Block chain-based Xiaohua chicken traceability method and system

Abstract

The invention provides a Xiaohua chicken traceability method and system based on a block chain, and the method comprises the steps: generating a root public parameter and a root verification key through credible setting, generating an independent sub-proof key for each node from breeding to selling through a hierarchical key derivation function based on a traceability hierarchical structure, encoding the acquired multi-modal traceability data into private input of the zero-knowledge proof circuit; selecting a corresponding rule circuit from a predefined circuit library, and splitting a data source party; each data party generates a zero-knowledge proof fragment by using a sub-proof key and a blinding factor, and after a main node verifies public state consistency and blinding factor constraint through a recursive aggregation algorithm, an aggregation proof is generated; the common input comprises a new state commitment generated by a cryptographic accumulator, and continuous updating of the state is realized; and verifying the aggregation certification by using the root verification key, and storing the certification abstract passing the verification in the block chain. According to the invention, cross-link data privacy protection and verifiable chain type tracing can be realized.

Description

Technical Field

[0001] This application belongs to the field of traceability, and in particular relates to a blockchain-based traceability method and system for Xinghua chicken. Background Technology

[0002] Xinghua chicken, with its firm meat texture, is widely loved by consumers. Full lifecycle traceability of Xinghua chicken not only protects consumer rights but is also key to enhancing brand value. Blockchain technology, with its characteristics of data immutability and transparency, is commonly used in the traceability field. Blockchain traceability typically records traceability data from each stage, such as breeding environment, feed information, and quarantine reports, directly on a distributed ledger. However, this data transparency can lead to the leakage of business privacy, exposing sensitive operational data of upstream and downstream enterprises in the supply chain, such as supplier relationships and batch costs. Directly uploading massive amounts of multimodal traceability data to the blockchain causes a rapid expansion of the blockchain ledger, resulting in high storage costs, low transaction throughput, and poor system scalability. Combining zero-knowledge proofs, especially Zk-SNARKs, with blockchain allows data owners to prove to verifiers that their data meets specific compliance requirements without revealing the specific data content, protecting data privacy and reducing the on-chain storage burden due to the small proof size. In complex traceability scenarios, data from a single stage is often provided by multiple different entities, such as farms, feed suppliers, and quarantine officers. Enabling these parties to collaboratively generate a unified proof of validity efficiently and securely while protecting their data privacy is a significant challenge. Furthermore, efficiently aggregating and reliably linking zero-knowledge proofs across multiple stages from breeding and slaughter to sales, ensuring the integrity of the traceability chain and the continuity of state transitions, and simplifying key management for the numerous participating nodes in a complex supply chain, are both problems that need to be solved and bottlenecks that current technological solutions have failed to effectively address. Summary of the Invention

[0003] To improve the privacy and reliability of Xinghua chicken traceability, the first aspect of this invention proposes a blockchain-based Xinghua chicken traceability method, comprising the following steps: A root public reference string and root verification key are generated through a one-time trusted setup. Based on the traceability hierarchy of the entire life cycle of Xinghua chicken, for each traceability node in breeding, slaughtering, processing, storage, transportation and sales, an independent sub-proof key is generated for each node using a hierarchical key derivation function based on the root public reference string and the node's identity feature vector. The traceability data collected in the traceability process is structured and encoded as the private witness input for the zero-knowledge proof circuit. From the circuit library defining all legal state transition rules for the Xinghua Chicken, a corresponding zero-knowledge proof circuit is selected based on the current tracing stage. The private witness input is split according to the data source. Each data source uses its own sub-proof key, the corresponding data subset, and the blinding factor used to hide the intermediate state to generate a zero-knowledge proof fragment. The master node of the tracing stage uses a recursive proof aggregation algorithm to aggregate all proof fragments to generate an aggregated zero-knowledge proof. The aggregation algorithm is used to verify that the common state shared by all proof fragments is consistent, and that the sum of the blinding factors used by each fragment satisfies a preset constraint. The generated aggregate zero-knowledge proof is verified using the root verification key and public input, and the verified proof and public input digest are recorded in the blockchain ledger.

[0004] Optionally, the public input of the aggregated zero-knowledge proof includes a new state commitment, which is calculated by a cryptographic accumulator based on the accumulator value recorded in the blockchain ledger in the previous stage and the batch handover ID of the current stage.

[0005] Optionally, the step of generating independent sub-proof keys for each node using a hierarchical key derivation function includes: The identity feature vector of the node is concatenated with the root common reference string; A deterministic seed is obtained by using the SHA-256 hash function to calculate the concatenated data; The seed is input into the hierarchical key derivation function to derive a dedicated sub-proof key for the node.

[0006] Optionally, the step of structurally encoding the traceability data collected during the traceability process as the private witness input for the zero-knowledge proof circuit includes: The environmental temperature and humidity values ​​are quantified into integers, and / or the feed batch number is converted into an ASCII code sequence, and / or the individual weight is standardized to grams and rounded down, and / or the logistics GPS track is encoded into a latitude and longitude coordinate pair sequence in chronological order, and / or the quarantine image is generated into a 64-bit hash value through a perception hash algorithm. All encoded data are concatenated into a numerical vector in a preset order. If the length of the numerical vector is less than the preset length, zero-padding is used to convert the numerical vector to the preset length. The numerical vector is then used as the private witness input.

[0007] Optionally, the step of generating zero-knowledge proof fragments by each data source using its own sub-proof key, the corresponding data subset, and a blinding factor used to hide intermediate states includes: Each data source generates a 256-bit random number as its blinding factor. In a zero-knowledge proof circuit, the blinding factor is operated on with the variables corresponding to the shared state in the private witness input to generate a blinded commitment to the shared state, and the blinding factor itself is used as a private input of the circuit for constraint.

[0008] Optionally, the circuit of the recursive proof aggregation algorithm enforces that the batch ID hash values ​​referenced by all proof fragments are consistent, and the blinding factors used by all proof fragments sum to zero over a preset finite field, so that the hiding effect of intermediate states is canceled out in the final aggregated proof, and the real shared state transition can be verified inside the circuit.

[0009] Optionally, the new state commitment is calculated by a cryptographic accumulator based on the accumulator value recorded in the blockchain ledger in the previous stage and the batch handover ID in the current stage, including: It employs an RSA-based cryptographic accumulator and pre-determines a publicly available modulus N; The accumulator value already recorded in the blockchain ledger in the previous step will be used as the old state commitment. ; Map the batch handover ID of the current stage to a value e using a hash function; Through formula The new state commitment is calculated. The new state commitment As one of the common inputs to the aggregated zero-knowledge proof, the circuitry of the aggregated zero-knowledge proof includes verification of the accumulator update calculation.

[0010] Optionally, recording the verified proof and public input digest in the blockchain ledger includes: The final aggregated zero-knowledge proof, the new state commitment, the digital signature of the current stage master node, and a Unix timestamp are packaged into a JSON object; The JSON object is serialized and submitted to the blockchain network as the payload of a transaction, where it is packaged into a new block by consensus nodes.

[0011] In a second aspect of the present invention, a blockchain-based traceability system for Xinghua chicken is provided, comprising the following modules: The sub-proof key generation module is used to generate the root public reference string and root verification key through a one-time trusted setting; based on the traceability hierarchy of the entire life cycle of Xinghua chicken, for each traceability node of breeding, slaughtering, processing, storage, transportation and sales, based on the root public reference string and the identity feature vector of the node, a hierarchical key derivation function is used to generate independent sub-proof keys for each node; the traceability data collected in the traceability process is structured and encoded as the private witness input of the zero-knowledge proof circuit; The zero-knowledge proof fragment generation and aggregation module is used to select the corresponding zero-knowledge proof circuit from the circuit library that defines all legal state transition rules for the Xinghua Chicken, based on the current tracing stage, and split the private witness input according to the data source. Each data source uses its own sub-proof key, the corresponding data subset, and the blinding factor used to hide the intermediate state to generate a zero-knowledge proof fragment. The master node of the tracing stage uses a recursive proof aggregation algorithm to aggregate all proof fragments to generate an aggregated zero-knowledge proof. The aggregation algorithm is used to verify that the common state shared by all proof fragments is consistent, and that the sum of the blinding factors used by each fragment satisfies a preset constraint. The verification module is used to verify the generated aggregate zero-knowledge proof using the root verification key and public input, and to record the verified proof and public input digest in the blockchain ledger.

[0012] Optionally, the public input of the aggregated zero-knowledge proof includes a new state commitment, which is calculated by a cryptographic accumulator based on the accumulator value recorded in the blockchain ledger in the previous stage and the batch handover ID of the current stage.

[0013] Optionally, the step of generating independent sub-proof keys for each node using a hierarchical key derivation function includes: The identity feature vector of the node is concatenated with the root common reference string; A deterministic seed is obtained by using the SHA-256 hash function to calculate the concatenated data; The seed is input into the hierarchical key derivation function to derive a dedicated sub-proof key for the node.

[0014] Optionally, the step of structurally encoding the traceability data collected during the traceability process as the private witness input for the zero-knowledge proof circuit includes: The environmental temperature and humidity values ​​are quantified into integers, and / or the feed batch number is converted into an ASCII code sequence, and / or the individual weight is standardized to grams and rounded down, and / or the logistics GPS track is encoded into a latitude and longitude coordinate pair sequence in chronological order, and / or the quarantine image is generated into a 64-bit hash value through a perception hash algorithm. All encoded data are concatenated into a numerical vector in a preset order. If the length of the numerical vector is less than the preset length, zero-padding is used to convert the numerical vector to the preset length. The numerical vector is then used as the private witness input.

[0015] Optionally, the step of generating zero-knowledge proof fragments by each data source using its own sub-proof key, the corresponding data subset, and a blinding factor used to hide intermediate states includes: Each data source generates a 256-bit random number as its blinding factor. In a zero-knowledge proof circuit, the blinding factor is operated on with the variables corresponding to the shared state in the private witness input to generate a blinded commitment to the shared state, and the blinding factor itself is used as a private input of the circuit for constraint.

[0016] Optionally, the circuit of the recursive proof aggregation algorithm enforces that the batch ID hash values ​​referenced by all proof fragments are consistent, and the blinding factors used by all proof fragments sum to zero over a preset finite field, so that the hiding effect of intermediate states is canceled out in the final aggregated proof, and the real shared state transition can be verified inside the circuit.

[0017] Optionally, the new state commitment is calculated by a cryptographic accumulator based on the accumulator value recorded in the blockchain ledger in the previous stage and the batch handover ID in the current stage, including: It employs an RSA-based cryptographic accumulator and pre-determines a publicly available modulus N; The accumulator value already recorded in the blockchain ledger in the previous step will be used as the old state commitment. ; Map the batch handover ID of the current stage to a value e using a hash function; Through formula The new state commitment is calculated. The new state commitment As one of the common inputs to the aggregated zero-knowledge proof, the circuitry of the aggregated zero-knowledge proof includes verification of the accumulator update calculation.

[0018] Optionally, recording the verified proof and public input digest in the blockchain ledger includes: The final aggregated zero-knowledge proof, the new state commitment, the digital signature of the current stage master node, and a Unix timestamp are packaged into a JSON object; The JSON object is serialized and submitted to the blockchain network as the payload of a transaction, where it is packaged into a new block by consensus nodes.

[0019] This invention, through a fragmented proof and recursive aggregation mechanism, supports the secure and efficient collaborative generation of unified stage proofs by multiple untrusted data sources, solving the challenge of multi-party collaboration. Uploading constant-size aggregated proofs to the blockchain reduces the storage burden on the blockchain and improves system processing performance and scalability. Furthermore, constructing a state transition chain using a cryptographic accumulator ensures the continuity and integrity of traceability information; hierarchical key derivation based on one-time trusted settings simplifies key management for numerous nodes in a complex supply chain, enhancing the practicality and security of the solution. Using multimodal traceability data from each stage as private witnesses for zero-knowledge proofs proves the compliance of traceability information without disclosing specific content, protecting the commercial privacy of all participants in the supply chain. Attached Figure Description

[0020] Figure 1 A flowchart of a specific embodiment; Figure 2 This is a schematic diagram of hierarchical key derivation and system architecture; Figure 3 A diagram illustrating the recursive proof of the aggregation process; Figure 4 This is a schematic diagram illustrating continuous state updates based on an accumulator. Figure 5 This is a diagram illustrating the verification and on-chain record. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with relevant laws, regulations, and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse. To more clearly explain this invention, the relevant terms are explained below: Private witness input: Specific data that the prover possesses and needs to keep confidential. When this data is input into the zero-knowledge proof circuit, all the equations of the circuit will be true, and the prover can prove that he / she possesses the private witness without having to show it.

[0022] Public input: In contrast to private witnesses, it is open to everyone, including provers and verifiers, and can also be input into zero-knowledge proof circuits.

[0023] Root Public Reference String and Root Verification Key: In ZKP systems such as zk-SNARKs, a root public reference string and a root verification key are generated during the trusted setup phase. Proofers must use the root public reference string when generating proofs, and anyone can use the publicly available root verification key, along with public input and the proof itself, to check the validity of a proof.

[0024] Blinding factor: A random number used to hide a real value in multi-party computation. For example, if the real value x is calculated with a random blinding factor b, such as x+b, the result of x+b is made public.

[0025] A specific embodiment proposes a blockchain-based traceability method for Xinghua chicken, such as... Figure 1 As shown, it includes the following steps: S1 generates a root public reference string and a root verification key through a one-time trusted setup; based on the traceability hierarchy of the entire life cycle of Xinghua chicken, for each traceability node in breeding, slaughtering, processing, storage, transportation and sales, an independent sub-proof key is generated for each node using a hierarchical key derivation function based on the root public reference string and the node's identity feature vector; the traceability data collected in the traceability process is structured and encoded as the private witness input of the zero-knowledge proof circuit; The trusted setup employs the Groth16 scheme, executed collaboratively by multiple untrusted parties to generate a root common reference string and a root verification key. The hierarchical key derivation function preferably uses the hash-based message authentication code HMAC-SHA256 algorithm. Using the root common reference string as the key, it calculates the identity feature vectors of nodes such as farm A or slaughterhouse B, securely deriving a unique sub-proof key for each node. Figure 2 As shown.

[0026] The structured coding process converts different types of data into finite field elements. For example, the ambient temperature of 25.5 degrees Celsius is converted into the integer 255 by multiplying by a scaling factor of 10; the logistics GPS track point 113.32 E longitude 23.15 N latitude is converted into two independent integers; and the quarantine image data is calculated into a fixed-length hash value using the SHA256 hash algorithm. These field elements together constitute the circuit's private witness vector.

[0027] S2, from the circuit library defining all legal state transition rules for Xinghua Chicken, select the corresponding zero-knowledge proof circuit according to the current tracing stage, and split the private witness input according to the data source; each data source uses its own sub-proof key, the corresponding data subset, and the blinding factor used to hide the intermediate state to generate a zero-knowledge proof fragment; the master node of the tracing stage uses a recursive proof aggregation algorithm to aggregate all proof fragments to generate an aggregated zero-knowledge proof, wherein the aggregation algorithm is used to verify that the common state shared by all proof fragments is consistent, and that the sum of the blinding factors used by each fragment satisfies a preset constraint; The zero-knowledge proof circuit library is pre-developed using languages ​​specific to fields such as Circom, and includes circuits for verifying temperature and humidity ranges during the breeding stage and for verifying geofencing during the transportation stage. The recursive proof aggregation algorithm employs Nova or Sangria algorithms based on a folding scheme. For example, the farm and feed supplier each generate proof shards. The master node, the farm, recursively folds the two shards into an aggregated proof, verifying whether shared public states such as batch IDs in the two shards are completely consistent, and verifying whether the sum of the blinding factors provided by both parties is zero. To prevent master node failures and malicious master nodes, in an optional embodiment, the master node is determined randomly or by voting.

[0028] S3. The generated aggregate zero-knowledge proof is verified using the root verification key and public input, and the verified proof and public input digest are recorded in the blockchain ledger.

[0029] Cryptographic accumulators can employ hash-based commitment schemes, such as the Poseidon hash function. Verification is the process of executing the Groth16 verification algorithm, which uses the root verification key to perform a pairwise computation on the aggregated zero-knowledge proof and the public input, including the new state commitment. If the equality holds, the verification passes. After successful verification, this aggregated proof, which is only a few hundred bytes long, along with the digest obtained by performing a Keccak-256 hash operation on the public input vector, is submitted as the transaction payload to blockchain platforms such as Ethereum and recorded. In an optional embodiment, the new state commitment is calculated as follows: a new state commitment equals the hash of the old proof and the hash value of the current handover ID. The old proof hash is the hash value of the verified proof from the previous stage read from the blockchain, and the current handover ID is the handover ID when the slaughterhouse receives a batch of chickens from the farm. The new state commitment, as public input, is included in the proof circuit of the current stage, enforcing the ordered linking of states.

[0030] In an optional embodiment, the step of generating independent sub-proof keys for each node using a hierarchical key derivation function includes: The identity feature vector of the node is concatenated with the root common reference string; A deterministic seed is obtained by using the SHA-256 hash function to calculate the concatenated data; The seed is input into the hierarchical key derivation function to derive a dedicated sub-proof key for the node.

[0031] Each specific farm or slaughterhouse can obtain a unique key that cannot be deduced by others. Suppose a farm's business registration number is 913…X, and the default root common reference string is a long hexadecimal string, such as 0x1A2B3CDEF0. Simply concatenate these two parts of data to form a new string: 913…X1A2B3CDEF0.

[0032] The concatenated long string is input into the SHA-256 hash function, which outputs a 256-bit hash value, a fixed-length deterministic seed, such as 5E884…42D8. This deterministic seed is uniquely generated based on the node's identity; as long as the identity information remains unchanged, the seed remains constant. The seed is used as input to a hierarchical key derivation function. The SHA-256 hash function, based on a tree structure, derives sub-proof keys specific to the farm from this seed. This ensures the security and isolation of key generation; even if the root reference string of the entire system is public, it is impossible to forge a key without knowing the specific node's identity information.

[0033] In an optional embodiment, the step of structurally encoding the traceability data collected during the traceability process as the private witness input for the zero-knowledge proof circuit includes: The environmental temperature and humidity values ​​are quantified into integers, and / or the feed batch number is converted into an ASCII code sequence, and / or the individual weight is standardized to grams and rounded down, and / or the logistics GPS track is encoded into a latitude and longitude coordinate pair sequence in chronological order, and / or the quarantine image is generated into a 64-bit hash value through a perception hash algorithm. All encoded data are concatenated into a numerical vector in a preset order. If the length of the numerical vector is less than the preset length, zero-padding is used to convert the numerical vector to the preset length. The numerical vector is then used as the private witness input.

[0034] To enable zero-knowledge proof circuits to handle various types of data, they need to be uniformly converted into a digital format. For example, the environmental temperature recorded in a breeding process is 25.5 degrees Celsius and the humidity is 68%, which can be quantized into integers 255 and 68. For a batch of feed with batch number F202308A, each character is converted into its corresponding ASCII code value: 70, 50, 48, 50, 51, 48, 56, 65. The weight of a pig is 55.7 kg, which is uniformly converted to 55700 grams.

[0035] For more complex data, such as GPS tracks for logistics transportation, a series of latitude and longitude coordinate pairs recorded in chronological order, such as the coordinates near xx (31.908°N, 86.397°E), can be converted into integer pairs 319080 and 863970. For a pig's health quarantine photo, a 64-bit hash value, such as A8C3E7F1B096D425, can be obtained using a perceptual hash algorithm to uniquely identify the image content. All these processed values, such as 255, 68, 70, 50, 48, 50, 51, 48, 56, 65, 55700, 399080, 1163970, and A8C3E7F1B096D425, will be arranged in a predefined order and concatenated into a long numerical vector. This numerical vector serves as a private witness for this stage and is input into the proof circuit for calculation. If a stage does not include all the above information, zero-padding can be used to convert the numerical vector to a preset length.

[0036] In an optional embodiment, the step of generating zero-knowledge proof fragments by each data source using its own sub-proof key, the corresponding data subset, and a blinding factor used to hide intermediate states includes: Each data source generates a 256-bit random number as its blinding factor. In a zero-knowledge proof circuit, the blinding factor is operated on with the variables corresponding to the shared state in the private witness input to generate a blinded commitment to the shared state, and the blinding factor itself is used as a private input of the circuit for constraint.

[0037] For example, in the process of transferring live pigs from the farm to the slaughterhouse, the shared state is the number of pigs in that batch, which is 100. The farm, as the outflow party, has a private witness value representing the state change of -100, while the slaughterhouse, as the inflow party, has a value of 100. To hide the specific number, the farm independently generates a very large random number, such as a 256-bit blinding factor R1.

[0038] Inside the zero-knowledge proof circuit of the farm, a specific operation is performed between the blinding factor R1 and -100, representing the change in quantity—such as addition over a finite field—to generate a blinded commitment value. Once this commitment value is made public, outsiders cannot deduce the true quantity -100 from it. The blinding factor R1 itself also serves as a private input to the circuit, which enforces verification that this commitment is indeed calculated from -100 and R1. The slaughterhouse uses the same method, employing another randomly generated blinding factor R2 to blind its data 100, generating its own proof fragment.

[0039] In an optional embodiment, the circuit of the recursive proof aggregation algorithm enforces that all proof fragments reference the same batch ID hash value, and that the blinding factors used by all proof fragments sum to zero over a preset finite field, so that the hiding effect of intermediate states is canceled out in the final aggregated proof, and that the real shared state transition can be verified inside the circuit.

[0040] The aggregation proof circuit acts as the auditor, ensuring the correct connection of the entire business process by setting two core mandatory rules. The first rule verifies batch consistency, such as... Figure 3 As shown. For example, a batch of pigs has the ID PIG20230815A and its hash value is 7B3F6A0C1D2E5987. Both the proof fragment submitted by the farm and the proof fragment submitted by the slaughterhouse must contain and reference this exact same hash value 7B3F6A0C1D2E5987. The aggregation circuit checks this to ensure that the pigs are from the same batch.

[0041] The second rule is to cancel out the blinding factors. Continuing the previous example, the farm uses a blinding factor R1 to hide its -100 handover quantity, and the slaughterhouse uses R2 to hide its 100 receiving quantity. The aggregation circuit enforces a constraint that the sum of R1 and R2 over a specific mathematical domain must be zero, meaning R2 must equal negative R1. Thus, when the two proofs are aggregated, the hidden numerical parts add up to -100 plus 100, which equals zero, and the blinding factor parts add up to negative R1 plus R1, which also equals zero. This ensures the balance transition of the shared state, i.e., that the handover quantity is accurate. If the quantities do not match, for example, the slaughterhouse only received 99 heads, then the final calculation result will not be zero.

[0042] In an optional embodiment, the new state commitment is calculated by a cryptographic accumulator based on the accumulator value recorded in the blockchain ledger in the previous stage and the batch handover ID in the current stage, including: It employs an RSA-based cryptographic accumulator and pre-determines a publicly available modulus N; The accumulator value already recorded in the blockchain ledger in the previous step will be used as the old state commitment. ; Map the batch handover ID of the current stage to a value e using a hash function; Through formula The new state commitment is calculated. The new state commitment As one of the common inputs to the aggregated zero-knowledge proof, the circuitry of the aggregated zero-knowledge proof includes verification of the accumulator update calculation.

[0043] The cryptographic accumulator continuously incorporates summaries of new transaction records, forming state commitments, such as... Figure 4 As shown. A very large modulus N is disclosed, such as a 2048-bit RSA modulus. Assume that prior to this pig transfer, the latest accumulator value recorded on the blockchain is... Its value is a hexadecimal string 5FA9C3B0, representing a summary of all transactions that have occurred so far.

[0044] When the handover of batch ID PIG20230815A occurs, this ID string is processed using a hash function and mapped to a unique prime number e, for example, 137. This is done through modulo exponentiation... The value of the accumulator is calculated by raising the power of e to the power of N and then taking the modulus of N. The entire calculation process is as follows: Equals 5FA9C3B0 to the power of 137, modulo N. The newly calculated... Value, along with Together with 'e', ​​it is input as public information into the final aggregation proof circuit. The circuit contains corresponding computational logic to verify the correctness of this update calculation, ensuring that each evolution of the state commitment is legal and verifiable.

[0045] In an optional embodiment, recording the verified proof and public input digest in the blockchain ledger includes: The final aggregated zero-knowledge proof, the new state commitment, the digital signature of the current stage master node, and a Unix timestamp are packaged into a JSON object; The JSON object is serialized and submitted to the blockchain network as the payload of a transaction, where it is packaged into a new block by consensus nodes.

[0046] Once a zero-knowledge proof for a given step is successfully generated and verified, it needs to be permanently and immutably recorded. This involves aggregating the proof itself, which is a long string of binary data represented as a hexadecimal string, such as a `proof` field value of 8AE3F1; and then adding the new state commitment. For example, the newStateCommitment field value is 5CB7D9; the digital signature of the slaughterhouse node responsible for this step, such as the signature field value being 4FD9A2; and the precise time the event occurred, such as a Unix timestamp 1692086400. All of the above information is organized into a structured JSON text.

[0047] The JSON text is converted into a single byte stream or string, a process known as serialization. The serialized string is the core payload of this traceability transaction. It is placed into the data fields of a standard blockchain transaction and broadcast throughout the blockchain network. Consensus nodes in the network, such as validators, verify the transaction's legitimacy and include it in a new block. Figure 5 As shown. Once the block is added to the blockchain, this traceability record, containing zero-knowledge proofs and state updates, becomes publicly verifiable, permanently stored, and cannot be unilaterally modified by anyone.

[0048] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

[0049] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0050] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A blockchain-based method for tracing the origin of Xinghua chicken, characterized in that, Includes the following steps: A root public reference string and root verification key are generated through a one-time trusted setup. Based on the traceability hierarchy of the entire life cycle of Xinghua chicken, for each traceability node in breeding, slaughtering, processing, storage, transportation and sales, an independent sub-proof key is generated for each node using a hierarchical key derivation function based on the root public reference string and the node's identity feature vector. The traceability data collected in the traceability process is structured and encoded as the private witness input for the zero-knowledge proof circuit. From the circuit library that defines all legal state transition rules for Xinghua Chicken, select the corresponding zero-knowledge proof circuit according to the current tracing link, and split the private witness input according to the data source. Each data source generates a zero-knowledge proof fragment using its own sub-proof key, the corresponding data subset, and a blinding factor used to hide intermediate states. The master node of the tracing process uses a recursive proof aggregation algorithm to aggregate all proof fragments to generate an aggregated zero-knowledge proof. The aggregation algorithm is used to verify that the common state shared by all proof fragments is consistent and that the sum of the blinding factors used by each fragment satisfies a preset constraint. The generated aggregate zero-knowledge proof is verified using the root verification key and public input, and the verified proof and public input digest are recorded in the blockchain ledger.

2. The method according to claim 1, characterized in that, The common input of the aggregated zero-knowledge proof includes a new state commitment, which is calculated by a cryptographic accumulator based on the accumulator value recorded in the blockchain ledger in the previous stage and the batch handover ID in the current stage.

3. The method according to claim 1, characterized in that, The method of generating independent sub-proof keys for each node using a hierarchical key derivation function includes: The identity feature vector of the node is concatenated with the root common reference string; A deterministic seed is obtained by using the SHA-256 hash function to calculate the concatenated data; The seed is input into the hierarchical key derivation function to derive a dedicated sub-proof key for the node.

4. The method according to claim 1, characterized in that, The step of using structured encoding of the traceability data collected during the traceability process as the private witness input for the zero-knowledge proof circuit includes: The environmental temperature and humidity values ​​are quantified into integers, and / or the feed batch number is converted into an ASCII code sequence, and / or the individual weight is standardized to grams and rounded down, and / or the logistics GPS track is encoded into a latitude and longitude coordinate pair sequence in chronological order, and / or the quarantine image is generated into a 64-bit hash value through a perception hash algorithm. All encoded data are concatenated into a numerical vector in a preset order. If the length of the numerical vector is less than the preset length, zero-padding is used to convert the numerical vector to the preset length. The numerical vector is then used as the private witness input.

5. The method according to claim 1, characterized in that, The process of generating zero-knowledge proof fragments by each data source using its own sub-proof key, corresponding data subset, and blinding factor used to hide intermediate states includes: Each data source generates a 256-bit random number as its blinding factor. In a zero-knowledge proof circuit, the blinding factor is operated on with the variables corresponding to the shared state in the private witness input to generate a blinded commitment to the shared state, and the blinding factor itself is used as a private input of the circuit for constraint.

6. The method according to claim 1, characterized in that, The circuit of the recursive proof aggregation algorithm enforces that the batch ID hash values ​​referenced by all proof fragments are consistent, and the blinding factors used by all proof fragments sum to zero over a preset finite field. This makes the hiding effect of intermediate states canceled out in the final aggregated proof, allowing the real shared state transitions to be verified within the circuit.

7. The method according to claim 2, characterized in that, The new state commitment is calculated by the cryptographic accumulator based on the accumulator value recorded in the blockchain ledger in the previous stage and the batch handover ID in the current stage, including: It employs an RSA-based cryptographic accumulator and pre-determines a publicly available modulus N; The accumulator value already recorded in the blockchain ledger in the previous step will be used as the old state commitment. ; Map the batch handover ID of the current stage to a value e using a hash function; Through formula The new state commitment is calculated. The new state commitment As one of the common inputs to the aggregated zero-knowledge proof, the circuitry of the aggregated zero-knowledge proof includes verification of the accumulator update calculation.

8. The method according to claim 2, characterized in that, The process of recording the verified proof and public input digest in the blockchain ledger includes: The final aggregated zero-knowledge proof, the new state commitment, the digital signature of the current stage master node, and a Unix timestamp are packaged into a JSON object; The JSON object is serialized and submitted to the blockchain network as the payload of a transaction, where it is packaged into a new block by consensus nodes.

9. A blockchain-based traceability system for Xinghua chicken, characterized in that, Includes the following modules: The sub-proof key generation module is used to generate the root public reference string and root verification key through a one-time trusted setting; based on the traceability hierarchy of the entire life cycle of Xinghua chicken, for each traceability node of breeding, slaughtering, processing, storage, transportation and sales, based on the root public reference string and the identity feature vector of the node, a hierarchical key derivation function is used to generate independent sub-proof keys for each node; the traceability data collected in the traceability process is structured and encoded as the private witness input of the zero-knowledge proof circuit; The zero-knowledge proof fragmentation generation and aggregation module is used to select the corresponding zero-knowledge proof circuit from the circuit library that defines all legal state transition rules of Xinghua Chicken, according to the current traceability link, and split the private witness input according to the data source. Each data source generates a zero-knowledge proof fragment using its own sub-proof key, the corresponding data subset, and a blinding factor used to hide intermediate states. The master node of the tracing process uses a recursive proof aggregation algorithm to aggregate all proof fragments to generate an aggregated zero-knowledge proof. The aggregation algorithm is used to verify that the common state shared by all proof fragments is consistent and that the sum of the blinding factors used by each fragment satisfies a preset constraint. The verification module is used to verify the generated aggregate zero-knowledge proof using the root verification key and public input, and to record the verified proof and public input digest in the blockchain ledger.

10. The system according to claim 9, characterized in that, The common input of the aggregated zero-knowledge proof includes a new state commitment, which is calculated by a cryptographic accumulator based on the accumulator value recorded in the blockchain ledger in the previous stage and the batch handover ID in the current stage.

Images