Arithmetic enhancement of C-like smart contracts for verifiable computations

Abstract

A system and method are provided for converting high-level source code into arithmetic circuitry representing functions expressed in the source code. The invention includes a translation / interpretation component for performing the conversion. In a preferred embodiment, the source code is a smart contract, such as a contract used in connection with a blockchain platform. A method according to an embodiment includes the steps of processing a portion of a high-level source code (e.g., a smart contract) to generate an arithmetic circuit. The arithmetic circuit includes one or more arithmetic gates arranged to represent at least some of the functions expressed in the source code. The processing involves evaluating one or more constants provided in the source code to generate one or more expressions containing Boolean and / or arithmetic operators. The arithmetic circuit includes an n-bit line connected to the arithmetic gate; it may be used to provide hardware and / or software circuitry. The arithmetic circuitry may be used to generate quadratic plans that may be executed on the processor.

Description

[0001] This application is a divisional application of Chinese application number 201880072692.7 (PCT international application number PCT / IB2018 / 058437), filed on October 29, 2018, entitled "Arithmetic Enhancement for C-like Smart Contracts with Verifiable Computability". Technical Field

[0002] This invention generally relates to the field of tools, techniques, and systems for transforming high-level source code into another form, such as interpreters. The invention also relates to blockchain technology, and more particularly to tools for building solutions for blockchain implementations. Furthermore, the invention relates to improved next-generation machine-executable technologies, such as smart contracts configured to execute on a blockchain. Background Technology

[0003] In this article, the term "blockchain" refers to any of several types of computer-based electronic distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and their variations. It also includes private blockchains and public blockchains.

[0004] It should be noted that this invention is not limited to any particular implementation or variant of a particular blockchain or related protocol, and alternative blockchain implementations and protocols fall within the scope of this invention.

[0005] A blockchain is a peer-to-peer electronic ledger implemented as a decentralized, computer-based system composed of blocks, which in turn are transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system and includes at least one input and at least one output. Each block contains the hash of the previous block, linking these blocks together to create a permanent, immutable record of all transactions written to the blockchain since its inception.

[0006] Some blockchain scripting languages ​​(called Scripts) are stack-based. Items can be pushed onto or popped from the top of the stack. For example, the OP_EQUAL operation pops the top two items from the stack, compares them, and then pushes the result (e.g., 1 if they are equal, 0 if they are not equal) onto the top of the stack. In some scripting languages ​​used in this implementation, there may be at least two stacks: a main stack and a backup stack.

[0007] For a transaction to be written to the blockchain, it must be "validated." Network nodes (such as mining nodes) work to ensure that every transaction is valid, and invalid transactions are rejected from the network. A node can have a different validity criterion than other nodes. Since validity in the blockchain is based on consensus, a transaction is considered valid if a majority of nodes agree that it is valid. Software clients installed on the nodes partially perform this validation work on transactions referencing Unspent Transaction (UTXO) by executing Unspent Transaction (UTXO) locking and unlocking scripts. If the execution of the locking and unlocking scripts evaluates to TRUE and other validation conditions (where applicable) are met, the transaction is validated by the node. Validated transactions are then propagated to other network nodes, which can then choose to include the transaction in the blockchain.

[0008] Therefore, in order for a transaction to be written into the blockchain, it must i) be verified by the first node receiving the transaction—if the transaction is verified, the node relays it to other nodes in the network; ii) be added to a new block constructed by the network nodes; and iii) be mined, i.e., added to the public ledger of past transactions. A transaction is considered confirmed when a sufficient number of blocks are added to the blockchain to make it practically irreversible.

[0009] Digital entrepreneurs have begun exploring the use of both cryptographic security systems and data that can be stored on blockchains to create new systems. This would be highly advantageous if blockchain could be used to automate tasks and processes. Such solutions would be able to leverage the benefits of blockchain (e.g., event permanence, tamper-proof records, distributed processing, etc.) while being more versatile in their applications.

[0010] One area of ​​current research is using blockchain to implement "smart contracts." These are computer programs designed to automate the execution of the terms of machine-readable contracts or agreements. Unlike traditional contracts written in natural language, smart contracts are machine-executable programs that contain rules that process input to produce results, which in turn prompt actions to be performed.

[0011] In implementation, a smart contract is "smart" in the sense that its enforcement and / or execution does not require a creator or some other specific entity. Execution or enforcement does not require human interaction. That is, while interactions with specific entities can be encoded in specific steps within a smart contract, the contract can also additionally execute automatically and self-execute. Smart contracts are machine-readable and executable. In some examples, automatic execution refers to any entity capable of consuming a UTXO and having an incentive to do so. Note that in such examples, "any entity capable of consuming a UTXO" means an entity capable of creating an unlocking script without proving knowledge of some private information. In other words, the consumption transaction can be verified without proving that the data source has access to encrypted private information (e.g., private asymmetric keys, symmetric keys, etc.). Additionally, in such examples, self-execution refers to causing the validating nodes of the blockchain network to enforce the consumption transaction according to constraints. In some examples, "consuming" a UTXO means creating such a consumption transaction that references the UTXO and executes it when valid.

[0012] Therefore, beyond its simple use as a payment tool, blockchain technology has attracted considerable interest in its potential applications. These include the control of IoT devices and intelligent systems incorporating AI technology.

[0013] However, despite the large number of skilled programmers using high-level languages ​​such as C, C++, Java, etc., the number of people capable of creating applications for blockchains is relatively small. This is partly because blockchains currently require coding at a relatively low level using op_code that manipulates the main and alt stacks. In particular, programming smart contracts for blockchain implementations is notoriously difficult and error-prone—as explored in the following literature: Delmolino, K. et al., (2015), Step by Step Towards Creating a Safe Smart Contract: Lessons and Insights from a Cryptocurrency Lab; and Juels, A. et al., (2013), The Ring of Gyges: Using Smart Contracts for Crime.

[0014] An improved blockchain and related platform can be provided by enabling the creation of solutions and applications that can be used in conjunction with blockchain. A solution for computational arithmetic gates is also provided. Arithmetic circuits can be configured to execute or perform predicates. This invention enables the creation and encoding of executable programs (as opposed to those disclosed in the prior art that merely provide proof or demonstration). Summary of the Invention

[0015] Therefore, it is desirable to provide a method and system that improves blockchain and distributed computing technologies in one or more aspects. Such an improved solution has now been designed. Therefore, according to the present invention, a method and system as defined in the appended claims are provided.

[0016] This invention may include systems and methods configured to provide and facilitate programmability in decentralized systems. For example, it may be a cryptocurrency system, a blockchain-implemented system, and / or a distributed computing system. From one perspective, it reduces the errors, time, effort, cost, and resources required during the programming process. Therefore, it provides a technical solution to the technical problem. From another perspective, because it reduces errors and defects, it provides an enhanced blockchain solution. It also preserves software integrity.

[0017] Advantageously, unlike known interpreters and compilers, this invention provides an architecture-independent solution. Furthermore, it does not require the use of a virtual machine (VM) for execution.

[0018] This invention provides a computer-implemented system and method that takes source code as input and generates an arithmetic circuit C. The resulting circuit C can represent the functionality of the HLL source code (as opposed to a proof used for verification). Upon execution, the arithmetic circuit C can provide a calculation result, which can then be verified. The circuit C can be machine-executable or processed to be executed on a machine. The source code can express or represent a computation.

[0019] The circuit may include a "wire" that carries information from the field. The values ​​are connected to addition and multiplication gates. Arithmetic circuits can be implemented in software and / or as physical circuits with wires and logic gates. Source code may include or represent functions or calculations written in HLL or GPL. Some or all of the above. The present invention can be described as an interpreter for converting the computation into an arithmetic circuit C. The arithmetic circuit C and some inputs x can be provided to the entity for execution.

[0020] This invention can convert or translate computations represented in source code into predicates that can be executed (by a machine / processor). (HLL / GPL) source code can be precompiled or preprocessed.

[0021] In one or more implementations, a public evaluation key EK and a public verification key VK can be derived using a private value s. The method may include the steps of: evaluating computations on a specific input x using EK and VK. The output y, the values ​​of one or more circuit wires, and EK can be used to generate a correctness proof π. The proof π may be stored on a blockchain. It may be stored in a blockchain transaction. The method may include the step of: providing the proof in a blockchain transaction. It may include the steps of: submitting the transaction to the blockchain and / or storing it on the blockchain.

[0022] The present invention provides a computer-implemented method comprising the following steps: processing a portion of source code to generate an arithmetic circuit, wherein: the source code is written in a high-level programming language; and, the arithmetic circuit includes one or more arithmetic gates, the one or more arithmetic gates being configured to represent some or all of the functions expressed in the source code; wherein, the arithmetic circuit includes n-bit wires connected to the arithmetic gates; and wherein, the outputs of one or more circuit wires and a public evaluation key EK are used to generate a proof of correctness.

[0023] Optionally, the proof of correctness is stored on a blockchain.

[0024] Optionally, the public evaluation key EK is obtained using a secret value.

[0025] Optionally, the secret value can be used to obtain the public verification key.

[0026] This method may include the step of verifying a proof stored on a blockchain. This proof can be verified by one or more parties. Advantageously, it can be verified by multiple parties without requiring the proving party to interact separately with each party. This provides a more efficient and faster solution compared to existing technologies.

[0027] All nodes or some nodes in a blockchain network can verify a transaction. Verification can be performed using the public verification key VK and the proof π, thereby verifying the smart contract.

[0028] The advantage of this invention lies in the fact that network nodes (e.g., mining nodes) verify transactions according to known conventional blockchain protocols. The verification process is part of the role of the network nodes (e.g., mining nodes) within the network. Therefore, this invention can technically advantageously utilize the efforts made by the nodes, as verification is performed as part of the required existing operation. This provides an efficient arrangement compared to existing technologies.

[0029] In some implementations, such as Figure 1 As shown, the present invention can form part of a workflow from smart contracts encoded in DSL to quadratic arithmetic program (QAP).

[0030] like Figure 2 As shown, Domain-Specific Language (DSL) smart contracts can be converted into high-level language contracts. DSL smart contracts can be written in a formal language with precise semantics. A DSL smart contract can include a set of conditions. The outcome of a DSL smart contract can depend on the satisfaction of a set of conditions.

[0031] The HLL preprocessor (also known as a preprocessor) can merge external libraries referenced by HLL contracts to generate preprocessed HLL contracts. The HLL preprocessor in... Figure 2 In this context, it can be called a C pre-compiler. HLL contracts are... Figure 2 This can be referred to as a C language contract.

[0032] Then, according to an embodiment of the invention, the HLL preprocessing contract (i.e., source code) can be converted into an arithmetic circuit. This arithmetic circuit can be optimized to produce a simplified arithmetic circuit from which the QAP polynomial is derived.

[0033] Preprocessing conversion can be performed by software programs ( Figure 2 The program (called a C pre-compiler) executes, and as a result of this execution, the software program receives a set of conditions (e.g., a DSL smart contract written in DSL) and translates the DSL code into HLL source code, such as an HLL contract. Figure 2 In this context, this can be referred to as a "C language preprocessor contract." It can also be simply called "source code." An HLL contract can be an HLL program containing contracts defined in a DSL smart contract, such as a C++ program. An HLL preprocessor can be a computer executable program that processes the HLL contract and the required external libraries to generate a standalone HLL preprocessor contract (i.e., source code).

[0034] External libraries can be collections of pre-written subroutines, functions, classes, containers, value and / or variable types that HLL contracts use by calling. For example, by calling an external library, an HLL contract can obtain the functionality of that library without implementing the functionality itself. HLL preprocessor contracts can contain a set of expressions and operators. Operators can include arithmetic operators (e.g., addition (+), multiplication (*), etc.), comparison operators (e.g., less than (<), equal to (==), greater than or equal to (>=), etc.), conditional statements (e.g., if-then(?, :)), or logical operators (e.g., AND(&&), OR(||), NOT(!), XOR(⊕), etc.). In some implementations, the main function (entry point) has a predefined name and format.

[0035] Arithmetic circuits can be directed acyclic graphs (DAGs) over a set of variables. Each node in the DAG with an in-degree of zero can represent a variable (e.g., x). iThe input gates of the DAG are called gates, and each other node in the DAG can be a summation gate (+) or a product gate (×). Each gate (node) can have an out-degree of 1, so the base graph can be a directed tree. Arithmetic circuits can have two complexity measures: size and depth. In some examples, the "size" of an arithmetic circuit can be based on the number of gates within the circuit. In some examples, the "depth" of an arithmetic circuit can be based on the length of the longest directed path within the circuit.

[0036] After generating the arithmetic circuit, the circuit can be reduced in size.

[0037] The computer-implemented method according to the present invention may include the following steps: processing a portion of source code to generate an (executable) arithmetic circuit. The source code may be written in a high-level programming language; and the arithmetic circuit may include one or more arithmetic gates configured to represent some function or computation expressed in the source code.

[0038] This is contrary to compilers and interpreters known in the prior art, which do not translate HLL source code into arithmetic circuits.

[0039] Arithmetic circuits can be executed on a processor. These circuits can be incorporated into blockchain transactions.

[0040] This contrasts with prior art disclosures that teach the verification of computational or logic circuits and / or produce outputs that result in (zero-knowledge) proofs. For example, the Pinocchio system generates a zero-knowledge proof to verify general computation – “Communications of the ACM”; Vol. 59, No. 2; 2016 Parno B et al.; “Pinocchio: Nearly Practical Verifiable Computations”; 103-112 (Parno). Therefore, prior art verification systems such as Pinocchio can be used in conjunction with this invention for verification, which provides functionality and results beyond those of the prior art.

[0041] Therefore, the present invention provides machine-executable output representing and / or providing computation. This can then be verified. This contrasts, for example, with the Pinocchio system, which compiles verification scripts to verify a (separate) program set up to perform computation, thus comprising a two-part process. Instead, the present invention uses a single-part approach, compiling the high-level computation itself into arithmetic circuitry. Thus, the present invention solves a different technical problem using a very different approach from this prior art.

[0042] Preferably, the source code is a smart contract. The source code can be preprocessed as described above.

[0043] Preferably, the processing steps include the following sub-step: evaluating one or more constants provided in the source code. This can provide one or more expressions containing Boolean operators and / or arithmetic operators.

[0044] The method may further include the following steps: providing hardware and / or software circuitry using arithmetic circuitry. The arithmetic circuitry may include n-bit wires connected to arithmetic gates. The arithmetic circuitry is architecture-independent; that is, it is not configured to operate or be used with a specific hardware or software architecture or platform. It does not require the use of a virtual machine. This contrasts with prior art compilers and interpreters, which are either architecture-specific or require the use of virtual machines.

[0045] The method may further include the step of preprocessing the source code to determine one or more constants. Preprocessing may include one or more of the following steps:

[0046] Remove comments; import header declarations from the header file into the source file;

[0047] Merge multiple source files;

[0048] Process or evaluate instructions and macros.

[0049] The method may also include the following steps: detecting all global variables declared in the source code, wherein the global variables are related to functions, structures or classes, constants and / or entry points of execution.

[0050] The method may further include the step of generating a symbol (identifier) ​​table to associate each symbol (i.e., identifier) ​​provided in the source code with declaration information provided in the source code. The symbols in the table are global and / or local symbols.

[0051] The method may further include the following steps: evaluating the source code line by line to obtain an arithmetic and / or logical expression, which represents one or more output variables as a combination of logical and / or arithmetic operations applied to one or more input variables.

[0052] This may also include the following steps: decoding the type; decoding the expression; evaluating the expression; and / or allocating memory for the data structures required for the function.

[0053] The method may further include the following steps: mapping arithmetic and / or logical operations of the expression to arithmetic gates. This mapping step may include the following sub-steps: performing wire expansion; and / or performing wire compression.

[0054] The method may further include the step of: using arithmetic circuitry to generate a quadratic program comprising a set of polynomials, the set of polynomials providing a description of the circuitry. The method may further include the step of: providing the quadratic program to an entity to perform the quadratic program using one or more inputs.

[0055] The present invention may also provide a system arranged to implement or perform any of the foregoing method steps. This system may include a translation or conversion component (i.e., an interpreter / compiler) configured to perform processing of source code. While compilers for generating (zero-knowledge) proofs are known in the prior art (e.g., see “Pinocchio: Nearly Practical Verifiable Computations” (Parno) cited above), these do not compile into arithmetic circuits as described in this invention. The present invention generates answers rather than proving or verifying answers.

[0056] A computer-implemented system, comprising:

[0057] Processor; and

[0058] The memory includes executable instructions, which, as a result of execution by a processor, cause the system to perform any computer-implemented implementation of one or more embodiments of the invention described herein and claimed. The instructions may include: instructions for providing a translation or conversion component (i.e., an interpreter / compiler) configured to perform processing of source code.

[0059] A non-transitory computer-readable storage medium having stored executable instructions thereon, which, as the result of execution by a processor of a computer system, cause the computer system to perform at least one or more embodiments of the invention / method described herein or claimed. Attached Figure Description

[0060] These and other aspects of the invention will become apparent from the embodiments described herein, and will be explained with reference to the embodiments described herein. Embodiments of the invention will now be described by way of example only with reference to the accompanying drawings, in which:

[0061] Figure 1 The illustration shows a protocol for verifiable computation and participants involved in exemplary uses and implementations of the present invention. These participants are: the client, the worker (also referred to as the “provider”), and the verifyer.

[0062] Figure 2 The process of converting a DSL contract to quadratic arithmetic programming (QAP) according to an embodiment of the present invention is illustrated.

[0063] Figure 3 An example of an arithmetic circuit according to an embodiment of the present invention is shown.

[0064] Figure 4 A high-level description of a data packet (header + body) containing circuit representation according to an embodiment of the present invention is shown.

[0065] Figure 5 An implementation of a 4-bit line expander is shown in the example described below, which represents the statement "Check variable". Is it an even number?

[0066] Figure 6 A construction block according to an exemplary embodiment of the present invention is shown, wherein the construction block implements conditional statements.

[0067] Figure 7 This illustrates how a constant generator module according to an embodiment of the invention can be responsible for creating constants used by arithmetic circuits. In the example used, three constants (C1, C2, and C3) are generated along with default values ​​of one (1) and zero (0).

[0068] Figure 8 This is a schematic diagram illustrating a computing environment in which various implementation methods can be carried out. Detailed Implementation

[0069] summary

[0070] The invention will now be described in one embodiment. In this example, a possible implementation is described as an interpreter configured to translate a high-level language contract (e.g., C / C++) into a circuit including arithmetic gates. However, the invention can be configured to translate other high-level languages. Specific constructs or building blocks can be used to facilitate this conversion. In one or more embodiments, this representation can be viewed as a first step in constructing a comprehensive pipeline capable of providing distributed, verifiable computation.

[0071] The building blocks presented in this example are not intended to be an exhaustive list of all possible high-level language constructs addressed as embodiments of the present invention. Furthermore, alternative implementations of the presented example may be provided. These are all within the scope of those skilled in the art.

[0072] Exemplary embodiments of the invention are now provided. However, it is important to note that these are examples of applications in which the invention can be used. Those skilled in the art will understand that the invention can be advantageously used in other contexts and applications. The invention is not limited to uses related to smart contracts or financial instruments.

[0073] Exemplary embodiments and example use cases of the present invention

[0074] For our example, consider the following protocol that allows users to generate contracts for financial instruments using a domain-specific language (DSL). Once the contract is generated, its execution can be outsourced to untrusted parties (referred to as "workers" or "proof-provers"), while its correctness can be publicly verified. This protocol utilizes cryptographic primitives that ensure:

[0075] • Integrity, meaning that if the protocol is followed correctly, the honest authenticating party will be confident in the validity of the output;

[0076] • Reliability (soundness): The cheating prover cannot convince the honest prover of the authenticity of its output.

[0077] • Zero knowledge means that the party that is cheating cannot learn any information other than the validity of the output.

[0078] The main benefits of this agreement are:

[0079] • Since no communication between the participants is required, man-in-the-middle attacks can be prevented.

[0080] Because of the use of blockchain technology, it is difficult for malicious nodes to tamper with the data.

[0081] • Avoid trusted third parties, such as trusted hardware devices.

[0082] Contract verification does not mean code re-execution. Computation is not copied to every node in the network. Instead, evidence of honest execution is stored on the public blockchain and used solely for verification purposes.

[0083] Such a system would be able to handle various types of smart contracts corresponding to a wide range of tasks and products, and would not be limited to financial applications or uses. Due to its decentralized and distributed nature, blockchain provides a suitable environment for reaching agreements between two or more parties.

[0084] Such systems require the provision and facilitation of programmability within decentralized systems. However, it has been recognized in the art that smart contract programming is an error-prone process. See Delmolino, K. et al., (2015), Step by StepTowards Creating a Safe Smart Contract: Lessons and Insights from a Cryptocurrency Lab, and Juels, A. et al., (2013), The Ring of Gyges: Using Smart Contracts for Crime.

[0085] Therefore, the ability to use a DSL is advantageous, as it makes smart contracts easier for programmers to write and read, thereby reducing errors and minimizing the time, effort, cost, and resources required for programming. Ideally, non-professional programmers should be able to write contracts without performing any encryption. Alternatively, the compiler / interpreter will automatically compile the source code into a cryptographic protocol between the user and the blockchain. These are the technical problems addressed by this invention. Existing technologies do not offer such advantages for verification and proof generation.

[0086] This framework employs state-of-the-art cryptographically verifiable computation (see Gennaro, R. et al. (2013), Quadratic Span Programs and Succint NIZKs without PCPs) and ensures correct functional evaluation: due to the use of verifiable computation, adversaries with access to sensitive information cannot manipulate the results. The model leverages blockchain technology to store proofs of correctness and combines a “correct by construction” cryptographic approach with smart contracts.

[0087] In this example, the focus is on the implementation of a translation component capable of converting high-level language contracts (e.g., C / C++) into circuits comprising arithmetic gates. The resulting circuit is a machine-executable representation of HLL source code (as opposed to a proof used for verification purposes). Specific structures or building blocks are used to facilitate this conversion. In our example, the invention can be used to provide the first step in constructing a pipeline arranged to implement a distributed verifiable computing system. However, it should be noted that the invention is again not limited to this use case and can function in a wider range of applications and environments.

[0088] To describe exemplary implementations, we provide an overview of a framework for verifiable computation, followed by a circuit representation of a smart contract according to the present invention.

[0089] Exemplary use: Verifiable computation: framework

[0090] Problem Statement. A client sends a specification of P and input x to an untrusted proving party (the worker). The worker computes the output y and returns it to the client. If y = P(x), a correct proving party should be able to produce a proof of correctness that convinces anyone (not just the client) of the correctness of y. Otherwise, the proving party should be highly likely to reject y.

[0091] The protocol should be cheaper for the verifying party than to execute P(x) locally, or the protocol should handle computations of P that the verifying party cannot perform on its own. Furthermore, there is no need to assume the correctness of the worker's behavior.

[0092] Data Access. The system contains two distinct decentralized databases: (i) DHT – off-chain data is stored in DHT. Data is fully randomized and replicated across nodes to ensure high availability; and (ii) Public Ledger – evidence of correct execution is stored on the blockchain and can be audited.

[0093] Agreement. The steps required for the agreement are as follows: Figure 1 As shown. The computation of P is represented by circuit C. The client provides input x, the worker executes circuit C on input x, and claims the output y. It is expected that the prover obtains a copy of {C, x, y}. A valid copy of {C, x, y} is the assignment of values ​​to the circuit wires, thus:

[0094] The value assigned to the input wire is the value of x;

[0095] The intermediate value corresponds to the correct operation of each gate in C;

[0096] The value assigned to the output wire

[0097] If the claimed output is incorrect, i.e. Then it does not exist. A valid copy.

[0098] The setup phase involves writing contracts using a formal language with precise semantics. According to the invention, the interpreter takes the source code as input and produces an arithmetic circuit C, which includes components with data from fields... The values ​​are connected to the wires of the addition and multiplication gates. In some implementations, arithmetic circuit optimization techniques, such as those described in UK Patent Application No. 1718505.9, can be used to reduce the resources required to determine the results of a smart contract.

[0099] The system generates a quadratic program Q from circuit C, where Q contains a set of polynomials that provide a complete description of the original circuit C. Then, it generates common parameters used by all provers and verifiers.

[0100] The public evaluation key EK and public verification key VK are derived using a private value s chosen by the client. The working parties use this public information to evaluate computations performed on a specific input x. The output y, the values ​​of the internal circuit wires, and EK are used to generate a correctness proof π. Proof π can be stored on the blockchain and verified by multiple parties without requiring the proving parties to interact separately with each of these entities.

[0101] All blockchain nodes can use the public verification key VK and the proof π to verify payment transactions, thereby verifying the contract.

[0102] Smart contracts and circuit representation

[0103] While domain-specific languages ​​(DSLs) are required to implement smart contracts, such as the Actulus Modeling Language (AML), Digital Asset Modeling Language (DAML), and Financial Product Markup Language (FpML), for the sake of illustration, we describe here the use of a more general language that provides a wider range of types, operators, and structures, such as a high-level language (HLL) like C. However, the invention can also be configured to use specialized tools to translate different DSL languages ​​into C (or other HLLs).

[0104] In the examples used in this article, the interpreter processes source code written in the C language. This invention can be adapted for use with other high-level languages ​​(also referred to as “General-Purpose Languages” (GPL)). Examples of general-purpose programming languages ​​include Ada, ALGOL, assembly language, BASIC, Boo, C, C++, C#, Clojure, COBOL, Crystal, D, Dart, Elixir, Erlang, F#, Fortran, Go, Harbour, Haskell, Idris, Java, JavaScript, Julia, Lisp, Lua, Modula-2, NPL, Oberon, Objective-C, Pascal, Perl, PHP, Pike, PL / I, Python, Ring, RPG, Ruby, Rust, Scala, Simula, Swift, and Tcl.

[0105] exist Figure 2 The diagram illustrates a comprehensive pipeline for translating a high-level language into logic circuits. According to the present invention, the focus is on... Figure 2 The module highlighted in the dashed box.

[0106] The high-level C program containing the contract and the necessary external libraries are linked together to form a separate preprocessor contract. At this stage, the C preprocessor is responsible for checking that all required resources are available. Preprocessor directives are also evaluated.

[0107] • Evaluate constant expressions and register all symbols. The result is an expression with a set of C-like operators, such as addition (+), multiplication (*), comparison (<), equality (==), conditional statements (?, :), and logical operators (and, or, not, xor). We require the main function to have a predefined name and format. Arithmetic circuits (see...) Figure 3 () is constructed by using n-bit wires connected to basic arithmetic gates (such as addition and multiplication) to represent symbols.

[0108] • The polynomial in quadratic arithmetic programming (QAP) is defined based on its evaluation at the root of the arithmetic circuit, as described in Gennaro, R. et al. (2013) in Quadratic Span Programs and Succinct NIZKs Without PCPs.

[0109] Figure 3 An example of an arithmetic circuit is shown. Each wire comes from field F, and all operations are performed on field F. The circuit calculates y = x1 + x2·x3·(x3 + x4). Since the final output of the circuit is a sum, an additional multiplication gate (multiplying by a constant 1) is required.

[0110] C language interpreter

[0111] According to an exemplary embodiment of the present invention, an interpreter is now described that is capable of recognizing a subset of instructions defined in the C programming language, including: preprocessor instructions, conditional statements, arithmetic and bitwise Boolean operators, and global functions. As will be readily understood by those skilled in the art, support for arrays and structures can also be provided without additional logic.

[0112] The interpreter uses the multiplication, addition, and specific building blocks presented in the section titled "Generation of Arithmetic Primitives" below to enhance expressions into an arithmetic gate language. Each wire will have a specified bit width. In the case of a 1-bit width, the wire represents a binary variable.

[0113] Arithmetic enhancements to C-like programs for implementation on the blockchain

[0114] The process of constructing an arithmetic circuit, representing a function expressed by C source code, will now be described in detail. At each stage of this process, unexpected behavior (e.g., missing symbols, incorrect syntax, or unknown operators) will cause the program execution to terminate immediately with an appropriate code error.

[0115] Preprocessing

[0116] like Figure 2 As shown, a smart contract can contain multiple files and libraries. The first step of the protocol involves creating a single source file containing the complete set of instructions required to implement the contract. The individual sub-steps can be listed below:

[0117] All comments have been removed.

[0118] • Header declarations are imported from header files into source files.

[0119] • All source files were merged.

[0120] • Processes or evaluates preprocessor C directives and macros. These include #define directives and conditional #ifdef directives.

[0121] At the end of this step, the actual values ​​of all preprocessor constants must be known. The values ​​of variables used in the source code must depend solely on the values ​​of the contract's inputs. Furthermore, the declaration of entry points in the source code must have the following syntax:

[0122] void contract(inputType*in,outputType*out)

[0123] The inputType and outputType types are user-defined. The source code box below shows a simple example of a smart contract that contains a single summation operation between two unsigned integer inputs.

[0124]

[0125] Depending on the specific contract, the output can be represented by variables of different types. In the case above, a single output is only connected to the result of an arithmetic operation.

[0126] Integers and real numbers

[0127] In this exemplary implementation, for simplicity, it is assumed that only operations between integers (signed or unsigned) are feasible. If this assumption were removed, the circuit building blocks would have to be expanded (see the "Generation of Arithmetic Primitives" section). Therefore, operations between real numbers must be converted to operations between integers. Consider the following part of a contract: "Check if the average salary of the employees is greater than $32.5K."

[0128] This statement requires division (by N employees) to calculate the average. However, the statement can be transformed into the following expression between integers:

[0129]

[0130] Where s i Let represent the salary of the i-th employee.

[0131] Create a global symbol table

[0132] In computer science, a symbol table is a data structure used by a compiler / interpreter to associate each identifier (symbol) in the source code with information related to its declaration. In this second step, the interpreter examines all global symbols declared in the source file:

[0133] ·function

[0134] • Structure (or class)

[0135] Note: Using classes (in OOP languages ​​such as C++) requires additional logic to check the scope of public, protected, and private parts.

[0136] ·constant

[0137] (Global variables can also be used, but it is not recommended. The scope of the contract(...) function should be treated as an independent black box. Its behavior should not depend on external variables.)

[0138] For each of these symbols, a hierarchy of local symbols representing the internal declarations of their identifiers is established. At the end of this stage, each global symbol (name, type, and value) in the table can be directly addressed for further processing.

[0139] Detect the entry point of the contract

[0140] One of the global symbols must be the entry point of the contract (the contract function in the "preprocessing" section). Its parameters' names, numbers, and types are checked against the expected syntax. Additional logic can primarily check that all input structures are used within the contract and that all output structures are linked to some part of the contract.

[0141] Line-by-line assessment

[0142] Each line of code is analyzed independently. Local symbols representing declarations within identifiers are contained within the hierarchy of the global symbol table. More specifically, this phase is responsible for the following tasks:

[0143] • Type decoding, including the declaration of structures and arrays, basic types (boolean, integer, etc.) and pointers.

[0144] • Decoding of expressions, such as unary or binary operations, constants, identifiers, data structures, and function calls.

[0145] • Evaluation of expressions, i.e., evaluation of (numerical) expressions that do not depend on input values.

[0146] • Memory allocation, which refers to the temporary storage allocation of data structures required by contract functions.

[0147] This stage links all statements of an arithmetic expression together from both spatial (i.e., memory usage) and temporal (i.e., operator precedence) perspectives. Therefore, each output variable is expressed as a combination of logical and arithmetic operations applied to the input variables.

[0148] Creating explicit arithmetic expressions

[0149] Using the data structures defined in the "line-by-line" section, the general arithmetic / logical expression 'e' is collapsed so that it can be expressed explicitly according to the following syntax:

[0150] OP N (OP N-1 (…(OP1(OP0))…))

[0151] According to this syntax, in the operator OP i Then, any operator OP i+1 Applied to e.

[0152] For example, given the following code:

[0153]

[0154] The explicit expression e can be represented as:

[0155] out0=(?(<15(ADD(ADD(ADD in0 in1)in0)in1))50(MUL(MUL in0 in1)in1))

[0156] As described in the section on “Generation of Arithmetic Primitives”, the expression e is used to create the arithmetic primitives required to represent contract functions.

[0157] Generation of arithmetic primitives

[0158] At this stage, the interpreter is ready to make a one-to-one mapping between the operations used to generate expression e and the structures required to implement these functions on the circuit.

[0159] One important parameter required for creating a circuit is the bit width n. bit n is the number of bits used to represent a signed (or unsigned) integer. Different computer architectures use different n values. bit The value is used to represent this. If the client does not know the preferred bit width value of the operator, it can arbitrarily select and specify its value and other information in the header of the circuit, such as... Figure 4 As shown. (Similar to compiling for a specific target architecture, knowing the bit width value can lead to more efficient implementation and execution of the circuit.)

[0160] The version field provides crucial information about the specific algorithm used to create a particular building block in the circuit. In the exemplary implementation, a two-complement binary representation of a signed integer is chosen.

[0161] addition and multiplication operations

[0162] Addition and multiplication operations are mapped one-to-one to addition and multiplication gates in a circuit. Given two n-bit wire inputs, the addition wire output requires n+1 bits, and the multiplication wire output requires 2n bits. For example, two n... bit The multiplication between wires a and b can be expressed as:

[0163] MUL[id a id b TO[id] c ]

[0164] (Each arithmetic or Boolean wire x in the circuit can be accessed via the value id) x Unique identifier. (For binary variables, counting starts from value 0). The result c will automatically be incremented by 2^n. bit Bit representation.

[0165] Boolean operations

[0166] The entire set of Boolean gates can be computed using arithmetic gates. Given two Boolean values ​​a and b, the following equivalents are valid:

[0167] AND(a, b) = ab

[0168] ·NAND(a, b) = 1 - ab

[0169] OR(a, b) = 1 - (1 - a)(1 - b)

[0170] ·NOR(a, b)=(1-a)(1-b)

[0171] XOR(a, b) = (1-a)b + (1-b)a

[0172] Except for the XOR operator, each Boolean gate requires only one multiplication. All arithmetic operations are performed on a 1-bit wide wire.

[0173] Performing bitwise Boolean operations on an n-bit wide input requires n 1-bit multiplications (for AND) or additions (for OR). Starting with the least significant output bit, each element is multiplied by 2 and added to the next element to produce an n-bit integer value as the result (see the "Wire Compression" section).

[0174] Wire extension

[0175] Wire extension is often used to convert arithmetic wire a to n. a Bit output wire, where n a It is the base-2 logarithm of the maximum value that can be expressed in terms of 'a'. For example, consider the following part of the contract:

[0176] "Check if variable" is even (check variables) Is it an even number?

[0177] If n a If the value is 4, then the statement can be implemented using wire extension, such as... Figure 5 As shown. Assuming a0 represents the least significant bit of a, then the output of this statement is equal to a0 itself. This circuit block can be represented as:

[0178] EXPAND[id a TO[id] a3 id a2 id a1 id a0 [id] a [id] a3 id a2 id a1 id a0 ])

[0179] A closer look at the circuit reveals that only one bit of 'a' needs further processing, while the remaining one-bit wires can be removed. The interpreter can generate only the individual one-bit wires used in the rest of the contract. Figure 5 This shows an implementation of a 4-bit wire extender, which represents the statement "Check if variable is even (check variables) Is it an even number?

[0180] The interpreter applies a specific syntax to the optimized wire expander:

[0181] EXPAND[id a TO[0->id] a0 [id] a [] Expanded to [0->id] a0 ])

[0182] That is, only the least significant 1 bit is used (i.e., the identifier number is zero), and the identifier id is... a0 Assign it. a The larger the value, the more efficient the optimization may be. (In this context, optimization is defined as the possibility of saving space to store or transmit low-level instructions used to represent arithmetic circuits.)

[0183] wire compression

[0184] Wire compression is used to compress 1-bit wire a i Combination return n a Bit output wire:

[0185]

[0186] This building block includes constant addition and multiplication, so the size of the QAP polynomial remains unaffected (see Genaro R. et al. (2013) Quadratic Span Programs and Succinct NIZKs Without PCPs). Assume n a =256 and the range [id] a0 id a255 The identifiers within the brackets are consecutive. One optimized way to represent this construction block is as follows:

[0187] COMPRESS[id a0 :id a255 TO[id] a [Compressed [id]] a0 :id a255 ] to [id] a ])

[0188] Then the obtained wire a is id a To identify.

[0189] Negation operation

[0190] Negation is needed to compare two variables because their difference can be compared to the value of zero. To find the negative of n... bit A bit-wire can be implemented by multiplying by a constant -1. This constant must be represented as:

[0191]

[0192] Equal to zero operation

[0193] n bit The building block for a bit wire a can be implemented as follows:

[0194] ·n bit Bits (a0, ..., a0) nbit-1 Extend the wires on the surface;

[0195] • Negate each 1-bit wire (a) i →b i );

[0196] ·Make the obtained b i Multiplication of wires:

[0197] Therefore, the 1-bit variable c = 1 if and only if a = 0.

[0198] Comparison with zero operations

[0199] The "greater than" operation can be converted to a "less than" operation using simple equality rules. In two's complement representation, this operation corresponds to checking whether the difference between two signed integers is positive or negative (or, in the case of the "less than or equal to" operation, checking if it is equal to zero). The sign of the difference c = a – b is determined by the most significant bit x in the binary representation: negative numbers are characterized by x = 1, while positive numbers are characterized by x = 0.

[0200] EXPAND[id c TO[n bit -1->x](Expand[id] c ] to [n bit -1->x])

[0201] Depending on the type of comparison (positive vs. negative), the binary value x needs to be negative.

[0202] conditional statements

[0203] Conditional statements in high-level languages ​​can be represented in the following form:

[0204] IF(S c )S a ELSE S b (If (S) c )S a Otherwise S b )

[0205] Due to statement S c Depending on the contract input, therefore branch S a and S b All of these must be implemented in a circuit. The logic flow is as follows: Figure 6 As shown. According to statement S c The (binary) output is used to execute statement S. a or statement S b The binary operation x+1 is used to invert x.

[0206] Generate constants

[0207] The constant value is independent of the circuit's input wires. Using a dedicated unary multiplication gate of the mul-by-const-c form, the following additional circuitry is provided to generate the constant value required by the contract:

[0208] The constant zero is calculated by multiplying the input wire by zero.

[0209] (A contract must have at least one input. Therefore, an input with an identifier of 1 (e.g., Figure 7 The `in1` parameter can be used to generate the constant `zero`.

[0210] • The constant one is calculated by incrementing the constant zero by one.

[0211] • Compute any other constant c by using mul-by-const-ci on the constant one. i .

[0212] Since the constants zero and one are always added to the circuit, k+2 gates are needed to implement k arbitrary constants. Figure 7 The process is described in the figure. The constant generator module provided according to an embodiment of the invention is responsible for creating constants used by arithmetic circuits. In this example, three constants (C1, C2, and C3) are generated along with the default values ​​of one (1) and zero (0).

[0213] The constant has a known bit width as specified by the complement standard.

[0214] Turn now Figure 8 , Figure 8 Exemplary simplified block diagrams of a computing device 2600 that can be used to practice at least one embodiment of the present disclosure are provided. In various embodiments, the computing device 2600 can be used to implement any system shown and described above. For example, the computing device 2600 can be configured to function as a data server, network server, portable computing device, personal computer, or any electronic computing device. Figure 8 As shown, computing device 2600 may include one or more processors (collectively designated 2602) having one or more levels of cache memory and storage controller, configured to communicate with storage subsystem 2606 including main memory 2608 and permanent memory 2610. Main memory 2608 may include dynamic random access memory (DRAM) 2618 and read-only memory (ROM) 2620, as shown. Storage subsystem 2606 and cache memory 2602 may be used to store information, such as details associated with transactions and blocks described in this disclosure. Processor 2602 may be used to provide steps or functions of any implementation described in this disclosure.

[0215] The processor 2602 can also communicate with one or more user interface input devices 2612, one or more user interface output devices 2614, and network interface subsystem 2616.

[0216] Bus subsystem 2604 can provide a mechanism for enabling the various components and subsystems of computing device 2600 to communicate with each other as desired. Although bus subsystem 2604 is schematically shown as a single bus, alternative implementations of the bus subsystem may utilize multiple buses.

[0217] The network interface subsystem 2616 can provide an interface to other computing devices and networks. The network interface subsystem 2616 can be used as an interface for receiving data from other systems and sending data from the computing device 2600 to other systems. For example, the network interface subsystem 2616 enables data technicians to connect devices to networks, allowing them to transfer data to and receive data from devices at remote locations (e.g., data centers).

[0218] User interface input device 2612 may include one or more user input devices, such as a keyboard; pointing devices such as an integrated mouse, trackball, touchpad, or graphics tablet; a scanner; a barcode scanner; a touchscreen incorporated into the display; audio input devices such as a speech recognition system, a microphone; and other types of input devices. Generally, the term "input device" is used to include all possible types of devices and mechanisms for inputting information into computing device 2600.

[0219] One or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display such as an audio output device. The display subsystem may be a cathode ray tube (CRT), a flat panel device such as a liquid crystal display (LCD), a light-emitting diode (LED) display, or a projector or other display device. Generally, the term "output device" is used to encompass all possible types of devices and mechanisms for outputting information from the computing device 2600. One or more user interface output devices 2614 may be used, for example, to present a user interface to facilitate interaction between the user and applications performing the aforementioned processing and variations thereof—where appropriate.

[0220] Storage subsystem 2606 may provide a computer-readable storage medium for storing basic programming and data structures that can provide functionality for at least one embodiment of the present disclosure. When executed by one or more processors, application programs (programs, code modules, instructions) can provide functionality for one or more embodiments of the present disclosure and may be stored in storage subsystem 2606. These application program modules or instructions may be executed by one or more processors 2602. Storage subsystem 2606 may additionally provide a repository for storing data used according to the present disclosure. For example, main memory 2608 and cache memory 2602 may provide volatile storage for programs and data. Persistent storage device 2610 may provide persistent (non-volatile) storage for programs and data and may include flash memory, one or more solid-state drives, one or more disk drives, one or more floppy disk drives with associated removable media, one or more optical drives (e.g., CD-ROM, DVD, or Blu-ray) with associated removable media and other similar storage media. Such programs and data may include programs for performing steps of one or more embodiments as described in this disclosure, as well as data associated with transactions and blocks as described in this disclosure.

[0221] The computing device 2600 can be of various types, including portable computer devices, tablet computers, workstations, or any other devices described below. Additionally, the computing device 2600 may include another device that can be connected to it via one or more ports (e.g., USB, headphone jack, Lightning connector, etc.). Devices that can be connected to the computing device 2600 may include multiple ports configured to accept fiber optic connectors. Therefore, the device can be configured to convert optical signals into electrical signals, which can be transmitted for processing via the ports used to connect the device to the computing device 2600. Due to the constantly evolving nature of computers and networks, [the following text is incomplete and requires further context]. Figure 8 The description of the computing device 2600 shown is merely a specific example used to illustrate a preferred embodiment of the device. Figure 8 The system drawn can also be compared to many other configurations with more or fewer components.

[0222] It should be noted that the above embodiments are illustrative rather than limiting of the invention, and those skilled in the art will be able to devise many alternative embodiments without departing from the scope of the invention as defined by the appended claims. Any reference numerals in parentheses within the claims should not be construed as limiting the claims. The words “comprising” and “comprises” do not exclude the presence of any other elements or steps besides those listed as a whole in any claim or specification. In this specification, “comprising” means “including or consisting of”. The singular form of an element does not exclude the plural form of such elements, and vice versa. The invention can be implemented by hardware comprising several different elements and by a suitably programmed computer. In the device claims enumerating several means, several of these means can be implemented by one and the same piece of hardware. The fact that certain measures are recited in dissimilar dependent claims does not mean that combinations of these measures cannot be advantageously used.

[0223] All references cited in this document, including publications, patent applications and patents, are incorporated herein by reference, and are cited in such a manner as if each reference were individually and specifically indicated as incorporated by reference and as a whole. References include UK patent applications GB1719998.5, GB 1718505.9, and GB 1720768.9.

Claims

1. A computer-implemented method, comprising the following steps: Process a portion of the source code to generate an arithmetic circuit, where: The source code is written in a high-level programming language; and The arithmetic circuit includes one or more arithmetic gates, which are configured to represent some or all of the functions expressed in the source code; wherein the arithmetic circuit includes n-bit wires connected to the arithmetic gates; wherein the outputs of one or more circuit wires and a public evaluation key EK are used to generate a proof of correctness.

2. The method according to claim 1, wherein, The proof of correctness is stored on the blockchain.

3. The method according to claim 1, wherein, The public evaluation key EK is obtained using a secret value.

4. The method according to claim 1, wherein, Use the secret value to obtain the public verification key.

5. The method according to claim 1, further comprising the following step: The arithmetic circuitry is used to provide hardware and / or software circuitry.

6. The method according to claim 1, wherein: The arithmetic circuit includes an n-bit wire connected to an arithmetic gate.

7. The method according to claim 1, wherein: The arithmetic circuit is architecture-independent.

8. The method of claim 1, wherein the method further comprises preprocessing the source code to determine one or more constants, the preprocessing comprising one or more of the following steps: Remove comments; Import the header declarations from the header file into the source file; Merge multiple source files; Process or evaluate instructions and macros.

9. The method according to claim 1, wherein, The method further includes the step of detecting all global variables declared in the source code, wherein the global variables are related to functions, structures or classes, constants and / or entry points for execution.

10. The method according to claim 1, wherein, The method further includes the following steps: A symbol table is generated to associate each symbol (i.e., identifier) ​​provided in the source code with declaration information provided in the source code, wherein the symbols in the table are global symbols and / or local symbols.

11. The method according to claim 1, wherein, The method further includes the following steps: evaluating the source code line by line to obtain arithmetic and / or logical expressions, wherein the arithmetic and / or logical expressions represent one or more output variables as a combination of logical and / or arithmetic operations applied to one or more input variables.

12. The method according to claim 11, wherein, The row-by-row evaluation includes the following sub-steps: Decode the type; Decode the expression; Evaluate the expression; and / or Allocate memory for the data structures required for the function.

13. The method of claim 11, further comprising the step of: Map the arithmetic and / or logical operations of the expression to arithmetic gates.

14. The method according to claim 13, wherein, The mapping step includes the following sub-steps: Perform wire extension; and / or Perform wire compression.

15. The method according to claim 1, further comprising the following step: The arithmetic circuit is used to generate a quadratic program comprising a set of polynomials, which provide a description of the circuit.

16. The method of claim 15, further comprising the step of: The quadratic program is provided to the entity to perform the quadratic program using one or more inputs.

17. A computer-implemented system configured to perform the steps of the method according to any one of claims 1 to 16, preferably, wherein, The system includes an interpreter configured to perform processing on the source code.

Images