A verifiable computation method based on multinomial commitment

Abstract

This application discloses a verifiable computation method based on polynomial commitments, relating to the field of information verification technology. The method includes linearly encoding the coefficient vector of a target polynomial and generating a corresponding binding commitment based on hierarchical hash commitments, sending the binding commitment to a verification end; in response to a random challenge initiated by the verification end, generating an intermediate vector based on the random challenge and the coefficient vector; in response to multiple random numbers sent by the verification end, obtaining a first verification value if the first proof from the proof end is confirmed to be successful through the binding commitment; obtaining a second verification value if the second proof from the proof end is confirmed to be successful through the binding commitment; and confirming the correctness of the evaluation result of the target polynomial at a specified point by evaluating the basic polynomial commitment if the first and second verification values ​​are equal. This application effectively reduces the overall complexity and communication overhead of information verification.

Description

Technical Field

[0001] This application relates to the field of information verification technology, and in particular to a verifiable computation method based on polynomial commitment. Background Technology

[0002] Zero-knowledge proof (ZKP) is an important cryptographic technique that can prove the correctness of a statement to the verifier without revealing private data on the proving end. It has wide applications in scenarios such as blockchain scaling.

[0003] In related technologies, zero-knowledge proofs are typically implemented using concise non-interactive proof systems. These systems require transforming the problem to be proven into a problem of circuit satisfiability, converting the circuit-satisfiable problem into an easily provable language, constructing an information-theoretic secure proof model for the easily provable language, and using a cryptographic compiler to build the concise non-interactive knowledge proof. A commonly used information-theoretic secure proof is the polynomial interactive oracle proof. In this interactive proof process, an oracle exists. The verifier can query the oracle for a value. The oracle does not deceive and directly sends the correct value to the verifier. The verifier then determines whether the verification passes based on the value sent by the oracle.

[0004] However, there is no Oracle in real-world proof systems. Therefore, the functionality of an Oracle can be achieved through multinomial commitments. Among existing multinomial commitment schemes, the trusted setting-based scheme has the advantages of smaller proof size and higher verification efficiency, but it relies on a trusted third party, which contradicts the decentralized concept. On the other hand, the transparent setting-based scheme eliminates the dependence on a trusted third party, but the proof size and verification overhead increase significantly. Summary of the Invention

[0005] The purpose of this application is to at least solve one of the technical problems existing in the prior art, and to provide a verifiable computation method, electronic device, computer-readable storage medium and computer program product based on polynomial commitment, which aims to reduce the overall complexity of information verification and communication overhead.

[0006] In a first aspect, embodiments of this application provide a verifiable computation method based on multinomial commitments, comprising:

[0007] The coefficient vector of the target polynomial is linearly encoded, and a corresponding binding commitment is generated based on the hierarchical hash commitment. The binding commitment is then sent to the verification end.

[0008] In response to a random challenge initiated by the verification end, an intermediate vector is generated based on the random challenge and the coefficient vector;

[0009] In response to multiple random numbers sent by the verification end, if the first proof of the proof end is determined to be successful through the binding commitment, a first verification value is obtained. The first proof of the proof end is a proof obtained by compressing multiple proofs for multiple random numbers through a preset batch processing algorithm.

[0010] If the second proof of the proof end is confirmed to be successful through the binding commitment, a second verification value is obtained. The second proof of the proof end is an encoded proof of the intermediate vector transferred from the verification end to the proof end through a preset verifiable encoding algorithm.

[0011] If the first verification value is equal to the second verification value, the correctness of the evaluation result of the target polynomial at the specified point is confirmed by evaluating the commitment of the basic polynomial.

[0012] According to the technical solution of the embodiments of this application, at least the following beneficial effects are achieved: the first proof of the proof end is a proof obtained by compressing multiple proofs for multiple random numbers through a preset batch processing algorithm. Through the preset batch processing algorithm, the calls to Eval in different polynomial commitments can be aggregated into a single Eval call, reducing computational complexity and communication overhead; and the second proof of the proof end is an encoded proof for the intermediate vector transferred from the verification end to the proof end through a preset verifiable encoding algorithm. In this way, the verification end does not need to encode itself, and the encoding process is outsourced to the proof end, further reducing computational complexity and communication overhead.

[0013] According to some embodiments of this application, the linear encoding of the coefficient vector of the target polynomial and the generation of a corresponding binding commitment based on the hierarchical hash commitment include:

[0014] The coefficient vector is structurally reorganized and double linearly encoded, and a hierarchical hash tree is constructed based on the result of the double linear encoding to generate binding commitments.

[0015] According to some embodiments of this application, the step of performing structured recombination and bilinear encoding on the coefficient vector, and constructing a hierarchical hash tree based on the result of the bilinear encoding to generate binding commitments, includes:

[0016] The coefficient vector is rearranged into a matrix, and the row vectors of the matrix are subjected to a first linear encoding to obtain a row encoding matrix. The column vectors of the row encoding matrix are subjected to a second linear encoding to obtain an extended encoding matrix.

[0017] A first Merkle tree commitment is generated for each column of the extended coding matrix, and a second Merkle tree commitment is generated based on the root value of the first Merkle tree commitment for all columns. The root value of the second Merkle tree commitment is used as the binding commitment.

[0018] According to some embodiments of this application, the generation of an intermediate vector based on the random challenge and the coefficient vector includes:

[0019] Based on the random challenge, the coefficient vector is linearly transformed to generate an intermediate vector;

[0020] The method further includes:

[0021] Based on the random challenge and the coefficient vector, calculate the evaluation results of the polynomials corresponding to multiple dimensions of the coefficient vector.

[0022] According to some embodiments of this application, the process of obtaining a first verification value in response to a plurality of random numbers sent by the verification end, provided that the first proof by the proof end is deemed successful through the binding commitment, includes:

[0023] In response to multiple location indices sent by the verification end and multiple evaluation results corresponding to the multiple location indices provided by the proof end, if the aggregated proof generated and verified by the preset batch processing algorithm passes the verification and is consistent with the binding commitment, the first verification value is obtained; the first verification value includes the multiple evaluation results, and the aggregated proof is used to simultaneously verify the correctness of the multiple evaluation results.

[0024] According to some embodiments of this application, obtaining the second verification value when the second proof at the proof end is confirmed to be successful through the binding commitment includes:

[0025] If the encoding proof is verified and consistent with the binding commitment, a second verification value is obtained; the encoding proof is used to confirm that the intermediate vector is correctly encoded, and the second verification value includes the encoding value of the intermediate vector at the corresponding positions of the plurality of random numbers.

[0026] According to some embodiments of this application, the step of verifying the correctness of the evaluation result of the target polynomial at a specified point by evaluating the fundamental polynomial commitment when the first verification value and the second verification value are equal includes:

[0027] If the first verification value and the second verification value are equal at the same index, a proof of the evaluation of the polynomial with the intermediate vector as coefficients at the specified point is generated by the evaluation algorithm of the basic polynomial commitment. If the proof of evaluation is verified, the evaluation result of the target polynomial at the specified point is confirmed to be correct.

[0028] In a second aspect, embodiments of this application provide an electronic device, including a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for implementing communication between the processor and the memory. The program is executed by the processor to implement the verifiable computation method described in the first aspect above.

[0029] Thirdly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which are used to cause a computer to perform the verifiable computation method as described in the first aspect above.

[0030] Fourthly, embodiments of this application provide a computer program product, including a computer program or computer instructions, wherein the computer program or computer instructions are stored in a computer-readable storage medium, a processor of a computer device reads the computer program or computer instructions from the computer-readable storage medium, and the processor executes the computer program or computer instructions, causing the computer device to perform the verifiable computation method as described in the first aspect above.

[0031] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0032] The accompanying drawings are used to provide a further understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0033] The present application will be further described below with reference to the accompanying drawings and embodiments;

[0034] Figure 1 This is a flowchart of a verifiable calculation method provided in one embodiment of this application;

[0035] Figure 2 This is a schematic block diagram of the structure of a cryptographic system provided in one embodiment of this application;

[0036] Figure 3 This is a flowchart of a verifiable calculation method provided in another embodiment of this application;

[0037] Figure 4 This is a flowchart of a verifiable calculation method provided in another embodiment of this application;

[0038] Figure 5 This is a flowchart of a verifiable calculation method provided in another embodiment of this application;

[0039] Figure 6 This is a flowchart of a verifiable calculation method provided in another embodiment of this application;

[0040] Figure 7 This is a flowchart of a verifiable calculation method provided in another embodiment of this application;

[0041] Figure 8 This is a flowchart of a verifiable calculation method provided in another embodiment of this application;

[0042] Figure 9 This is a schematic diagram of an electronic device for performing a verifiable computation method according to an embodiment of this application. Detailed Implementation

[0043] This section will describe in detail the specific embodiments of this application. Preferred embodiments of this application are shown in the accompanying drawings. The purpose of the drawings is to supplement the textual description with graphics, so that people can intuitively and vividly understand each technical feature and the overall technical solution of this application, but they should not be construed as limiting the scope of protection of this application.

[0044] In the description of this application, it should be understood that the orientation descriptions, such as up, down, front, back, left, right, etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0045] In the description of this application, "several" means one or more, "more than" means two or more, "greater than," "less than," and "exceeding" are understood to exclude the stated number, while "above," "below," and "within" are understood to include the stated number. The use of "first" and "second" in the description is merely for distinguishing technical features and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or implicitly indicating the order of the indicated technical features.

[0046] In the description of this application, unless otherwise expressly defined, terms such as "setup," "installation," and "connection" should be interpreted broadly, and those skilled in the art can reasonably determine the specific meaning of the above terms in this application in conjunction with the specific content of the technical solution.

[0047] The following description, in conjunction with the accompanying drawings, further elaborates on various embodiments of the verifiable computation method based on polynomial commitments of this application.

[0048] like Figure 1 As shown, Figure 1This is a flowchart of a verifiable calculation method provided in one embodiment of this application. The verifiable calculation method may include, but is not limited to, steps S110 to S150.

[0049] Step S110: Linearly encode the coefficient vector of the target polynomial, generate the corresponding binding commitment based on the hierarchical hash commitment, and send the binding commitment to the verification end;

[0050] Step S120: In response to the random challenge initiated by the verification end, generate an intermediate vector based on the random challenge and the coefficient vector;

[0051] Step S130: In response to multiple random numbers sent by the verification end, if the first proof of the proof end is confirmed to be successful through the binding commitment, a first verification value is obtained. The first proof of the proof end is a proof obtained by compressing multiple proofs for multiple random numbers through a preset batch processing algorithm.

[0052] Step S140: If the second proof of the proof end is confirmed to be passed by binding commitment, the second verification value is obtained. The second proof of the proof end is the encoded proof of the intermediate vector transferred from the verification end to the proof end by a preset verifiable encoding algorithm.

[0053] Step S150: If the first verification value and the second verification value are equal, the correctness of the evaluation result of the target polynomial at the specified point is confirmed by verifying the evaluation of the commitment of the basic polynomial.

[0054] It is understood that the verifiable computation method based on multinomial commitments provided in this embodiment can be applied to a cryptographic system containing a proof end and a verification end, as referenced. Figure 2 , Figure 2 This is a schematic block diagram of a cryptographic system provided in one embodiment of this application. The cryptographic system includes a polynomial commitment framework, a proof end, and a verification end. The polynomial commitment framework includes a preset batch processing algorithm and a preset verifiable encoding algorithm. The proof end can construct a first proof and a second proof through the polynomial commitment framework.

[0055] For example, the proof side holds the target polynomial that needs to be committed to and verified. This polynomial is a d-dimensional multilinear polynomial g defined on a finite field F, whose coefficients form a high-dimensional vector.

[0056] Prove that we obtain the coefficient vector u of the target polynomial g, with dimension n, where n is set to a perfect square. To facilitate subsequent structured processing, and to achieve an efficient and verifiable commitment to the polynomial coefficients, the proving end performs a linear encoding operation on the coefficient vector u, using a linear code with a specific algebraic structure, such as random folding encoding, to map the original coefficient vector into a longer encoded vector with redundancy and error correction properties. After completing the linear encoding, the proving end can organize the encoded data into a tree structure, recursively calculate the hash value, and finally generate a fixed-length binding commitment value comm. The commitment value comm acts as a digital fingerprint of the entire polynomial coefficient data, possessing collision resistance; any tampering with the original coefficients will cause a change in its hash commitment value. The proving end sends the binding commitment comm to the verifying end as a trust anchor for all subsequent verification operations.

[0057] For example, when the verification end needs to verify the evaluation result y of polynomial g at a specific point, the verification end first issues a random challenge to the proof end, that is, sends a randomly selected vector r. In response to this random challenge, the proof end generates an intermediate vector t based on the received random challenge r and the original coefficient vector u it secretly holds, through a predetermined linear transformation formula. The dimension of the intermediate vector t is significantly smaller than that of the original coefficient vector u. It can be understood as the coefficient vector of a new polynomial with respect to the remaining variables obtained by fixing a part of the variables of the original multivariable polynomial g to the challenge value r. In this way, the problem of verifying a high-dimensional multi-point evaluation is transformed into the problem of verifying a relatively low-dimensional and simpler structure.

[0058] Subsequently, the verification end sends a set of random numbers, for example, a set of randomly selected position indices. The proving end needs to prove to the verification end that, for multiple random positions specified by the verification end, the specific data derived from the original coefficient vector u is correct. Traditionally, a separate proof needs to be generated for each position. In this embodiment, the proving end uses a preset batch processing algorithm to aggregate multiple zero-knowledge proofs or arguments that would normally need to be generated independently for each random position into a single concise proof, i.e., the first proof, through linear combination and randomization. After receiving the first proof, the verification end verifies it in conjunction with the previously held binding commitment comm. If the verification passes, the verification end is not only convinced that the data of the proving end at those specified positions is correct, but can also extract or deduce a set of corresponding values ​​from the proof to obtain the first verification value, thereby greatly reducing communication overhead and the computational burden on the verification end.

[0059] Furthermore, the proving end has sent the intermediate vector t to the verifying end. The verifying end needs to confirm whether t has been correctly encoded, i.e., encoded according to the same linear code rules as in the first stage. Similarly, to avoid the verifying end performing the expensive full encoding calculation itself, this application embodiment designs an interactive or non-interactive protocol through a verifiable encoding algorithm, so that the task of verifying the correctness of the encoding of t can be transferred from the verifying end or outsourced to the proving end. The proving end then generates a second proof. The verifying end verifies the second proof by running the verification step of the verifiable encoding algorithm and combining it with the context established by the binding commitment comm. If the verification passes, the verifying end is certain that the encoding of the intermediate vector t is correct and obtains another set of values, i.e., the second verification value.

[0060] After obtaining the first and second verification values, the verifier can compare whether the two verification values ​​are completely equal. Since the first verification value comes from the partial verification of the original committed data, and the second verification value comes from the verification of the encoding of the intermediate vector t, their equality constitutes a strong constraint. If they are equal, the intermediate vector t generated by the proof end is completely consistent with the result that should be derived from the originally committed coefficient vector u according to the challenge r. This is equivalent to cross-verifying the consistency of the proof end throughout the entire calculation process, eliminating the possibility of cheating by using different data at different stages. Only after the cross-verification passes will the final evaluation verification be performed. At this point, the problem has been simplified to verifying a polynomial with the confirmed correct intermediate vector t as coefficients at another point specified by the verifier. To determine whether the value on the given point is y, the proving and verifying ends call a function to evaluate and verify a basic polynomial commitment scheme, where the basic scheme is a pre-selected scheme that meets specific security requirements. The proving end generates a polynomial (with coefficients t) at the point... The final proof of the value of y is obtained by the verification end using a fast verification algorithm based on this basic scheme. If the final verification passes, the verification end can be certain that the original target polynomial g is at the complete point. The result of the evaluation on the y-value is indeed y, thus completing the entire information verification process.

[0061] like Figure 3 As shown, Figure 3 This is a flowchart of a verifiable calculation method provided in another embodiment of this application; regarding the above step S110, it may include, but is not limited to, step S210.

[0062] Step S210: The coefficient vector is structurally reorganized and double linearly encoded, and a hierarchical hash tree is constructed based on the result of the double linear encoding to generate binding commitments.

[0063] For example, the proof side obtains the coefficient vector u of the target polynomial g, where the dimension n of the coefficient vector u is preset to be... This allows the one-dimensional coefficient vector to be naturally reinterpreted and reorganized into a two-dimensional matrix structure U with dimensions m×m, thus transforming the linear coefficient sequence into a two-dimensional array. Each element of the reorganized matrix U... It directly corresponds to a specific coefficient in the original coefficient vector u, where i and j represent the row index and column index (from 0 to m-1), respectively.

[0064] For example, the first layer of the double linear encoding is a row-wise linear encoding. The proof selects a linear code C1 with good properties, for example, a code based on random folding encoding techniques, for each row of matrix U. (An m-dimensional row vector) is encoded using the linear code C1. The encoding function Enc1 maps the m-dimensional row vector to a codeword row vector of length N (N>m, which is the length of the encoded vector). That is, for all ,calculate After processing all m rows, a row encoding matrix is ​​obtained. The matrix has dimensions m×N, and each row of the matrix is ​​a valid C1 codeword.

[0065] The second level of encoding is a linear encoding for columns. The proof end selects another or the same linear code C2; ​​in this case, the object of processing is the row-encoded matrix. For matrix Each column The proof end uses linear code C2 to encode it. The encoding function Enc2 maps a column vector of length m to a codeword column vector of length N, that is, for all... The column encoding vector is calculated, and after processing all N columns, a three-dimensional data block is obtained, which is an extended data structure with double linear encoding. This can be formally represented as an N×N matrix. Each element is indirectly protected by the original coefficients and two levels of coding.

[0066] Then, based on the results of dual linear encoding A hierarchical hash tree (Merkel tree) is constructed to generate the final binding commitments. The construction of the first layer of the hash tree is aimed at... For each column, specifically for j ranging from 0 to N-1, the corresponding j-th column data in the extended data is taken as a leaf node. Each leaf node is paired with another to calculate its hash value, which is then used as the parent node. This pairing and hashing process is repeated recursively until a single root hash value is generated for that column of data. In this way, we can obtain the root hash values ​​of N first-level Merkle trees, denoted as set. Each of these root hash values ​​represents the complete data of its corresponding column. The second-level hash tree is constructed by using N first-level root hash values ​​H as leaf nodes, arranging them in order, pairing them up in pairs, calculating hashes, and so on, until a single root hash value is generated at the top level. The root hash value at the top level is the final binding commitment comm.

[0067] Thus, through the hierarchical hash commitment structure, any tiny modification to the original coefficient vector u will propagate through linear encoding, ultimately changing the first-level root hash value of its corresponding column, and consequently changing the top-level root hash value comm, thereby achieving binding. Furthermore, when the verifier subsequently wants to query data at a specific location, the prover only needs to provide that data to its first-level column root. Merkel's path and The Merkel path to the top-level root comm allows the verification end to efficiently verify the authenticity of the data fragment.

[0068] like Figure 4 As shown, Figure 4 This is a flowchart of a verifiable calculation method provided in another embodiment of this application; regarding the above step S210, it may include, but is not limited to, steps S310 and S320.

[0069] Step S310: Rearrange the coefficient vector into a matrix, perform first linear encoding on the row vectors of the matrix to obtain the row encoding matrix, and perform second linear encoding on the column vectors of the row encoding matrix to obtain the extended encoding matrix;

[0070] Step S320: Generate a first Merkle tree commitment for each column of the extended coding matrix, generate a second Merkle tree commitment based on the root value of the first Merkle tree commitment for all columns, and use the root value of the second Merkle tree commitment as the binding commitment.

[0071] For example, the coefficient vector is rearranged into a matrix, and the proof begins with the coefficient vector u of the target polynomial g, with a length of n. Based on the system parameters, let... The proof will use a one-dimensional vector. Fill the matrix U into an m x m matrix in row-major order, i.e., for Matrix elements Thus, the i-th row of matrix U It is a continuous segment of the original coefficient vector.

[0072] For example, for the first linear code, the proving end uses a pre-agreed first linear code scheme, which is defined by a generator matrix G1 or implemented by a specific encoding algorithm. For example, the input length of the first linear code is m, and the output length is N. For each row of matrix U... (1×m vector), the proof end calculates its encoding. (using generating matrix multiplication), or (Using a specific random folding encoding function Enc_RFC1), after processing all m rows, a row encoding matrix is ​​obtained. With dimensions m×N, the matrix... Each line is a valid first linear codeword of length N.

[0073] For example, for the second linear code, the proof end uses a pre-agreed second linear code scheme, which is also defined by the generator matrix G2 or the encoding algorithm Enc_RFC2. For instance, the input length of the second linear code is m, and the output length is N. In this case, the object being encoded is a matrix. The columns, for each column index Extracting the matrix The j-th column is denoted as The proof side calculates the encoding of this column vector. This yields a coding column vector of length N. Performing the above operation on all N columns results in N coding column vectors of length N. Combining these coding column vectors side-by-side forms the final extended coding matrix. .

[0074] For example, for generating the first Merkle tree commitment, the proof side first consists of the extended encoding matrix. Construct a Merkle tree for each column, for the j-th column This column of data As a leaf node, it first needs to be serialized into a byte string, and then calculated using a collision-resistant cryptographic hash function. Let's assume the leaf node is... Calculate the parent node in pairs. And so on. If N is not a power of 2, it will be padded. This process is repeated recursively until a unique root hash value for the column is generated. , The first Merkle tree commitment in column j binds to all data in that column. The proof is executed for all N columns, yielding N first Merkle tree commitment values. .

[0075] For example, to generate the second Merkle tree commitment and the final binding commitment, the proving end uses N first Merkle tree commitment values ​​RC as new data leaf nodes to construct the top-level Merkle tree. Arranged sequentially as a list of leaf nodes, the same hash function is used to pair and hash the commitment values ​​in pairs, recursively generating a top-level root hash value, which is the binding commitment comm.

[0076] The proving end needs to store all necessary auxiliary information to generate subsequent proofs, including all intermediate hash values ​​(Merkel tree paths), but only needs to send the comm to the verifying end, which only holds this comm. This comm is then used in subsequent verifications. When proving a specific element, the proof can provide the value of that element and the root from that element to its column. Merkel's path and from The Merkel path to the top-level root comm can be independently calculated and verified by the verification end, ultimately confirming that the element does indeed belong to the dataset bound to the initial commitment comm.

[0077] like Figure 5 As shown, Figure 5 This is a flowchart of a verifiable calculation method provided in another embodiment of this application; the above step S120 may include, but is not limited to, step S410;

[0078] Step S410: Perform a linear transformation on the coefficient vector based on the random challenge to generate an intermediate vector;

[0079] The verifiable calculation method described above may also include, but is not limited to, step S160;

[0080] Step S160: Based on the random challenge and the coefficient vector, calculate the evaluation results of the polynomials corresponding to the multiple dimensions of the coefficient vector.

[0081] For example, when the verification end decides on the target polynomial g at the point When verifying the evaluation of y, the interaction protocol is initiated, sending the first random challenge to the proof end, which is a randomly selected vector of domain elements, denoted as r. The dimension of vector r is d / 2, where d is the total number of variables in polynomial g, derived from the random number generator on the proof end or, in a non-interactive setting, derived from previous interaction records via the Fiat-Shamir transformation. After receiving the random challenge vector r, the proof end needs to perform calculations using the secretly stored original polynomial coefficient vector u or its recombined matrix form U.

[0082] For example, in the computation of generating the intermediate vector t, the coefficient vector u has been reorganized into an m×m matrix U, and a random challenge r is used to assign values ​​to a subset of the variables of the polynomial. Specifically, there exists a definite linear transformation that interacts the matrix U with a specific vector derived from the challenge r, the derived vector being the tensor product of the components of the challenge r. For instance, for a multilinear polynomial, the coefficient vector t of the new polynomial with respect to the last d / 2 variables obtained after fixing the first d / 2 variables as r can be computed as follows: ,in It depends on the k-th component of r. And the function of index ik.

[0083] Construct a selection vector q1 of length m, such that q1 is the Lagrange evaluation vector for the first half of the variables r. Then, the intermediate vector t can be calculated... The result is a 1×m row vector, where each component of t... The intermediate vector t represents the new polynomial g obtained by setting the first d / 2 variables to r, with respect to the remaining d / 2 variables. The coefficient vector is t, therefore the dimension of t is m, which is much smaller than the original number of coefficients. .

[0084] For example, the calculation of the evaluation results of the polynomials corresponding to multiple dimensions of the coefficient vector is used to prepare data for subsequent batch processing verification. The coefficient vector u is reorganized into each column of matrix U. It can also be viewed as the coefficients of a multilinear polynomial, for each column index. A multilinear polynomial can be defined. The coefficient vector is Therefore, for the same random challenge r sent from the verification end, the value of each polynomial f_j at point r can be calculated, that is, for each j, the value of f_j can be calculated. .because The coefficient is And r acts on its variables, so the calculation is similar in form to the calculation of the components of t, but the direction is horizontal. Specifically, the calculation can be performed for each j. .

[0085] like Figure 6 As shown, Figure 6 This is a flowchart of a verifiable calculation method provided in another embodiment of this application; regarding the above step S130, it may include, but is not limited to, step S510.

[0086] Step S510: In response to the multiple location indices sent by the verification end and the multiple evaluation results corresponding to the multiple location indices provided by the proof end, if the aggregated proof generated and verified by the preset batch processing algorithm passes the verification and is consistent with the binding commitment, a first verification value is obtained; the first verification value includes multiple evaluation results, and the aggregated proof is used to simultaneously verify the correctness of multiple evaluation results.

[0087] Understandably, after sending the initial random challenge r, the verification end will generate and send multiple random numbers—a set of randomly selected location indices—in order to initiate batch verification. For example, the number of samples in the batch verification is l (a constant related to a security parameter), and the verification end randomly selects l different indices from the index range, denoted as the set. The index set J is sent to the proof side. Upon receiving the query index set J, the proof side needs to respond to the challenge by retrieving the corresponding value from the previously calculated result set for each index j in set J. , take l values Send it back to the verifier. However, simply sending these values ​​is insufficient; the verifier cannot trust that these values ​​were correctly calculated if the verifier provides each... To provide an independent zero-knowledge proof, prove Equals a polynomial with coefficients in the j-th column of the committed data. The value of point r will result in The proof size and verification time.

[0088] Therefore, using a pre-defined batch processing algorithm, the proving end constructs a single aggregated proof, i.e., the first proof, using the index set J sent by the verifying end and the evaluation results corresponding to the indices. For example, the proving end first formally defines l declarations, each of which is... Batch processing algorithms combine declarations into an equivalent declaration about a certain aggregation polynomial. For example, the verifier sends l additional random weights after sending index J. The proof then constructs a polynomial. Therefore, it is proved that for all k, Statistically equivalent to proof Now, the proof-end only needs to provide a proof for evaluating this aggregate polynomial F at point r. Since the polynomial commitment scheme supports concise proofs of evaluating a single polynomial at a single point, l proofs are compressed into one proof. Therefore, the first proof generated by the proof-end is a proof of the evaluation result of the aggregate polynomial F at the challenge point r. The generation of this proof relies on the evaluation proof (Eval) function provided by the underlying polynomial commitment scheme. The proof-end runs this function, taking into account knowledge of the coefficients of polynomial F, as well as point r and the aggregate value. The output is a brief proof. .

[0089] The proof end will The data is sent to the verification end, where the verification process consists of two parts: the first part verifies the aggregate proof. The validity of the commitment itself is verified by using a verification algorithm based on the fundamental multinomial commitment scheme to check the value of F at point r. Whether the statement is true or false. Since F is a linear combination of several columns in U, and the column data of U has been committed to in the binding commitment comm, the verifier can construct a commitment to F. This requires the prover to provide the first-level Merkle tree commitment value corresponding to each column involved in F, and... The Merkel path to the top-level commitment comm; the verification end verifies the validity of these paths, confirming their validity. It is part of comm, and then, based on and random weights The verification end can compute an aggregated column commitment, corresponding to the commitment of the coefficient vector of the polynomial F. The verification end uses the aggregated commitment, the point r, and the aggregated value. and proof The verification function of the underlying commitment scheme is called. If the verification passes, the verifier is statistically certain that almost all of the original l evaluation declarations are correct.

[0090] The second part is obtaining the first verification value. After the batch verification passes, the verified value obtained by the verification end is l evaluation results. Although the convergence proof only directly verifies linear combinations However, since the verifier knows the random weight α and the verification passes, according to the definition of plausibility in cryptography, unless all... Both are correct; otherwise, the proof would be almost impossible for the verification to pass. Therefore, the verification end can safely consider this l value as verified and record it as the first verification value. Thus, through an efficient aggregation proof verification, the verification end successfully obtained a strong guarantee of the correctness of data at multiple random locations, and obtained the first set of data required for subsequent cross-validation.

[0091] like Figure 7 As shown, Figure 7 This is a flowchart of a verifiable calculation method provided in another embodiment of this application; regarding the above step S140, it may include, but is not limited to, step S610.

[0092] Step S610: If the encoding proof passes verification and is consistent with the binding commitment, a second verification value is obtained; the encoding proof is used to verify that the intermediate vector is correctly encoded, and the second verification value includes the encoding value of the intermediate vector at the corresponding positions of multiple random numbers.

[0093] Understandably, after the proof side calculates the intermediate vector t, it needs to convince the verification side that the encoding of t is correct. Here, encoding in the proof refers to processing vector t according to the same second linear code as in the commitment phase. For example, t is an m-dimensional vector, and the encoding process converts it into an N-dimensional codeword vector v, i.e. If the verification end recalculates v itself, it needs to know the encoding details and execute the code. The computations are on the order of magnitude, which are extremely costly when m and N are large.

[0094] For example, the proving end sends the calculated intermediate vector t itself to the verifying end, so that the verifying end knows the plaintext value of t. Then, both parties run a preset verifiable encoding algorithm. The proving end needs to prove to the verifying end that it knows a codeword v, and this v is exactly a valid encoding of t. At the same time, this proof process does not reveal additional information and the verification work of the verifying end is very lightweight. For example, the proving end can regard the vector t as the coefficient vector of a certain low-order polynomial pt. Since the random folding encoding process is essentially a polynomial evaluation on a predefined point set T, v is the correct encoding of t, which is equivalent to the result of the evaluation of polynomial pt on the point set T being v.

[0095] Therefore, the proof can use a suitable polynomial commitment scheme to commit to the polynomial pt with coefficient t, and obtain the commitment. When the verification end needs to verify the encoding, it randomly selects a small subset of positions from the point set T. For example, it selects l positions and chooses the same set of column indices as the batch verification stage for cross-comparison with the batch verification. At the corresponding evaluation points, the verification end requests the proof end to provide the values ​​of v at these positions, i.e. For each requested location The proof end not only provides values It is also necessary to provide that this value is provided by the commitment. The proof is derived by evaluating the corresponding polynomial pt at a specific point.

[0096] However, directly performing l evaluations on l points raises the efficiency issue. Therefore, the pre-defined verifiable encoding algorithm usually integrates a batch processing algorithm. The proof end can generate an aggregated evaluation proof for the evaluations on these l points, and the verification end sends the same random weights. The proof end constructs a declaration about the linear combination of the polynomial pt on multiple points and generates a single concise proof π_encode, i.e., the second proof.

[0097] In order to verify the second proof, the verification end must be able to confirm the commitment used by the proof end to the polynomial pt. It is valid and consistent with the overall protocol context. Although t was just sent by the proving end, the verifying end needs to confirm that the proving end generated it. The commitment c_t used at that time does indeed correspond to this t. This can be achieved by having the proving end send the commitment c_t at the same time as or before sending t. The verifier then checks whether c_t is indeed an honest commitment to a polynomial with coefficient t. Additionally, the verifier needs to associate this process with the initial binding commitment comm. During verification... At that time, the verification end mainly checks the validity of two aspects: first, the aggregate evaluation proof. Whether it is mathematically valid can be checked using a multinomial commitment verification algorithm. The first step is to declare the point set and aggregate value; the second step is to check whether any data from the initial commitment referenced by the proof end in generating the proof can be traced back to the top-level commitment comm via the Merkel path. For example, if certain elements in the initial commitment data are needed as context during the encoding verification process, the proof end must provide proofs of inclusion of these elements, and the verification end will verify that these paths ultimately point to comm.

[0098] When the second proof After verification and all consistency checks with the binding commitment comm have passed, the verifier gains a high degree of confidence that the encoding v of the intermediate vector t provided by the proviser is correct. The verifier then extracts the encoded values ​​at these l positions from the response provided by the proviser. This is recorded as the second verification value V2. Thus, without the entire encoding computation, the verification end has obtained valid evidence and a specific value V2 regarding the correctness of the t encoding through an outsourced, verifiable protocol.

[0099] like Figure 8 As shown, Figure 8 This is a flowchart of a verifiable calculation method provided in another embodiment of this application; regarding the above step S150, it may include, but is not limited to, step S710.

[0100] Step S710: If the first verification value and the second verification value are equal at the same index, generate a proof of the evaluation of the polynomial with the intermediate vector as the coefficient at the specified point using the evaluation algorithm of the basic polynomial commitment. If the evaluation proof is verified, confirm that the evaluation result of the target polynomial at the specified point is correct.

[0101] Understandably, the verification terminal stores the first verification value locally. This refers to the verified evaluation result of the polynomial corresponding to a specific column of the original coefficient matrix at point r, obtained during the batch verification phase, as well as the second verification value. It is the verified index of the intermediate vector t in the same column obtained during the verifiable coding outsourcing stage. The encoded value on the verifier. The verifier needs to check whether V1 and V2 are equal element by element, that is, for each k from 1 to l, check the equation. Whether it is valid or not.

[0102] Understandable It is the original matrix of the first... The value of the polynomial defined by the column at point r, and The encoding of the intermediate vector t is at the th The position value is determined by the linearity of the random folding code and the calculation method of the intermediate vector t. It can be deduced that if all calculations are correct, then for each column index j, theoretically there should be ,because It is a component of the encoding of t, and the encoding of t is essentially a linear transformation of t. This is a linear transformation of the j-th column of U. Therefore, if the proving end cheats or incorrectly calculates the code v when generating the intermediate vector t, the probability of all equations at these l random positions being true is extremely low, even if they pass the previous two sub-verifications. Therefore, if all l pairs of comparisons are consistent, the verifying end can be confident with a very high probability that the intermediate vector t held by the proving end was indeed calculated from the initially committed coefficient matrix U according to the correct rules and challenge r, which is equivalent to verifying the correctness of the calculation path from the original commitment to the intermediate state.

[0103] When cross-validation is successful, the objective polynomial g can be verified at the complete point. The result of the evaluation on the point is y. At this point, it has been confirmed that the intermediate vector t is correct, and according to the properties of multilinear polynomials, the original polynomial g at the point... The value of is exactly equal to the polynomial with coefficient t at point . The value of . That is ,in The coefficient is t. Therefore, verification Equivalent to verification ( )=y.

[0104] For example, the proof and verification ends call the evaluation and verification function of the basic polynomial commitment scheme to perform verification. Here, the basic polynomial commitment scheme refers to the commitment scheme that serves as the underlying building block. The proof end needs to use t as the coefficients of the polynomial to be committed, but it does not need to go through the entire commitment process again because t is public and its correctness has been guaranteed by the previous steps. Therefore, the proof end can directly use the interface in the basic commitment scheme to generate the evaluation proof. If the verification algorithm outputs 1 (accept), the verification end finally confirms the polynomial with t as coefficients. At point The value is indeed y. Combined with the previously confirmed " The verification end can then be finally certain that the initial objective polynomial g lies at the specified point. The correct result of the evaluation is y.

[0105] In one embodiment, it can be understood that multinomial commitments An algorithm can use a pre-defined batch processing algorithm to reduce computational overhead if it satisfies the following definition 1. In the pre-defined batch processing algorithm, the proof end proves to the verification end the correctness of the values ​​of multiple polynomials that have been promised at the evaluation points. The pre-defined batch processing algorithm can process multiple different polynomials to their corresponding... The algorithm access is reduced to only needing to be called once. Access to specific polynomials greatly reduces the computational complexity of the protocol.

[0106] Definition 1: It is The linear code, and the corresponding multivariate linear evaluation algorithm The definition is as follows:

[0107]

[0108] in, This represents the evaluation point of the polynomial. Represents the coefficients of the polynomial. Indicates the use of linear code De-encoding , Representing a polynomial At point The value on, that is Thus, the pre-defined batch processing algorithm can not only prove the polynomial At point The value on Furthermore, it can be proven that y is a near-legal codeword space. The vector, where the valid definition comes from the parameters in the Proximity Gap set in the multinomial commitment algorithm.

[0109] In addition, regarding relationships It can be viewed as a tuple ( All sets of , where and This indicates an intention to prove multiple different polynomials. At the evaluation point , Is it equal to .

[0110] For example, It is a multivariable linear polynomial, and the polynomial commitment... The algorithm satisfies Definition 1. The proof begins by using a polynomial in the initial phase. The vector is encoded using a linear code, and then committed using the Commit algorithm in the corresponding multinomial commitment. Subsequently, the verifier sends a random number. The proof uses random numbers to combine polynomials into a new polynomial. Then prove that the end will After encoding the polynomial in the same way, it is committed using the commit method of polynomial commitment, and then the probability gap property of linear codes is used to guarantee the commitment. It is by and The result is that the verification end randomly selects some positions for the verification end to send the encoded vector Enc( The values ​​at the corresponding positions and the corresponding Merkle tree proofs are then used. Finally, the polynomial is opened. At point Use the value above to make a judgment .

[0111] For example, the input to a pre-defined batch processing algorithm is a polynomial. ;

[0112] Output: , 0 / 1 (output 1 if the Eval algorithm passes and the verification passes, otherwise output 0).

[0113] The preset batch processing algorithms include:

[0114] Procedure BatchEval ;

[0115] The proof end encodes the polynomial and commits it using a Merkle tree. Then Converging into a Merkel commitment And calculate and send and Provided to the verification end;

[0116] Verification Send

[0117] Proof calculation and will Post-encoding commitment send Provided to the verification end;

[0118] The verification end is randomly selected. The location to be checked, for each The verification end requests each from the proof end. and The corresponding number a symbol And include the Merkel path;

[0119] Verification end inspection Otherwise, the verification will fail;

[0120] Finally, the verification and proof ends run polynomial commitments. The algorithm obtains Specific value ,judge If they are the same, the verification passes; otherwise, the verification end rejects the verification.

[0121] In one embodiment, it can be understood that for a message The proof end uses randomfoldable code to encode this locally. ,Right now Then, the proof end uses Merkle trees to... The commitment is given to the verifier, who can then verify the committed vector. Whether the symbol at any position is related to the corresponding codeword, i.e. Are the symbols at corresponding positions the same? In this way, by using a preset verifiable encoding algorithm, the verification end can outsource the encoding process to any proof end, thereby reducing the computational overhead of its own encoding. Previously, to ensure the correctness of the encoding, the verification end needed the proof end to send the message to the verification end, and the verification end would encode it locally, which also increased the communication overhead.

[0122] Exemplary, encoded verifiable relationships It can be viewed as a tuple ( The polynomial coefficients are denoted as That is, the encoded message. Indicates by In point set The evaluation of the codeword is called the evaluation of the codeword.

[0123] For example, for a preset verifiable encoding algorithm, It is a multivariable linear polynomial with coefficients The encoding process is performed on a point set to encode the message. ,beg Proof of local encoding message ,Right now Do not send The code is given to the verification end, and then the verification end needs to be proven to ensure the correctness of the encoding. The verification end randomly selects the location to open. The proof end is required to send And prove It is made by The codeword obtained by encoding according to the requirements is number 1. At each position, f is committed to the verifier using a multinomial commitment algorithm, i.e. Where the coefficient of f is m. Then, based on the location requested by the verification end... A multinomial commitment scheme is used to fulfill the verification requirements, namely, sending the first codeword. a symbol .because Based on the properties of multinomial commitments, the verification end can invoke the multinomial commitment function. Algorithm to verify Is it determined by the commitment polynomial? At point The calculation shows that this polynomial commitment scheme just satisfies the requirement that random folding encoding yields the codeword number. The calculation process for each position.

[0124] For example, the input to the predefined verifiable encoding algorithm is a polynomial. Set of value points ;

[0125] Output: Verification results , code character symbol ;

[0126] Preset verifiable encoding algorithms include:

[0127] Procedure Verifiable Encoding ;

[0128] The proof end is encoded locally. Using a multinomial commitment agreement ,Will Send to the verification end;

[0129] The proof and verification ends run a preset batch processing algorithm. If the preset batch processing algorithm passes the verification, then the preset verifiable encoding algorithm passes; otherwise, the verification fails.

[0130] For example, embodiments of this application provide a general construction framework that can be combined with a polynomial commitment scheme satisfying Definition 1 to construct a new polynomial commitment scheme. Compared to existing schemes, the proposed new polynomial commitment scheme exhibits superior performance in terms of proof size and verification computational overhead. Furthermore, the scheme of embodiments of this application supports polynomial values ​​over any finite field, demonstrating good versatility and scalability.

[0131] For example, It is a A multivariable linear polynomial with coefficients, i.e., the objective polynomial, for integers Suppose there is , Represents a polynomial The coefficient vector, and It is a Lagrange form.

[0132] It can be done through sets indexing numbers The elements, for ,Bundle Consider it as a The matrix, Represents the first of this matrix Okay, that is And for polynomials A point of evaluation There exist two vectors Make ,in represent and The tensor product.

[0133] This application provides a polynomial commitment scheme divided into two phases: a commitment phase and an evaluation phase. In the commitment phase, the proving end commits the coefficients of the polynomial to the verifying end. In the evaluation phase, the proving end calculates the value of the polynomial based on the commitment, where the open points are selected by the verifying end, and the proving end proves to the verifying end that the calculated polynomial is the one committed in the commitment phase.

[0134] Commitment phase: The purpose of this phase is to prove the end-pair polynomial. Generate a commitment that has the binding property, meaning that one commitment corresponds to one specific polynomial. First, set the coefficients... Represent as The matrix, for the matrix Encode, Representative to each line The matrix is ​​obtained by encoding with linear code. Then, on Encode each column to obtain ;for Each column treats each symbol as a Merkle tree data block and then performs a Merkle tree commitment to obtain N Merkle root nodes. Finally, these N Merkle root nodes are used as the data blocks of the Merkle tree to perform Merkle tree commitments to obtain the root node. The root value of the second Merkle tree commitment is used as the binding commitment.

[0135] Evaluation Phase: In this phase, the verifier knows a commitment. A point of evaluation and a value The proving end needs to convince the verifying end that it knows a polynomial. The commitment corresponding to this polynomial is and Upon receiving the commitment message from the certifying end, the verifying end sends a random vector. Because it is necessary to verify whether the verification end meets the requirements: each line Obtained using random foldablecode encoding The verification end is randomly selected. We'll verify each column.

[0136] Proof calculation:

[0137]

[0138] Verification end calculation: Then compare .

[0139] During the verification process, the proof end needs to send The verification end needs to use its own local encoding. ,Right now Then, during the comparison process, The proof needs to be sent and accompanied by Merkel's proof for verification. From a promise Corresponding Finally, when calculating the polynomial, a polynomial commitment scheme is used to... Treat it as a coefficient.

[0140] In the above process, The calculation is the inner product of two vectors, and one of the vectors is of the Lagrange form. Therefore, the inner product of these two vectors can be transformed into a multivariable linear polynomial. The coefficients of the multiple terms are At point The open value on the [unclear]. This process can be viewed as a polynomial commitment scheme, and the verification process requires evaluating the values ​​of different polynomials at random points multiple times. This process is optimized using a pre-defined batch processing algorithm. The Random foldable code encoding process uses a pre-defined verifiable encoding algorithm, which can outsource the encoding calculation process on the verification end to the proof end through a polynomial commitment scheme.

[0141] After the above optimizations, the large amount of vector inner product calculation overhead at the verification end in the entire Evaluation Phase is outsourced to the proof end through the multinomial commitment scheme. At the same time, the number of messages that need to be sent is greatly reduced, thus lowering the communication complexity.

[0142] For example, common inputs to a multinomial commitment scheme: points ( ;

[0143] Proof of the secret: Polynomial The coefficients, the coefficient matrix of the polynomial ;

[0144] Codeword parameters: and diagonal matrix ;

[0145] Output: Verification results Polynomial values ;

[0146] Multinomial commitment schemes include:

[0147] Commitment Phase:

[0148] Proof end row encoding , ,according to Column encoding, ;

[0149] right Make a Merkel tree commitment for each column. ;

[0150] right Making Merkel Tree promises to receive ;

[0151] send Provided to the verification end;

[0152] Evaluation Phase:

[0153] The verification end sends a random number Provide proof;

[0154] Random verification end The location of the test. correspond The List, Both the proof and verification ends execute the preset batch processing algorithm BatchEval. ;

[0155] If the preset batch processing algorithm passes, the result is... Conversely, the agreement is terminated.

[0156] Proof calculation Then, based on the random location selected by the verification end in the previous step... Both the proving and verifying ends execute a preset verifiable encoding algorithm. , , by diagonal matrix The parameters are derived from the definition of the randomfoldable code used;

[0157] If the preset verifiable encoding algorithm passes, then... Conversely, the agreement is terminated.

[0158] Verification and comparison If they are equal, the agreement passes; otherwise, the agreement is terminated.

[0159] Finally, a multinomial commitment scheme is used to open, i.e., run. The polynomial coefficients are At point The value above is complete.

[0160] For example, the polynomial commitment cryptography tools described above can be used to compile an information-theoretic secure proof system into a concise interactive proof system, and then the Fiat-Shamir transformation can be used to turn this system into a concise non-interactive proof system.

[0161] Based on the verifiable calculation methods of the above embodiments, various embodiments of the electronic device, computer-readable storage medium, and computer program product of this application are proposed below.

[0162] like Figure 9 As shown, Figure 9 This is a schematic diagram of an electronic device for performing a verifiable computation method according to an embodiment of this application. The electronic device 900 implemented in this application includes: a processor 920, a memory 910, and a computer program stored in the memory 910 and executable on the processor 920, wherein... Figure 9 The example uses a processor 920 and a memory 910.

[0163] The processor 920 and the memory 910 can be connected via a bus or other means. Figure 9 Taking the example of a connection between China and Israel via a bus.

[0164] Memory 910, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory 910 may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory 910 may optionally include remotely located memories 910 relative to processor 920, which can be connected to electronic device 900 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0165] Those skilled in the art will understand that Figure 9 The structure shown does not constitute a limitation on the electronic device 900, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0166] exist Figure 9 In the illustrated electronic device 900, the processor 920 can be used to call the control program stored in the memory 910, thereby implementing the verifiable calculation method described above. Specifically, the non-transitory software program and instructions required to implement the verifiable calculation method of the above embodiments are stored in the memory 910, and when executed by the processor 920, the verifiable calculation method of the above embodiments is executed.

[0167] It is worth noting that since the electronic device 900 of this application embodiment can execute the verifiable calculation method of any of the above embodiments, the specific implementation method and technical effect of the electronic device 900 of this application embodiment can refer to the specific implementation method and technical effect of the verifiable calculation method of any of the above embodiments.

[0168] Furthermore, one embodiment of this application provides a computer-readable storage medium storing computer-executable instructions for performing the verifiable computation method described above. Exemplarily, the above-described method is executed... Figure 1 , Figures 3 to 8 The methods and steps in the text.

[0169] It is worth noting that, since the computer-readable storage medium of this application embodiment is capable of executing the verifiable computation method of any of the above embodiments, the specific implementation and technical effects of the computer-readable storage medium of this application embodiment can be referred to the specific implementation and technical effects of the verifiable computation method of any of the above embodiments.

[0170] Furthermore, one embodiment of this application also provides a computer program product, including a computer program or computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer program or computer instructions from the computer-readable storage medium and executes the computer program or computer instructions, causing the computer device to perform the verifiable computation method described above. Exemplarily, the above-described method is performed... Figure 1 , Figures 3 to 8 The methods and steps in the text.

[0171] It is worth noting that, since the computer program product of this application embodiment can execute the verifiable calculation method of any of the above embodiments, the specific implementation method and technical effect of the computer program product of this application embodiment can refer to the specific implementation method and technical effect of the verifiable calculation method of any of the above embodiments.

[0172] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which may include computer storage media or non-transitory media and communication media or transient media. As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc DVD or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0173] In the several embodiments provided in this application, it should be understood that the disclosed systems, instruments, and methods can be implemented in other ways. For example, the instrument embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between instruments or units may be electrical, mechanical, or other forms. Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, i.e., they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0174] It should also be understood that the various implementation methods provided in this application can be combined arbitrarily to achieve different technical effects.

[0175] The embodiments of this application have been described in detail above with reference to the accompanying drawings. However, this application is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of this application.

Claims

1. A verifiable computation method based on multinomial commitments, characterized in that, include: The coefficient vector of the target polynomial is linearly encoded, and a corresponding binding commitment is generated based on the hierarchical hash commitment. The binding commitment is then sent to the verification end. In response to a random challenge initiated by the verification end, an intermediate vector is generated based on the random challenge and the coefficient vector; In response to multiple random numbers sent by the verification end, if the first proof of the proof end is determined to be successful through the binding commitment, a first verification value is obtained. The first proof of the proof end is a proof obtained by compressing multiple proofs for multiple random numbers through a preset batch processing algorithm. If the second proof of the proof end is confirmed to be successful through the binding commitment, a second verification value is obtained. The second proof of the proof end is an encoded proof of the intermediate vector transferred from the verification end to the proof end through a preset verifiable encoding algorithm. If the first verification value is equal to the second verification value, the correctness of the evaluation result of the target polynomial at the specified point is confirmed by evaluating the commitment of the basic polynomial. The step of linearly encoding the coefficient vector of the target polynomial and generating a corresponding binding commitment based on the hierarchical hash commitment includes: The coefficient vector is structurally reorganized and double linearly encoded, and a hierarchical hash tree is constructed based on the result of the double linear encoding to generate binding commitments; The step of performing structured recombination and bilinear encoding on the coefficient vector, and constructing a hierarchical hash tree based on the result of the bilinear encoding to generate binding commitments, includes: The coefficient vector is rearranged into a matrix, and the row vectors of the matrix are subjected to a first linear encoding to obtain a row encoding matrix. The column vectors of the row encoding matrix are subjected to a second linear encoding to obtain an extended encoding matrix. A first Merkle tree commitment is generated for each column of the extended coding matrix, and a second Merkle tree commitment is generated based on the root value of the first Merkle tree commitments for all columns. The root value of the second Merkle tree commitment is used as the binding commitment. The generation of the intermediate vector based on the random challenge and the coefficient vector includes: Based on the random challenge, the coefficient vector is linearly transformed to generate an intermediate vector; The method further includes: Based on the random challenge and the coefficient vector, calculate the evaluation results of the polynomials corresponding to multiple dimensions of the coefficient vector; The step of verifying the correctness of the evaluation result of the target polynomial at a specified point by evaluating the fundamental polynomial commitment when the first verification value and the second verification value are equal includes: If the first verification value and the second verification value are equal at the same index, a proof of the evaluation of the polynomial with the intermediate vector as coefficients at the specified point is generated by the evaluation algorithm of the basic polynomial commitment. If the proof of evaluation is verified, the evaluation result of the target polynomial at the specified point is confirmed to be correct.

2. The method according to claim 1, characterized in that, The first verification value is obtained in response to multiple random numbers sent by the verification end, provided that the first proof from the verification end is successful through the binding commitment. This includes: In response to multiple location indices sent by the verification end and multiple evaluation results corresponding to the multiple location indices provided by the proof end, if the aggregated proof generated and verified by the preset batch processing algorithm passes the verification and is consistent with the binding commitment, the first verification value is obtained; the first verification value includes the multiple evaluation results, and the aggregated proof is used to simultaneously verify the correctness of the multiple evaluation results.

3. The method according to claim 1, characterized in that, The process of obtaining a second verification value upon confirming the second proof at the proof end through the binding commitment includes: If the encoding proof is verified and consistent with the binding commitment, a second verification value is obtained; the encoding proof is used to confirm that the intermediate vector is correctly encoded, and the second verification value includes the encoding value of the intermediate vector at the corresponding positions of the plurality of random numbers.

4. An electronic device, characterized in that, The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for enabling communication between the processor and the memory. The program is executed by the processor to implement the verifiable computation method as described in any one of claims 1 to 3.

5. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing a computer to perform the verifiable computation method as described in any one of claims 1 to 3.

6. A computer program product, said computer program product comprising a computer program or computer instructions, characterized in that, The computer program or the computer instructions are stored in a computer-readable storage medium, the processor of the computer device reads the computer program or the computer instructions from the computer-readable storage medium, and the processor executes the computer program or the computer instructions, causing the computer device to perform the verifiable computation method as described in any one of claims 1 to 3.

Images