on R1CS constraints, which will not be elaborated here.

[0101] In this embodiment, by executing Step S220, the prover P maps the data in the integer ring to the Galois ring, making the data in the obtained second equation relationship invertible, so that polynomial interpolation methods including the Lagrange interpolation method can be used for polynomial conversion, and further enabling the process of zero-knowledge proof for the second equation relationship to be smoothly executed, solving the problem that the data in the integer ring cannot be used for zero-knowledge proof using R1CS constraints.

[0102] Figure 3 It is a schematic diagram of the execution process of a zero-knowledge proof provided for the embodiment. Figure 3 From the perspective of data transformation for Figure 2The implementation process of the embodiment is specifically described. Among them, the first task is to perform zero-knowledge proof for the first equation relationship, which includes first private data and several first public data. The data included in the first equation relationship belongs to the integer ring, and the data in the integer ring is not necessarily invertible, resulting in the inability to directly perform zero-knowledge proof for the first equation relationship. Mapping the first equation relationship to the Galois ring, a second equation relationship is obtained, which includes second private data and several second public data obtained through mapping. Since the data in the Galois ring is invertible, this makes the zero-knowledge proof for the second equation relationship executable. Performing zero-knowledge proof based on the Galois ring and the second equation relationship, a proof result can be obtained, and based on this proof result, a proof result for the first task can be obtained.

[0103] When the above proof result fails the proof, it can be determined that the proof result for the first task must fail. And when the above proof result passes the proof, it may be that a malicious prover carefully constructs some malicious data to pass the check. To ensure the security of the scheme and prevent malicious provers from passing the check, the following additional checks are added in this application.

[0104] Figure 4 Schematic diagram of the execution process of the additional check provided for the embodiment. Compared with Figure 3 the embodiment shown, Figure 4 in the embodiment shown, a first constraint term is added to the intermediate equation relationship. The zero-knowledge proof process for the second equation relationship includes the proof for the second equation relationship itself, the proof for the first constraint term, and the proof for the second private data. When all three parts of the proof pass, it can be ensured that malicious provers cannot pass the check by constructing false malicious data.

[0105] The following is a detailed description of this embodiment.

[0106] In this embodiment, the step of obtaining the second equation relationship in step S220 may include the following steps 1 and 2.

[0107] Step 1, map the data included in the first equation relationship to the Galois ring to obtain an intermediate equation relationship.

[0108] Step 2, add a first constraint term to the intermediate equation relationship to obtain the second equation relationship. The value of the first constraint term

[0109] is selected from the data included in the kernel set Ker. Figure 2Based on the embodiments, a proof for the first constraint item is further added That is, the following step 3 is further included:

[0110] Step 3: The prover P uses the method of zero-knowledge proof to prove to the verifier V that the value of the first constraint item is from the kernel set Ker.

[0111] The following specifically describes the Figure 3 shown embodiments.

[0112] The execution of step 1 is the same as the execution process of step S220 in Figure 2 , only the obtained equation relationship is processed as an intermediate equation relationship, and other contents will not be elaborated. For example, equation (5) can be used as an intermediate equation relationship.

[0113] Adding the first constraint item in step 2 can be adding the first constraint item to other items, or multiplying. Multiplication and addition can actually be interchanged. The following takes addition as an example for illustration. Adding the first constraint item to the intermediate equation relationship, the obtained second equation relationship can be expressed as:

[0114]

[0115] Among them, the value of the first constraint item is selected from the data included in the kernel set Ker. The data in the kernel set Ker belongs to the Galois ring GR, and when the data in the kernel set Ker is mapped to the integer ring it is 0. That is:

[0116]

[0117] Among them, the data in the kernel set Ker belongs to the Galois ring GR, and when the data in the kernel set Ker is mapped to the integer ring the obtained while is 0.

[0118] In step 3, the value of the first constraint item belongs to private data and cannot be leaked to the verifier V, but the kernel set Ker is public data.

[0119] When proving to the verifier V that the value of the first constraint item is from the kernel set Ker, the prover P can generate a first random number, and combine the first random number with the first constraint item Send the first product result of the value of to the verifier V. The verifier V receives the first product result sent by the prover P and verifies the first constraint term based on the first product result The value of comes from the kernel set Ker. The first product result well protects the first constraint term

[0120] The verifier V can verify whether the first product result belongs to the kernel set Ker. If it belongs, it determines the first constraint term The value of comes from the kernel set Ker. When the first product result does not belong to the kernel set Ker, it means that the first constraint term The value of does not come from the kernel set Ker

[0121] The verifier V can directly determine whether the first product result is in the kernel set Ker; or map the first product result to the integer ring Verify whether the mapped value is 0. If it is, it means that the first product result is in the kernel set Ker

[0122] Multiplying the first random number by the value of the first constraint term is a random linear combination method. It can be understood that the properties of the integer ring space and the Galois ring space ensure that if the result after performing a sufficient number of random linear combinations on the value of the first constraint term that is, the first product result, is still in these two spaces, that is, still meets the requirements, then the value of the first constraint term is likely to be in the kernel set

[0123] Next, look at the proof for the second private data In the Galois ring space, there may be some data whose dimensions are different from those of the real second private data but can still satisfy the second equality relationship

[0124] In another embodiment of the present application, when mapping the data included in the first equality relationship to the Galois ring in step S220, the first private data w is mapped to the second private data The mapping process processes the private data, causing its value to change. To ensure the security of zero-knowledge proof, the prover P needs to give some additional proofs about the private data to the verifier V. Since in the mapping encoding process, it can be proved that the second private data has dimensions corresponding to those of the first private data w

[0125] Given that the first private data w is a vector of the first dimension n2 - n3 dimension, when the statement of the prover P is true, the second private data obtained by it The vector dimension of should be the dimension corresponding to the first dimension. That is, the following step 4 can also be included in this embodiment:

[0126] Step 4, the prover P uses the method of zero-knowledge proof to prove to the verifier V the second private data whose vector dimension is the dimension corresponding to the first dimension.

[0127] The dimension corresponding to the first dimension can include several cases. For example, when using RMFE coding for mapping, the second private data the vector dimension becomes (n2 - n3) / m. Therefore, the prover P proves to the verifier V that the vector dimension of the second private data is (n2 - n3) / m.

[0128] Or, when not using RMFE coding to map every m elements, but using mapping for each element in the matrix and vector, the prover P proves to the verifier V the second private data the vector dimension is n2 - n3.

[0129] When proving, the method of random linear challenge can be adopted. The prover P generates a second random number and sends the second product result of the second random number and the second private data to the verifier V. The verifier V receives the second product result sent by the prover P and verifies whether the vector dimension of the second private data is the dimension corresponding to the first dimension based on the second product result. The second product result well protects the second private data from being leaked.

[0130] The verifier V can directly verify whether the vector dimension of the second product result is the target dimension. If so, it is determined that the verification is successful; if not, the verification fails. The target dimension is the dimension corresponding to the first dimension.

[0131] Multiplying the second random number and the second private data is a random linear combination method. It can be understood that the properties of the integer ring space and the Galois ring space ensure that if the result after performing a sufficient number of random linear combinations on the value of the second private data , that is, the second product result, its dimension still meets the requirements, then the second private data is probably mapped from the original first private data w.

[0132] Next, the above embodiment will be further described in combination with Figure 5 as follows.

[0133] Figure 5A schematic diagram of a principle for proving the task conversion process provided for the embodiment. Among them, the first equation relationship is Equation (1) Az*Bz = Cz, where z includes x and w, the vector w is private data, and all data here belongs to the integer ring The zero-knowledge proof process for the first equation relationship is the initial proof task, that is, the first task. Map the data included in the first equation relationship in the first task to the Galois ring GR through RMFE encoding to obtain the intermediate equation relationship, that is, Equation (5) All data in Equation (5) belongs to the Galois ring GR.

[0134] Next, in the intermediate equation relationship Add the first constraint term Get the second equation relationship Equation (11) At this time, the proof task can be converted into the proof of the following content:

[0135] Prove the second equation relationship;

[0136] Prove that belongs to the kernel set Ker;

[0137] Prove the dimension of the second private data When all three of the above are proven to pass, it can be confirmed that the first task is proven to pass, that is, it is confirmed that the first private data is real.

[0138] Next, the logical correctness of the proof conversion process in the above embodiment will be explained.

[0139] Map the first constraint term

[0140] to the integer ring The obtained data can be expressed as η. In the integer ring The following equation relationship may exist: In the integer ring

[0141] Az*Bz = Cz + η (13)

[0142] In the process of explanation, Equation (1) Az*Bz = Cz, and Equation (5) and Equation (11)

[0143]

[0144] At the same time, the following transformation formula for Equation (11) will also be used in the process of explanation:

[0145]

[0146]

[0147] Suppose the first private data \(w\) held by the prover \(P\) is not true. Then, equations (1) and (5) do not hold. Equation (1) will become equation (13), and equation (5) will become equation (11). And the is not a vector in the kernel set \(Ker\).

[0148] In this way, the data \(z\) containing the first private data \(w\) does not satisfy equation (1), but satisfies equation (13), and \(\eta\neq0\). Suppose the data \(z\) satisfies equation (1), then \(\eta = 0\). Therefore, if it can be proved that equation (13) holds and \(\eta = 0\) in it, that is, it is proved that equation (1) is correct.

[0149] Based on equation (13), perform the \(\varphi\) transformation on both sides of equation (13), mapping the data from the integer ring to the Galois ring, and the result is equation (11).

[0150] Now the problem is transformed into the following proof of equation (11): The prover \(P\) calculates and from the data \(A\), \(B\), \(C\) and \(z\) he has, and selects the first constraint term from the kernel set \(Ker\). Use these data to prove that equation (11) holds, and prove that the in it is selected from the kernel set \(Ker\), and prove that the dimension of the second private data is the target dimension.

[0151] If the above proofs of equation (11) can be achieved, then it means that the proof of equation (1) is achieved. Because, perform the \(\psi\) transformation on both sides of equation (11), and equation (14) is obtained. Equation (14) is the data on the integer ring. Since \(\psi\) is a linear transformation and has the property of equation (8), equation (14) can be transformed into equation (15). When belongs to the kernel set \(Ker\), Equation (15) is transformed into equation (16). Based on equation (15), equation (14) can be transformed into equation (16), that is, equation (14) and equation (16) are equivalent, and equation (16) is equation (1). Therefore, equation (1) can be undoubtedly obtained from the above proof of equation (11).

[0152] In summary, the above embodiments transform the relationship on the integer ring (non-prime ring) to the Galois ring through RMFE encoding, and then use the Galois ring to construct a data set that supports the Lagrange interpolation method, and further use the existing scheme to prove the second equality relationship on the Galois ring. At the same time, due to the RMFE encoding transformation, the embodiments introduce two additional spatial constraint relationships on the basis of the existing scheme, which can be further proved, making the proof process more rigorous and accurate. That is, the embodiments propose a scheme using random linear challenges to transform the spatial constraint relationships (i.e., the proof of the second privacy data dimension and the proof that the first constraint term belongs to the kernel set) into solvable proof tasks.

[0153] In this specification, the "first" in terms such as the first privacy data, the first public data, the first constraint term, and the first dimension, and the corresponding "second" (if any) in the text are only for the convenience of distinction and description, and do not have any restrictive meaning.

[0154] The above content describes specific embodiments of this specification, and other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be executed in a different order from that in the embodiments, and still achieve the desired results. Additionally, the processes depicted in the drawings do not necessarily need to be executed in the specific order or continuous order shown to achieve the desired results. In certain embodiments, multi-tasking and parallel processing are also possible or may be advantageous.

[0155] Figure 6 A schematic block diagram of a zero-knowledge proof device among multiple parties provided for the embodiments. This device embodiment corresponds to Figure 2 、 Figure 3 and Figure 4 the method embodiments shown. This device 600 is deployed in the prover, and the prover has the first privacy data. This device 600 includes:

[0156] A task determination module 610, configured to determine a first task to be subject to zero-knowledge proof, where the first task is used to prove the first privacy data to the verifier through a first equality relationship. Among the first equality relationship, several first public data and the first privacy data belong to the integer ring, and the data in the integer ring does not meet the requirements of the polynomial interpolation method;

[0157] A data mapping module 620, configured to map the data included in the first equality relationship to the Galois ring obtained based on the integer ring to obtain a second equality relationship; the data in the Galois ring can meet the requirements of the polynomial interpolation method;

[0158] The zero-knowledge proof module 630 is configured to perform a zero-knowledge proof based on the second equation relationship by using the above polynomial transformation method and send the proof to the verifier. The proof result obtained based on the second equation relationship is used to determine the proof result for the first task.

[0159] In one implementation, the data mapping module 620 includes: a mapping sub-module 21 and a constraint sub-module 22. The mapping sub-module 21 is configured to map the data included in the first equation relationship into the Galois ring to obtain an intermediate equation relationship. The constraint sub-module 22 is configured to add a first constraint term to the intermediate equation relationship, and the value of the first constraint term is selected from the data included in the kernel set; the data in the kernel set belongs to the Galois ring, and when the data in the kernel set is mapped to the integer ring, it is 0.

[0160] The apparatus 600 further includes: a constraint proof module 640, configured to prove to the verifier, by using the method of zero-knowledge proof, that the value of the first constraint term comes from the kernel set.

[0161] In one implementation, the constraint proof module 640 is specifically configured to: generate a first random number and send the first product result of the first random number and the value of the first constraint term to the verifier, so that the verifier proves that the value of the first constraint term comes from the kernel set based on the first product result.

[0162] In one implementation, the first private data is a vector of the first dimension. The data mapping module 620 is specifically configured to: map the first private data into the Galois ring to obtain the second private data.

[0163] The apparatus 600 further includes: a dimension proof module 650, configured to prove to the verifier, by using the method of zero-knowledge proof, that the vector dimension of the second private data is the dimension corresponding to the first dimension.

[0164] In one implementation, the dimension proof module 650 is specifically configured to: generate a second random number and send the second product result of the second random number and the second private data to the verifier, so that the verifier verifies that the vector dimension of the second private data is the first dimension based on the second product result.

[0165] In one implementation, when the data mapping module 620 maps the first private data into the Galois ring, it includes: using a multiplication-friendly embedding algorithm to map the first private data into the Galois ring.

[0166] In one implementation, the polynomial transformation method includes the Lagrange interpolation method.

[0167] The above device embodiments correspond to the method embodiments. For specific descriptions, reference can be made to the descriptions in the method embodiment section, and details will not be repeated here. The device embodiments are obtained based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments. For specific descriptions, reference can be made to the corresponding method embodiments.

[0168] Embodiments of this specification also provide a computer-readable storage medium, on which a computer program is stored. When the computer program is executed on a computer, it causes the computer to execute Figures 1 to 5 the method described in any one of the above.

[0169] Embodiments of this specification also provide a computing device, including a memory and a processor. An executable code is stored in the memory. When the processor executes the executable code, it implements Figures 1 to 5 the method described in any one of the above.

[0170] Each embodiment in this specification is described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the embodiments of the storage medium and the computing device, since they are basically similar to the method embodiments, the descriptions are relatively simple. For the relevant parts, reference can be made to the partial descriptions in the method embodiments.

[0171] Those skilled in the art should be able to realize that in one or more of the above examples, the functions described in the embodiments of the present invention can be implemented by hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0172] The above specific implementation manners further elaborate on the objectives, technical solutions, and beneficial effects of the embodiments of the present invention. It should be understood that the above is only the specific implementation manners of the embodiments of the present invention and is not used to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made based on the technical solutions of the present invention shall be included within the protection scope of the present invention.

Claims

1. A zero-knowledge proof method between multiple parties, performed by a prover and a verifier, wherein the prover possesses first private data; The method comprises: The prover determines a first task to be performed on a zero-knowledge proof, where the first task is to prove the first private data to the verifier using a first equation; wherein the first public data and the first private data included in the first equation belong to an integer ring, and the data in the integer ring does not meet the requirements of the polynomial interpolation method; The prover maps the data contained in the first equation relationship to a Galois ring obtained based on the integer ring to obtain a second equation relationship; the data in the Galois ring can meet the requirements of the polynomial interpolation method; The prover uses the polynomial interpolation method to perform a zero-knowledge proof based on the second equation relationship and sends the proof to the verifier; The verifier receives the proof sent by the prover and determines a proof result based on the proof, where the proof result is used to determine a proof result for the first task.

2. A zero-knowledge proof method between multiple parties, performed by a prover, wherein the prover possesses first private data; The method comprises: Determining a first task to be zero-knowledge proofed, the first task being used to prove the first private data to a verifier using a first equation; wherein the first public data and the first private data included in the first equation belong to an integer ring, and the data in the integer ring does not meet the requirements of a polynomial interpolation method; Mapping the data contained in the first equation relationship to a Galois ring obtained based on the integer ring to obtain a second equation relationship; the data in the Galois ring can meet the requirements of the polynomial interpolation method; The polynomial interpolation method is used to perform a zero-knowledge proof based on the second equation relationship, and the proof is sent to the verifier; wherein the proof result obtained based on the second equation relationship is used to determine the proof result for the first task.

3. The method according to claim 2, wherein the step of obtaining the second equation relationship comprises: Mapping the data contained in the first equation relationship to the Galois ring to obtain an intermediate equation relationship; Adding a first constraint term to the intermediate equality relationship, wherein a value of the first constraint term is selected from data included in a core set; the data in the core set belongs to the Galois ring, and is 0 when the data in the core set is mapped to the integer ring; The method further comprises: Using a zero-knowledge proof method, it is proved to the verifier that the value of the first constraint item comes from the core set.

4. The method according to claim 3, wherein the step of proving to the verifier that the value of the first constraint item is from the core set comprises: Generate a first random number, and send a first product result of the first random number and the value of the first constraint item to the verifier, so that the verifier proves that the value of the first constraint item is from the core set based on the first product result.

5. The method according to claim 2, wherein the first private data is a vector of a first dimension; The step of mapping the data included in the first equation relationship to the Galois ring includes: mapping the first private data to the Galois ring to obtain second private data; The method further comprises: Using a zero-knowledge proof method, prove to the verifier that the vector dimension of the second private data is the dimension corresponding to the first dimension.

6. The method according to claim 5, wherein the step of proving to the verifier that the vector dimension of the second private data is the first dimension comprises: A second random number is generated, and a second product result of the second random number and the second private data is sent to the verifier, so that the verifier verifies that the vector dimension of the second private data is the first dimension based on the second product result.

7. The method according to claim 5, wherein the step of mapping the first private data to the Galois ring comprises: The first private data is mapped to the Galois ring using a multiplication-friendly embedding algorithm. The method according to claim 2 , wherein the polynomial interpolation method comprises a Lagrange interpolation method.

9. A zero-knowledge proof device between multiple parties, deployed in a prover, wherein the prover possesses first private data; The device comprises: a task determination module configured to determine a first task to be zero-knowledge proofed, the first task being to prove the first private data to a verifier using a first equation; wherein the first public data and the first private data included in the first equation belong to an integer ring, and the data in the integer ring does not meet the requirements of the polynomial interpolation method; a data mapping module configured to map the data contained in the first equation relationship to a Galois ring obtained based on the integer ring to obtain a second equation relationship; the data in the Galois ring can meet the requirements of the polynomial interpolation method; A zero-knowledge proof module is configured to use the polynomial interpolation method to perform a zero-knowledge proof based on the second equation relationship and send the proof to the verifier; wherein the proof result obtained based on the second equation relationship is used to determine the proof result for the first task.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 8.

11. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 8 is implemented.

Images