An extensible privacy-preserving distributed product checking method and system

Abstract

The present application relates to a kind of extensible privacy protection distributed product checking method and system, comprising: the input vector is split into at least two random additive share for each element based on the additive secret sharing mechanism of label of principal, the message authentication code is calculated as authentication label for each element, and share and corresponding authentication label are distributed to each computing node of each CSP cluster;Each computing node independently executes the product calculation of corresponding share in parallel, obtains each local cumulative result share;Each cumulative result share received and own cumulative result share are aggregated to obtain regional result by polynomial addition;Principal converges all regional results, reconstructs global partial product based on regional result and performs integrity verification, to solve the sequential computing bottleneck and privacy protection problem in prior art in product checking.

Description

Technical Field

[0001] This invention relates to the fields of zero-knowledge proof acceleration and multi-party secure computation technology, and in particular to a scalable and privacy-preserving distributed product checking method and system. Background Technology

[0002] Zero-knowledge proofs have become a research hotspot in cryptography due to their wide applications in areas such as blockchain scaling, privacy-preserving computation, and identity authentication. PLONK (Permutations over Lagrange-bases for Oecumenical Noninteractive Arguments of Knowledge), as a general and efficient zero-knowledge proof system, has become one of the mainstream choices in industry and academia due to its advantages such as universal trusted settings, fewer constraints, and support for various circuit descriptions.

[0003] However, the proof generation process (Prover computation) of PLONK is computationally expensive, becoming a key bottleneck restricting its practical application. In the PLONK protocol, the prover needs to perform a large number of product checking calculations, specifically calculating partial products of a series of single-variable polynomials:

[0004]

[0005] in It is a polynomial for encoding witness. It is a unit root. This computational process inherently exhibits strong sequential dependencies: the result at each prefix position must be obtained through multiplication based on the result at the previous position, constituting a typical "prefix product" problem. In a single-machine environment, this sequential computation severely limits processing speed and the scale of data that can be processed.

[0006] To overcome this bottleneck, existing technologies attempt to accelerate the process through parallelization using distributed computing. For example, solutions like zkSaaS propose a parallelization strategy: splitting the input vector into... Continuous blocks and distributed to There are several computation nodes, each independently calculating the prefix product within its local block. However, to obtain the final global prefix product, each node must multiply its local result by the cumulative product of all its predecessor nodes. This cross-block multiplication operation reintroduces sequential dependencies and communication coupling between nodes, resulting in high computational complexity for each node, which increases with the number of nodes. With the increase in communication overhead, the scalability and speedup of the system are severely limited.

[0007] A Chinese patent titled "A Data Proof System Based on zkSNARKs and Blockchain (Authorization Announcement No. CN118540067A)" discloses a data proof system based on zkSNARKs and blockchain. This system constructs a proof circuit and generates zero-knowledge proofs via a server, completing proof verification and data storage within the blockchain network, thereby achieving data privacy protection and the immutability of the proof results. However, the above technical solution mainly focuses on the application and verification mechanism of zero-knowledge proofs in the blockchain environment, without optimizing the computational complexity of the proof generation stage. In zkSNARKs systems, the proof generation process typically requires large-scale polynomial operations and product checks, with computational overhead far exceeding that of the verification stage. This patent does not address the high computational complexity issue in the proof generation process. Another example is a Chinese patent titled "A GPU-based PLONK Algorithm Acceleration Method (Authorization Announcement No. CN113467951A)." This solution accelerates the data processing and encryption operations in the PLONK algorithm using the parallel computing capabilities of GPUs, thereby improving the computational efficiency in the zero-knowledge proof generation process. This method leverages the high parallel computing capabilities of GPUs to segment and process input data in parallel, thereby shortening proof generation time. However, the aforementioned technical solution primarily relies on the hardware parallelism of GPUs to accelerate the PLONK algorithm, focusing its optimization on parallel execution at the computational resource level, without improving the core mathematical computation structure in the PLONK proof generation process. In particular, for the product check calculation process with strong sequential dependencies in the proof generation stage, this solution still uses the original sequential computation model.

[0008] Furthermore, in cloud computing or outsourced computing scenarios, the data (witness) of the prover often contains sensitive user information (such as transaction amounts, identity information, etc.), and the correctness of the calculation results needs to be reliably guaranteed. Therefore, how to achieve efficient, verifiable, and scalable distributed product checking computation while protecting data privacy is a core technical challenge that urgently needs to be solved in the field of zero-knowledge proof acceleration. Summary of the Invention

[0009] This invention addresses the technical problems existing in the prior art by providing a scalable and privacy-preserving distributed product checking method and system. It aims to solve the sequential computation bottleneck and privacy protection problem in the existing product checking, and achieve efficient parallel acceleration of product checking in the PLONK protocol while protecting data privacy and ensuring the authentication of calculation results.

[0010] According to a first aspect of the present invention, a scalable and privacy-preserving distributed product checking method is provided, comprising:

[0011] Step 1: Based on the additive secret sharing mechanism of the tag, the principal splits each element of the input vector into at least two random additive shares, generates a global private key to calculate the message authentication code for each element as an authentication tag, and distributes the shares and the corresponding authentication tags to each computing node of each CSP cluster.

[0012] Step 2: Each computing node performs the product calculation of its corresponding share in parallel and independently to obtain the local cumulative result share.

[0013] Step 3: Divide the computing nodes into regions. The designated computing node in each region acts as the region coordinator. After receiving the cumulative result share sent by other paired computing nodes, it performs polynomial addition aggregation on the received cumulative result share and its own cumulative result share to obtain the regional result.

[0014] Step 4: The client gathers all regional results, reconstructs the global partial product based on the regional results, and performs integrity verification.

[0015] Based on the above technical solution, the present invention can also be improved as follows.

[0016] Optionally, step 1 includes:

[0017] Step 101: Define the input vector as the polynomial coefficients of the encoded witness in the PLONK protocol. ,in, The length of the vector;

[0018] Step 102, Calculate the authentication label The authentication tags are fractionalized to satisfy the following: ;in, Represents the i-th element Data share, Represents the i-th element The authentication label corresponding to the data share This represents the global private key generated by the delegator;

[0019] Step 103: Generate certified Beaver multiplication triplet shares ,in ;

[0020] Step 104: Distribute the data share, authentication tag, and multiplication triple share to each compute node on each CSP cluster, and allocate a contiguous data block to each compute node. , ;in, This indicates the number of compute nodes deployed within the CSP cluster and the size of each data block. .

[0021] Optionally, step 2 includes:

[0022] Step 201: The computing node traverses from the first element to the last element in the order of the index within the data block, and initializes the local cumulative result share to the multiplication unit share.

[0023] Step 202: Update the partial product share of the current position, and update the cumulative result share and the corresponding authentication tag based on the partial product share of the current position.

[0024] Optionally, the method for updating the partial product share at the current position in step 202 includes:

[0025] Step 20201, for data blocks The first Each element, the computing node calculates the blinding value using its held triplet share:

[0026]

[0027]

[0028] in, Indicates the first Partial product share of each element Indicates to The value after blinding Indicates to The value after blinding;

[0029] Step 20202: Reconstruct the blinding value through protocol interaction, and update the partial product share of the current position based on the reconstructed blinding value as follows:

[0030]

[0031] in, Indicates the current position (number). +1 element's partial product share, index Indicates the current computing node .

[0032] Optionally, step 3 includes:

[0033] Pair N compute nodes within a CSP cluster into N / 2 regions;

[0034] The compute nodes with even-numbered indices in each region are defined as region coordinators, and the compute nodes with odd-numbered indices are defined as ordinary compute nodes.

[0035] The ordinary computing node sends its local cumulative result share set to the corresponding regional coordinator.

[0036] Optionally, the formula for obtaining the region result by polynomial addition aggregation in step 3 is:

[0037]

[0038] in, Variables representing polynomials, This indicates the region result, where the subscript k represents the region number and the subscript u represents the CSP cluster sequence number. The set of indexes containing the regional coordinator itself, where I represents the set of indexes, and the superscript... Indicates the serial number of the regional coordinator; This represents the global evaluation domain of the entire PLONK protocol, where... For a finite field The upper level is The primitive unit root, m represents The serial number.

[0039] Optionally, step 4 includes:

[0040] Step 401: The client performs a very lightweight algebraic summation on all regional results to obtain a global polynomial share, and then extracts the final plaintext polynomial and the corresponding authentication tag polynomial from the global polynomial share.

[0041] Step 402, the delegator uses the global private key it holds. A consistency check is performed on the final plaintext polynomial and its corresponding authentication tag.

[0042] Optionally, in step 401, the global polynomial share is calculated as follows:

[0043]

[0044] in, Represents the global polynomial share. This represents the region polynomial share, u represents the CSP cluster index, and k represents the region coordinator index. The number of regional coordinators;

[0045] The final plaintext polynomial and the corresponding authentication tag polynomial are:

[0046]

[0047]

[0048] in, Represents the final plaintext polynomial. This represents the corresponding authentication label polynomial. and These represent the global polynomial shares of the two CSP clusters, respectively. and These represent the authentication tags for the two CSP clusters, respectively.

[0049] Optionally, in step 402, the Schwartz-Zippel lemma is used to perform compression verification. The relationship for consistency verification at the local physical closed-loop terminal is as follows: .

[0050] According to a second aspect of the present invention, a scalable and privacy-preserving distributed product checking system is provided, comprising: a principal, a CSP cluster, and computing nodes; wherein the computing nodes are deployed on the CSP cluster;

[0051] The delegator, based on the additive secret sharing mechanism of the label, splits each element of the input vector into at least two random additive shares, generates a global private key to calculate a message authentication code for each element as an authentication label, and distributes the shares and the corresponding authentication labels to each computing node of each of the CSP clusters.

[0052] Each of the aforementioned computing nodes performs the product calculation of its corresponding share in parallel and independently to obtain the local cumulative result share;

[0053] Each computing node is divided into regions. The designated computing node in each region acts as the region coordinator. After receiving the cumulative result share sent by other paired computing nodes, the node performs polynomial addition aggregation on the received cumulative result share and its own cumulative result share to obtain the regional result.

[0054] The client aggregates all regional results, reconstructs the global partial product based on the regional results, and performs integrity verification.

[0055] This invention provides a scalable and privacy-preserving distributed product checking method and system, achieving true linear scalability: By eliminating sequential multiplication dependencies across blocks, this invention reduces the computational complexity of each node from that of existing technologies. Reduce to This achieves a near-linear speedup. As the number of nodes increases... As the computation time increases, the computation time decreases inversely, theoretically allowing for unlimited expansion and significantly improving the system's computational efficiency under large-scale data. The highly efficient hierarchical aggregation architecture employs a hierarchical architecture of "local computation → regional aggregation → global aggregation," distributing communication and aggregation pressure to coordinators at various levels, avoiding broadcast or point-to-point communication storms across the entire network. Regional coordinators only need to communicate with one node within their region, and delegators only need to communicate with... Communication between regional coordinators significantly reduces communication complexity and improves computational efficiency and system performance. Dual protection of privacy and integrity: Based on an authenticated secret-sharing protocol, this invention ensures all computations are performed on encrypted (shared) data, guaranteeing absolute privacy of input data. Through cryptographic authentication mechanisms and final boundary constraint verification, even if some nodes (such as all nodes within the same cloud service provider) act maliciously, the computation results cannot be tampered with undetected. Security is based on the non-collusion assumption, achieving information theory security levels and ensuring system reliability under high security requirements. Applicable to multi-cloud / hybrid cloud environments: The system architecture of this invention is naturally adapted to multi-cloud or hybrid cloud environments, allowing computational tasks to be distributed across nodes of multiple cloud service providers. This design fully leverages the elastic resource advantages of cloud computing, avoiding the lock-in risk of a single cloud service provider, while adhering to the non-collusion assumption, enhancing the system's practicality and security, and providing greater flexibility and scalability. Efficient and secure computation process: The distributed computing structure and communication strategy of this invention enable higher computational efficiency while ensuring privacy protection and effectively reducing data transmission overhead. Each computing node processes only local data and achieves efficient parallel computing through hierarchical aggregation and optimal solution feedback mechanisms, while ensuring the confidentiality and integrity of the data. Attached Figure Description

[0056] Figure 1 A flowchart illustrating an embodiment of a scalable and privacy-preserving distributed product checking method provided by the present invention;

[0057] Figure 2 This is an overall architecture diagram of an embodiment of a scalable and privacy-preserving distributed product checking system provided by the present invention.

[0058] Figure 3 This is a schematic diagram of the logical structure of an embodiment of a scalable and privacy-preserving distributed product checking system provided by the present invention. Detailed Implementation

[0059] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0060] Figure 1A flowchart illustrating an embodiment of the scalable and privacy-preserving distributed product checking method provided by the present invention is shown below. Figure 1 As shown, this distributed product checking method includes:

[0061] Step 1: The delegator, based on the additive secret sharing mechanism (ASS) based on tags, splits each element of the input vector into at least two random additive shares, generates a global private key to calculate a message authentication code (IT-MAC, Information-Theoretic MAC) for each element as an authentication tag, and distributes the shares and corresponding authentication tags to each computing node of each CSP cluster.

[0062] In practice, the number of randomly additive shares split corresponds to the number of CSP clusters.

[0063] Step 2: Each computing node independently and in parallel performs the product calculation of its corresponding share to obtain the local cumulative result share.

[0064] Step 3: Divide the computing nodes into regions. The designated computing node in each region acts as the region coordinator. After receiving the cumulative result share sent by other paired computing nodes, it performs polynomial addition aggregation on the received cumulative result share and its own cumulative result share to obtain the regional result.

[0065] Step 4: The client gathers all regional results, reconstructs the global partial product based on the regional results, and performs integrity verification.

[0066] This invention provides a scalable and privacy-preserving distributed product checking method. By reconstructing the product checking constraint system, the computation process is decomposed into: each computing node independently performs intra-block product calculation based on an additive secret shared share; a regional coordinator homomorphically aggregates the local results of adjacent nodes; and a delegator performs the final aggregation of regional results and constructs data label constraints to complete integrity verification. This method deconstructs the cross-block sequential multiplication dependency, achieving linear scalability of the computation task and significantly reducing the computational complexity of a single node. Simultaneously, by combining authentication label technology, it ensures data privacy and result authentication throughout the computation process, effectively improving the efficiency and security of large-scale product checking. It aims to solve the sequential computation bottleneck and privacy protection challenges existing in product checking technologies.

[0067] Example 1

[0068] Embodiment 1 provided by this invention is an embodiment of a scalable and privacy-preserving distributed product checking method provided by this invention, such as... Figure 2 This invention provides an overall architecture diagram and logical structure schematic diagram of an embodiment of a scalable and privacy-preserving distributed product checking system, combined with... Figures 1-3It can be seen that embodiments of this distributed product checking method include:

[0069] Step 1: Based on the additive secret sharing mechanism of tags, the delegator splits each element of the input vector into at least two random additive shares, generates a global private key to calculate a message authentication code for each element as an authentication tag, and distributes the shares and corresponding authentication tags to each computing node of each CSP cluster.

[0070] In one possible embodiment, step 1 includes:

[0071] Step 101: Define the input vector as the polynomial coefficients of the encoded witness in the PLONK protocol. ,in, The length of the vector is given, and each element belongs to a finite field. .

[0072] Step 102, Calculate the authentication label The certification labels are fractionalized to meet the following requirements: ;in, Represents the i-th element Data share, Represents the i-th element The authentication label corresponding to the data share This represents the global private key generated by the delegator.

[0073] In practice, when splitting into two random additive shares, for the input vector any i-th element Randomly generated shares make .

[0074] Step 103: Generate certified Beaver multiplication triplet shares ,in It supports subsequent nonlinear multiplication operations.

[0075] In practice, the share of the multiplication triple can be the share of the Beaver triple.

[0076] Step 104: Distribute the data share, authentication tag, and multiplication triple share to each compute node on each CSP cluster, and allocate a contiguous data block to each compute node. , ;in, This indicates the number of compute nodes deployed within the CSP cluster and the size of each data block. .

[0077] The delegator uses a global private key. A Message Authentication Code (MAC) is calculated for each element as an authentication tag, and then the authentication tag is isomorphically split into two additive tag shares. After the delegator distributes the data block, the corresponding authentication share, and the pre-generated multiplicative triple share to the non-colluding computing node cluster, it can safely go offline.

[0078] In one possible implementation, when there are two CSP clusters, the authentication share is distributed to the individual compute nodes on both CSP clusters. Data share and its certification information Cluster Data share and its certification information .

[0079] Step 2: Each computing node independently and in parallel performs the product calculation of its corresponding share to obtain the local cumulative result share.

[0080] In one possible embodiment, step 2 includes:

[0081] Step 201, Calculate the nodes Iterate through the data blocks sequentially from the first element to the last element, following the index order within the data block, and initialize the local cumulative result share to a multiplicative unit share. .

[0082] Step 202: Update the partial product share of the current position, and update the cumulative result share and the corresponding authentication label based on the partial product share of the current position.

[0083] In one possible embodiment, the method for updating the partial product share of the current position in step 202 includes:

[0084] Step 20201, for data blocks The first Each element is a compute node that performs a certified homomorphic multiplication operation by invoking the triplet multiplication protocol. The compute node then uses its held Beaver triplet shares to calculate the blinded value.

[0085]

[0086]

[0087] in, Indicates the first Partial product share of each element Indicates to The value after blinding Indicates to The value after blinding.

[0088] Step 20202: Reconstruct the blinding value through protocol interaction, and update the partial product share of the current position based on the reconstructed blinding value:

[0089]

[0090] in, Indicates the current position (number). +1 element's partial product share, index Indicates the current computing node .

[0091] Simultaneously, the cumulative result share and its corresponding MAC tag are updated to ensure the integrity of the intermediate calculation process. After each multiplication operation, the node stores a portion of the product share for its current position: .

[0092] All N computing nodes simultaneously update the cumulative result share. Intra-block computations do not involve cross-region communication; secure multiplication interactions are performed only in fixed rounds between computing parties participating in the same secret-sharing protocol. Each computing node obtains a partial product share for all positions within its block, which serves as input for subsequent aggregation steps.

[0093] After receiving consecutive data block shares, the compute node independently calculates the partial product sequence within that block based on its held data shares and authentication tags. During the iteration process within the block, the compute node uses its held multiplication triplet shares to perform authenticated homomorphic interactive multiplication operations based on the ciphertext field, calculates the ciphertext product of the current cumulative result and the next element, and synchronously updates the authentication tag shares, thus avoiding the dependency on global serial computation.

[0094] Step 3: Divide the computing nodes into regions. The designated computing node in each region acts as the region coordinator. After receiving the cumulative result share sent by other paired computing nodes, it performs polynomial addition aggregation on the received cumulative result share and its own cumulative result share to obtain the regional result.

[0095] In one possible embodiment, step 3 includes:

[0096] Pair N compute nodes within a CSP cluster into N / 2 regions.

[0097] The compute nodes with even-numbered indices in each region (such as...) ) is defined as the regional coordinator, the computation node of the odd index ( ) is defined as a regular computing node.

[0098] Ordinary computing nodes will collect the local cumulative result share set. Send to the corresponding regional coordinator .

[0099] During transmission, the data remains in fractional form, without revealing the original information.

[0100] The regional coordinator receives the cumulative result share set and combines it with its own local calculation results. Perform polynomial addition aggregation. The regional coordinator, based on the publicly available global Lagrange base polynomial, calculates a partial share of the global constraint polynomial for its own index set. This constructs the constraint polynomial partial share belonging to the region. This step transforms the local computational relationships of the underlying data points into global constraint fragments at the algebraic polynomial level.

[0101] In one possible embodiment, the formula for obtaining the region result by polynomial addition aggregation in step 3 is:

[0102]

[0103] in, Variables representing polynomials, This indicates the region result, where the subscript k represents the region number and the subscript u represents the CSP cluster sequence number. The set of indexes containing the regional coordinator itself, where I represents the set of indexes, and the superscript... Indicates the serial number of the regional coordinator; This represents the global evaluation domain of the entire PLONK protocol, where... For a finite field The upper level is The primitive unit root, m represents The number of ordinal numbers; the product of bases is the global field. This ensures that the shares generated independently in each region have a globally consistent algebraic structure.

[0104] Step 4: The client gathers all regional results, reconstructs the global partial product based on the regional results, and performs integrity verification.

[0105] The principal reconnects, receives the regional constraint polynomial shares uploaded by each regional coordinator, aggregates them into a global polynomial share using a lightweight polynomial addition operation, and reconstructs the plaintext state. In one possible embodiment, step 4 includes:

[0106] Step 401: The client performs a very lightweight algebraic summation on all regional results to obtain the global polynomial share, and then extracts the final plaintext polynomial and the corresponding authentication tag polynomial from the global polynomial share.

[0107] In one possible embodiment, the global polynomial share is calculated in step 401 as follows:

[0108]

[0109] in, Represents the global polynomial share. This represents the region polynomial share, u represents the CSP cluster index, and k represents the region coordinator index. This refers to the number of regional coordinators.

[0110] The final plaintext polynomial and the corresponding authentication tag polynomial are:

[0111]

[0112]

[0113] in, Represents the final plaintext polynomial. This represents the corresponding authentication label polynomial. and These represent the global polynomial shares of the two CSP clusters, respectively. and These represent the authentication tags for the two CSP clusters, respectively.

[0114] Step 402, the delegator uses the global private key they hold. A consistency check is performed on the final plaintext polynomial and its corresponding authentication label.

[0115] In one possible embodiment, step 402 employs the Schwartz-Zippel lemma to perform compression verification, and the relationship for consistency verification at the local physical closed-loop terminal is as follows: .

[0116] Subsequently, the client, based on a random challenge mechanism (Schwartz-Zippel lemma), selects verification points to perform dimensionality-reduced consistency checks on the global result polynomial and its authentication label polynomial. If the verification passes, the final partial product result sequence is output; if the verification fails, the output is rejected and a security interception is triggered.

[0117] In practice, when the consistency verification passes, it indicates that all local computations and intermediate aggregations have been executed correctly, and the system outputs the final computation result share for use in the subsequent PLONK proof construction steps; when the consistency verification fails, it indicates that there is malicious tampering or computation error during the computation process, the system triggers a security alarm, and optionally starts an error recovery process (such as reassigning computation tasks).

[0118] This invention is applied to the product checking calculation stage of zero-knowledge proof protocols, providing a scalable and privacy-preserving distributed product checking method and system. It is applicable to application scenarios that rely on zero-knowledge proofs, such as blockchain scaling, privacy-preserving computation, and identity authentication. It solves the technical problems existing in the product checking calculation of zero-knowledge proof protocols, such as the performance bottleneck of sequential computation, the difficulty of distributed parallel expansion, data privacy leakage during the calculation process, and the unverifiable results.

[0119] This invention fundamentally restructures the constraint system of some products in the PLONK protocol, delaying cross-block sequential dependencies to the hierarchical aggregation stage. A structured constraint reorganization mechanism avoids real-time inter-block communication dependencies, thereby achieving complete parallelism in the computation stage. This achieves truly dependency-free parallel computing. Specifically, this invention decomposes the global product check computation into two stages: "local block computation" and "hierarchical aggregation verification." Through a structured constraint decomposition mechanism, each computing node can complete its local computation completely independently, and the entire product check computation process can be completed only in the final stage through a lightweight global aggregation and verification.

[0120] Meanwhile, this invention deeply integrates the aforementioned parallel computing architecture with label-based additive secret sharing technology to construct a complete, scalable, and privacy-preserving distributed product checking protocol. This mechanism allows each computing node to perform homomorphic operations in ciphertext state, holding only an additive data share and its corresponding authentication label (MAC). This not only guarantees the absolute privacy of the original data but also achieves proactive defense against malicious tampering through a cryptographic label verification mechanism. Furthermore, throughout the entire core computing process, the computing delegation party does not need to remain online or participate in the interaction.

[0121] Example 2

[0122] Embodiment 2 of this invention is an example of a scalable and privacy-preserving distributed product checking system provided by this invention. To adapt to the zero-trust assumption in a multi-party secure computation (MPC) environment, this system adopts a physical and logical separation architecture based on the roles of multiple participating parties, combined with... Figures 1-3 It is known that the implementation of this distributed product checking system includes: a principal, a CSP cluster, and computing nodes; the computing nodes are deployed on the CSP cluster.

[0123] The delegator uses a tag-based additive secret sharing mechanism to split each element of the input vector into at least two random additive shares, generates a global private key to calculate a message authentication code for each element as an authentication tag, and distributes the shares and corresponding authentication tags to each computing node in each CSP cluster.

[0124] Each computing node executes the product calculation of its corresponding share independently in parallel to obtain the local cumulative result share.

[0125] Each computing node is divided into regions. The designated computing node in each region acts as the regional coordinator. After receiving the cumulative result share sent by other paired computing nodes, it performs polynomial addition aggregation on the received cumulative result share and its own cumulative result share to obtain the regional result.

[0126] The client aggregates all regional results, reconstructs the global partial product based on the regional results, and performs integrity verification.

[0127] In one possible embodiment, unlike the aforementioned highly generalized logical division, this embodiment focuses on the engineering deployment and specific data flow mechanisms of each participating party in the actual network topology. Physically, the system consists of trusted local computing terminals and multiple non-colluding cloud service provider clusters on a wide area network. Based on a tag-based additive secret sharing underlying cryptographic library, the system personifies computing entities into three main hardware and service roles: the principal, the ordinary computing node cluster, and the regional coordinator.

[0128] In specific project deployments, the client acts as a secure physical terminal (such as a secure workstation or controlled edge device) deployed locally on the data owner's premises. Running on a trusted local physical terminal, it controls the global key at the hardware level and is physically isolated from the external computing network. As the starting and ending point of the entire computing flow, it undertakes the dual responsibilities of "offline distribution" and "online verification".

[0129] Offline preprocessing and distribution: The terminal device is equipped with a random number generator and a MAC calculation engine. During initialization, the terminal maps the original plaintext vector to a finite field, obtains an input vector of length M, and uses local computing power to divide it into two additive secret shared shares. These shares are then combined with a global private key residing in local secure memory to generate a MAC authentication tag. After encapsulation, the terminal sends the encrypted data packet and auxiliary multiplication triple to the preset IP ports of each CSP node via secure channels such as TLS. Subsequently, it releases external network interface resources and enters a low-power offline state, achieving lightweight offline operation.

[0130] Online Collection and Result Verification Reconstruction: Once cloud computing is complete, the delegator re-enters the network and directly collects the intermediate polynomial shares returned by the regional coordinator. It then reconstructs the global shares locally using extremely low-complexity polynomial homomorphic addition operations and performs compressed batch verification of MAC tags using a global key known only to itself, based on a random challenge mechanism (Schwartz-Zippel lemma). Only after successful verification can the final partial product plaintext sequence be output for subsequent PLONK proof construction.

[0131] Ordinary computing nodes are deployed within the clusters of various cloud service providers (CSPs) to carry the core arithmetic logic in encrypted form.

[0132] In terms of engineering deployment, ordinary computing nodes are undertaken by a large number of heterogeneous computing instances (such as cloud servers, virtual machines, or container services) configured within each CSP, serving as a "computing power consumption cluster" at the bottom layer of the distributed architecture.

[0133] Each compute node instance receives a contiguous block of data (block size is...) allocated through the system's distribution script. During the execution phase, the node loads the received additive shares and labels into its local cache, utilizes local CPU or GPU computing power, and performs sequential iterations within the block according to the rules of finite field arithmetic. Specifically, the node frequently executes encapsulated authenticated homomorphic multiplication code routines within the ciphertext domain, performs interactive ciphertext computation and label evolution by consuming pre-allocated Beaver triples, generates a sequence of local prefix product discrete shares for all positions within the block, and finally outputs the local partial product shares for all positions within the data block, reporting them as intermediate results to the upper-layer route (i.e., the regional coordinator).

[0134] The regional coordinator acts as a high-bandwidth routing and local aggregation hub deployed within the cloud cluster. To break through the all-to-all communication bottleneck within the cloud computing cluster and reduce the network I / O pressure on delegators when retrieving results, the system dynamically or statically allocates some nodes (such as even-numbered index nodes) within the cloud computing cluster to serve as regional coordinators.

[0135] Aggregate Computation: In practical implementation, the system dynamically launches the aggregation listening service for a given role through a scheduler based on the node's physical IP range or process ID (e.g., selecting instances corresponding to even-numbered IDs). The regional coordinator opens specific internal communication VPC ports to receive local intermediate result caches pushed by physically or logically adjacent ordinary nodes (e.g., instances with odd-numbered IDs). At the data processing level, the regional coordinator allocates independent computing threads to perform interpolation operations on the received discrete shares of adjacent blocks based on a publicly available global Lagrange polynomial, transforming the discrete local array encoding into "partially constrained polynomial shares".

[0136] Directed WAN Backhaul: Finally, the node serializes and encapsulates the transformed polynomial data blocks and securely backhauls them to the client terminal via the WAN egress route. This physical routing mechanism perfectly transforms global all-to-all communication into local tree-like aggregation, significantly reducing the peak bandwidth pressure of transmission to the external network and ensuring ultimate scalability in engineering. The regional coordinator is responsible for managing the paired nodes in its region, receiving intermediate discrete result shares sent by ordinary computing nodes in the same region, performing interpolation operations on them based on the global Lagrange polynomial, constructing the "partially constrained polynomial share" belonging to that region, and securely backhauling it to the client.

[0137] It is understood that the scalable and privacy-preserving distributed product checking system provided by the present invention corresponds to the scalable and privacy-preserving distributed product checking method provided in the foregoing embodiments. The relevant technical features of the scalable and privacy-preserving distributed product checking system can be referred to the relevant technical features of the scalable and privacy-preserving distributed product checking method, and will not be repeated here.

[0138] This invention provides a scalable and privacy-preserving distributed product checking method and system, achieving true linear scalability: By eliminating sequential multiplication dependencies across blocks, this invention reduces the computational complexity of each node from that of existing technologies. Reduce to This achieves a near-linear speedup. As the number of nodes increases... As the computation time increases, the computation time decreases inversely, theoretically allowing for unlimited expansion and significantly improving the system's computational efficiency under large-scale data. The highly efficient hierarchical aggregation architecture employs a hierarchical architecture of "local computation → regional aggregation → global aggregation," distributing communication and aggregation pressure to coordinators at various levels, avoiding broadcast or point-to-point communication storms across the entire network. Regional coordinators only need to communicate with one node within their region, and delegators only need to communicate with... Communication between regional coordinators significantly reduces communication complexity and improves computational efficiency and system performance. Dual protection of privacy and integrity: Based on an authenticated secret-sharing protocol, this invention ensures all computations are performed on encrypted (shared) data, guaranteeing absolute privacy of input data. Through cryptographic authentication mechanisms and final boundary constraint verification, even if some nodes (such as all nodes within the same cloud service provider) act maliciously, the computation results cannot be tampered with undetected. Security is based on the non-collusion assumption, achieving information theory security levels and ensuring system reliability under high security requirements. Applicable to multi-cloud / hybrid cloud environments: The system architecture of this invention is naturally adapted to multi-cloud or hybrid cloud environments, allowing computational tasks to be distributed across nodes of multiple cloud service providers. This design fully leverages the elastic resource advantages of cloud computing, avoiding the lock-in risk of a single cloud service provider, while adhering to the non-collusion assumption, enhancing the system's practicality and security, and providing greater flexibility and scalability. Efficient and secure computation process: The distributed computing structure and communication strategy of this invention enable higher computational efficiency while ensuring privacy protection and effectively reducing data transmission overhead. Each computing node processes only local data and achieves efficient parallel computing through hierarchical aggregation and optimal solution feedback mechanisms, while ensuring the confidentiality and integrity of the data.

[0139] In summary, this invention not only provides a more efficient computing solution, but also ensures privacy protection and data integrity in a distributed environment. It has good scalability, flexibility and security, and is suitable for practical applications in multiple industries, especially in the fields of cloud computing and big data processing, where it has broad prospects.

[0140] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0141] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0142] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0143] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0144] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0145] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0146] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A scalable and privacy-preserving distributed product checking method, characterized in that, The distributed product checking method includes: Step 1: Based on the additive secret sharing mechanism of the tag, the principal splits each element of the input vector into at least two random additive shares, generates a global private key to calculate the message authentication code for each element as an authentication tag, and distributes the shares and the corresponding authentication tags to each computing node of each CSP cluster. Step 2: Each computing node performs the product calculation of its corresponding share in parallel and independently to obtain the local cumulative result share. Step 3: Divide the computing nodes into regions. The designated computing node in each region acts as the region coordinator. After receiving the cumulative result share sent by other paired computing nodes, it performs polynomial addition aggregation on the received cumulative result share and its own cumulative result share to obtain the regional result. Step 4: The client aggregates all regional results, reconstructs the global partial product based on the regional results, and performs integrity verification. Step 1 includes: Step 101: Define the input vector as the polynomial coefficients of the encoded witness in the PLONK protocol. ,in, The length of the vector; Step 102, Calculate the authentication label The authentication tags are fractionalized to satisfy the following: ;in, Represents the i-th element Data share, Represents the i-th element The authentication label corresponding to the data share This represents the global private key generated by the delegator; Step 103: Generate certified multiplication triplet shares ,in ; Step 104: Distribute the data share, authentication tag, and multiplication triple share to each compute node on each CSP cluster, and allocate a contiguous data block to each compute node. , ;in, This indicates the number of compute nodes deployed within the CSP cluster and the size of each data block. ; Step 2 includes: Step 201: The computing node traverses from the first element to the last element in the order of the index within the data block, and initializes the local cumulative result share to the multiplication unit share. Step 202: Update the partial product share of the current position, and update the cumulative result share and the corresponding authentication tag based on the partial product share of the current position.

2. The distributed product checking method according to claim 1, characterized in that, The method for updating the partial product share at the current position in step 202 includes: Step 20201, for data blocks The first Each element, the computing node calculates the blinding value using its held triplet share: in, Indicates the first Partial product share of each element Indicates to The value after blinding Indicates to The value after blinding; Step 20202: Reconstruct the blinding value through protocol interaction, and update the partial product share of the current position based on the reconstructed blinding value as follows: in, Indicates the current position (number). +1 element's partial product share, index Indicates the current computing node .

3. The distributed product checking method according to claim 1, characterized in that, Step 3 includes: Pair N compute nodes within a CSP cluster into N / 2 regions; The compute nodes with even-numbered indices in each region are defined as region coordinators, and the compute nodes with odd-numbered indices are defined as ordinary compute nodes. The ordinary computing node sends its local cumulative result share set to the corresponding regional coordinator.

4. The distributed product checking method according to claim 1, characterized in that, The formula for obtaining the region result by polynomial addition aggregation in step 3 is as follows: in, Variables representing polynomials, This indicates the region result, where the subscript k represents the region number and the subscript u represents the CSP cluster sequence number. The set of indexes containing the regional coordinator itself, where I represents the set of indexes, and the superscript... Indicates the serial number of the regional coordinator; This represents the global evaluation domain of the entire PLONK protocol, where... For a finite field The upper level is The primitive unit root, m represents The serial number.

5. The distributed product checking method according to claim 1, characterized in that, Step 4 includes: Step 401: The client performs a very lightweight algebraic summation on all regional results to obtain a global polynomial share, and then extracts the final plaintext polynomial and the corresponding authentication tag polynomial from the global polynomial share. Step 402, the delegator uses the global private key it holds. A consistency check is performed on the final plaintext polynomial and its corresponding authentication tag.

6. The distributed product checking method according to claim 5, characterized in that, In step 401, the global polynomial share is calculated as follows: in, Represents the global polynomial share. This represents the region polynomial share, u represents the CSP cluster index, and k represents the region coordinator index. The number of regional coordinators; The final plaintext polynomial and the corresponding authentication tag polynomial are: in, Represents the final plaintext polynomial. This represents the corresponding authentication label polynomial. and These represent the global polynomial shares of the two CSP clusters, respectively. and These represent the authentication tags for the two CSP clusters, respectively.

7. The distributed product checking method according to claim 6, characterized in that, In step 402, the Schwartz-Zippel lemma is used to perform compression verification. The relationship for consistency verification at the local physical closed-loop terminal is as follows: .

8. A scalable and privacy-preserving distributed product checking system, characterized in that, The distributed product checking system includes: a principal, a CSP cluster, and computing nodes; the computing nodes are deployed on the CSP cluster. The delegator, based on the additive secret sharing mechanism of the label, splits each element of the input vector into at least two random additive shares, generates a global private key to calculate a message authentication code for each element as an authentication label, and distributes the shares and the corresponding authentication labels to each computing node of each of the CSP clusters. Each of the aforementioned computing nodes performs the product calculation of its corresponding share in parallel and independently to obtain the local cumulative result share; Each computing node is divided into regions. The designated computing node in each region acts as the region coordinator. After receiving the cumulative result share sent by other paired computing nodes, the node performs polynomial addition aggregation on the received cumulative result share and its own cumulative result share to obtain the regional result. The client aggregates all regional results, reconstructs a global partial product based on the regional results, and performs integrity verification. The process by which the principal distributes the share and the corresponding authentication tag to each of the computing nodes in each of the CSP clusters includes: Step 101: Define the input vector as the polynomial coefficients of the encoded witness in the PLONK protocol. ,in, The length of the vector; Step 102, Calculate the authentication label The authentication tags are fractionalized to satisfy the following: ;in, Represents the i-th element Data share, Represents the i-th element The authentication label corresponding to the data share This represents the global private key generated by the delegator; Step 103: Generate certified multiplication triplet shares ,in ; Step 104: Distribute the data share, authentication tag, and multiplication triple share to each compute node on each CSP cluster, and allocate a contiguous data block to each compute node. , ;in, This indicates the number of compute nodes deployed within the CSP cluster and the size of each data block. ; The process by which the computing nodes obtain their respective local cumulative result shares includes: Step 201: The computing node traverses from the first element to the last element in the order of the index within the data block, and initializes the local cumulative result share to the multiplication unit share. Step 202: Update the partial product share of the current position, and update the cumulative result share and the corresponding authentication tag based on the partial product share of the current position.

Images