Decentralized computing system and method

Abstract

To provide a decentralized processing system, method and storage medium that are accompanied by decentralization of computation tasks to one or more untrusted worker computer systems.SOLUTION: In a method, when an untrusted worker computer system executes calculation for a request computer system, the request computer system (or another verification request computer system) provides information enabling the request computer system to cryptographically verify that the task is completed correctly, the worker computer system provides information including proof and I / O data after the calculation is completed, and the request computer system uses setting, proof and I / O data of open verification key parameters to verify that the calculation executed by the untrusted worker computer system is correct, the calculation executed by a worker being related to a block chain transactions.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates generally to the operation of distributed computing systems, and more particularly to methods and systems for cryptographically verifying the correct completion of computing tasks distributed to and performed by third-party computer systems. Some embodiments of the present invention may be particularly well-suited for use in blockchain systems, although not exclusively so. [Background technology]

[0002] In this document, the term "blockchain" refers to any of several types of electronic, computer-based distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and unpermissioned ledgers, shared ledgers, and variations thereof. The most widely known application of blockchain technology is the Bitcoin® ledger, but other blockchain implementations have been proposed and developed. While this disclosure may refer to the example of Bitcoin for convenience and illustrative purposes, it should be noted that the present invention is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are within the scope of the present invention. For example, the present invention may be useful in other blockchain implementations that have similar limitations as Bitcoin regarding what constraints can be encoded in transactions.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a computer-based, decentralized, distributed system composed of blocks, which in turn are composed of transactions and other information. For example, in Bitcoin, each transaction is a data structure that encodes the transfer of control of a digital asset between participants in the blockchain system and includes at least one input and at least one output. In some embodiments, a "digital asset" refers to binary data associated with the right to use. Examples of digital assets include Bitcoin, Ether, and Litecoin. In some implementations, the transfer of control of a digital asset can be accomplished by reassociating at least a portion of the digital asset from a first entity to a second entity. Each block contains a hash of the previous block, thereby chaining blocks together to create a permanent, immutable record of all transactions written to the blockchain since its inception. Transactions contain small programs known as scripts embedded in their inputs and outputs, which specify how and who can access the transaction's output. In the Bitcoin platform, these scripts are written using a stack-based scripting language.

[0004] Generally, transactions are "validated" before they are written to the blockchain. Network nodes (miners) perform the work to ensure each transaction is valid, and invalid transactions are rejected by the network. Nodes can have different standards for validity than other nodes. Because validity in the blockchain is consensus-based, a transaction is considered valid if a majority of nodes agree that the transaction is valid. A software client installed on a node performs this validation work for transactions that reference unspent transaction (UTXO)s, in part by executing UTXO locking and unlocking scripts. A transaction is validated by a node if the execution of the locking and unlocking scripts evaluates to TRUE and other validation conditions, if applicable, are met. Validated transactions are propagated to other network nodes, and miner nodes can then choose to include the transaction in the blockchain. Therefore, for a transaction to be written to the blockchain, it must be i) verified by the first node that receives the transaction, which if verified, relays it to other nodes in the network; ii) added to a new block constructed by a miner; or iii) mined, i.e., added to the public ledger of past transactions. A transaction is considered confirmed when enough blocks have been added to the blockchain to make the transaction effectively irreversible.

[0005] While blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to explore the use of both the cryptographic security system upon which Bitcoin is based and the data that can be stored on the blockchain to realize new systems. It would be highly advantageous if blockchain could be used for automated tasks and processes that are not limited to the cryptocurrency realm. Such solutions would be more versatile in their application while also being able to take advantage of the benefits of blockchain (e.g., a permanent, tamper-proof record of events, distributed processing, etc.).

[0006] One area of ​​current research is the use of blockchain for the implementation of "smart contracts." Smart contracts are computer-implemented systems that automate the execution and / or validation of terms of contracts or agreements stored in a machine-readable format. Unlike traditional contracts, which are written in natural language, smart contracts are machine-readable descriptions of terms and conditions that can be processed by a computer system to produce results, which can then cause actions to be performed depending on those results.

[0007] Another area of ​​blockchain-related interest is the use of "tokens" (or "colored coins") to represent the transfer of real-world entities through the blockchain. Potentially sensitive or secret items can be represented by tokens that have no discernible meaning or value. The tokens thus act as identifiers that allow real-world items to be referenced from the blockchain.

[0008] In embodiments, a smart contract is "smart" in the sense that its creator or some other particular entity is not tasked with enforcing and / or executing the smart contract. That is, while interactions with particular entities may be encoded in specific steps within the smart contract, the smart contract is otherwise automatically executable and self-enforcing. It is machine-readable and executable. In some examples, automatically executing refers to any entity being able to unlock the UTXO and having an incentive (e.g., a reward) to do so. Note that in such examples, "any entity" that can unlock the UTXO refers to any entity that can create the unlock script without being required to prove knowledge of any secret. In other words, an unlock transaction is verifiable without verifying that the source of the data has access to a cryptographic secret (e.g., a private asymmetric key, a symmetric key, etc.). Furthermore, in such examples, self-enforcing refers to an attesting node in the blockchain network being forced to enforce the unlock transaction according to constraints. In some examples, "unlocking" a UTXO refers to creating an unlock transaction that references the UTXO and executes as valid. This is sometimes called "spending" the transaction.

[0009] A blockchain transaction output includes a locking script and information about the ownership of a digital asset, such as Bitcoin. A locking script, sometimes called an encumbrance, "locks" a digital asset by specifying conditions that must be met to unlock the output. For example, a locking script may require that specific data be provided within an unlocking script to unlock the associated digital asset. A locking script is also known as a "scriptPubKey" in Bitcoin. Techniques for requiring a party to provide data to unlock a digital asset include embedding a hash of the data within the locking script. However, this presents a problem if the data is undetermined (e.g., unknown and not fixed) when the locking script is created. Summary of the Invention

[0010] It would therefore be desirable to provide a method and system that improves distributed computing systems in one or more of these aspects. Such an improved solution has now been devised. Thus, according to the present invention, there is provided a method as defined in the appended claims.

[0011] It is therefore desirable to provide a computer-implemented method, the computer-implemented method including the steps of: providing a task to a set of independent computer systems that can compete to provide a result of the provided task, the task specifying a computation to be performed; and verifying, in a verifying computer system, that the computation is correctly performed by a worker computer system in the set of independent computer systems, the computation being based on a circuit having a set of multiplication gates by at least generating an evaluation key, providing the evaluation key to the worker computer system, and receiving a proof from the worker computer system, the proof being based at least in part on the evaluation key, generating a verification key, and verifying that the computation is correct using the proof and the verification key.

[0012] The verification key may be based on one or more of the inputs to the set of multiplication gates and the outputs of the set of multiplication gates. In one embodiment, the verification key is a public verification key, which may be published by the computer system.

[0013] The proof may be based at least in part on a set of intermediate outputs of the multiplication gate, hi one embodiment, the set of intermediate outputs excludes the final output of the circuit.

[0014] The evidence may be based at least in part on a public reputation key.

[0015] The proof and verification key may be based at least in part on a first generator and a second generator that generate different groups.

[0016] Preferably, the method may further comprise verifying that elements of the proof are consistent with elements of the evaluation key. In one embodiment, the evaluation key may be determined as follows, where i represents an index into an internal wire of the circuit, deg(t) is the degree of the polynomial t(x), and deg(t) is equal to the number of multiplication gates in the circuit:

number

[0017] Preferably, the method may further comprise the step of verifying that the elements of the proof are constructed using matching coefficients, which in one embodiment are checked for Vmid(s)P, Wmid(s)Q, and Ymid(s)P as follows:

number

[0018] Preferably, the method may further comprise the step of verifying a divisibility requirement for the terms of the proof. In one embodiment, the verifying entity verifies that the divisibility requirement is met by checking that:

number

[0019] The worker computer system may provide a set of I / O values ​​that correspond to the input and output values ​​of the circuit. In one embodiment, the I / O data are the inputs and outputs of the function being evaluated by the worker computer system.

[0020] A circuit may include one or more addition gates that are modeled for their contributions to multiplication gates. In one embodiment, a circuit can be viewed as a set of multiplication and addition gates, where the circuit includes m wires connected to d multiplication gates, and the addition gates are modeled for their contributions to the multiplication gates.

[0021] The calculation may be part of a Bitcoin transaction verification, or in a further embodiment, the calculation may be part of a blockchain transaction verification.

[0022] Verifying that the computation is correct may be accomplished by providing at least the proof, the verification key, and the set of I / O values ​​to a verification computer system, and receiving an indication that the computation is correct from the verification computer system. In one embodiment, the indication may be a cryptographically verifiable indication that the computation is correct, such as a digital signature generated with a key associated with the verification computer system.

[0023] The validating computer system may be a blockchain node or a Bitcoin node.

[0024] It is further desirable to provide a system including a processor and a memory containing executable instructions that, upon execution by the processor, cause the system to perform any of the claimed methods.

[0025] It is further desirable to provide a non-transitory computer-readable storage medium having stored thereon executable instructions that, upon execution by one or more processors of a computer system, cause the computer system to perform at least any of the claimed methods. [Brief explanation of the drawings]

[0026] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiment(s) described hereinafter. One embodiment of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which: [Figure 1] 1 illustrates a blockchain environment in which various embodiments may be implemented. [Figure 2] FIG. 1 is a swim diagram illustrating an example of a process that, when performed by a client computer system and a worker computer system, enables a client to verify work performed by a worker using a proof π and a verification key VK, according to one embodiment. [Figure 3] 1 illustrates an example of a circuit representing an arithmetic function according to one embodiment. [Figure 4] 1 is a flowchart illustrating an example of a process for determining a verification key VK when performed by a client computer system, according to one embodiment. [Figure 5] 1 is a flowchart illustrating an example of a process for verifying a computation performed by a worker computer system using a proof π when performed by a client computer system, according to one embodiment. [Figure 6] 1 illustrates a computing environment in which various embodiments may be implemented. DETAILED DESCRIPTION OF THE INVENTION

[0027] In a distributed computing environment, a single task may be divided into multiple subtasks, and the subtasks may be distributed among multiple computer systems for execution. Each of the multiple computer systems may perform one or more of the subtasks. In various examples, results generated by the individual computer systems are accumulated and aggregated by a collaborating computer system to generate a result for the original single task. Thus, in many embodiments, the collaborating computer system is interested in determining that each of the subtasks was executed correctly, thereby determining that the result generated for the original single task is correct. This is particularly problematic when the individual computer systems to which the subtasks are distributed are not fully trusted by the collaborating computer system. The systems and methods described herein allow a verifying computer system to cryptographically verify work performed by other computer systems, even though the other computer systems may be untrusted computer systems. This allows the collaborating computer system to distribute work to a wider set of computer systems that are not necessarily trusted, because the work generated can be cryptographically verified without reproducing the distributed subtasks.

[0028] This document uses various examples to describe a process by which work of untrusted worker computer systems can be verified. In some embodiments, work distributed to worker computer systems can be viewed as part of a logical circuit, and verification of work associated with some or all of that circuitry allows a verifier to proceed with other subtasks related to the logical circuit. In some implementations, information related to the performance and verification of subtasks is exchanged using a blockchain. However, the methods described herein are applicable to any distributed computing environment in which a verifying entity is required to verify work performed by one or more untrusted computer systems.

[0029] In this document, the following notation may be used: A mathematical group is a double-struck

number

number

number

number

number

number

[0030] Double-struck

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0031] This document describes one or more embodiments that use a Quadratic Arithmetic Program ("QAP"). In various embodiments, a general computation is performed over a field of prime order r.

number

number

number

number

number

[0032] Reference is first made to Figure 1, which illustrates an exemplary blockchain network 100 associated with a blockchain according to one embodiment of the present disclosure. In an embodiment, the exemplary blockchain network 100 includes blockchain nodes implemented as peer-to-peer distributed electronic devices, each executing instances of software and / or hardware that perform operations according to a blockchain protocol agreed upon at least in part among operators of the nodes 102. In some examples, a "node" refers to a peer-to-peer electronic device distributed across the blockchain network. One example of a blockchain protocol is the Bitcoin protocol.

[0033] In some embodiments, node 102 may comprise any suitable computing device (e.g., by a server in a data center, by a client computing device (e.g., a desktop computer, laptop computer, tablet computer, smartphone, etc.), by multiple computing devices in a distributed system of a computational resource service provider, or by any suitable electronic client device such as computing device 600 of FIG. 6). In some embodiments, node 102 has an input for receiving data messages or objects representing proposed transactions, such as transaction 104. Nodes, in some embodiments, are queriable for information they maintain, such as information about the state of transaction 104.

[0034] As shown in Figure 1, some of the nodes 102 are communicatively coupled to one or more other of the nodes 102. Such communicative coupling may include one or more of wired or wireless communication. In an embodiment, the nodes 102 each maintain at least a portion of a "ledger" of all transactions in the blockchain. In this manner, the ledger is a distributed ledger. Transactions processed by a node that affect the ledger are verifiable by one or more of the other nodes, thereby maintaining the integrity of the ledger.

[0035] With regard to which nodes 102 can communicate with which other nodes, it is sufficient that each of the nodes in the exemplary blockchain network 100 can communicate with one or more other of the nodes 102 such that messages passed between nodes can propagate throughout the exemplary blockchain network 100 (or any significant portion thereof), assuming the messages are messages that the blockchain protocol indicates should be forwarded. One such message might be the publication of a proposed transaction by one of the nodes 102, such as node 102A, which then propagates along a path, such as path 106. Another such message might be the publication of a new block proposed for inclusion in the blockchain.

[0036] In one embodiment, at least some of the nodes 102 are miner nodes that perform complex computations, such as solving cryptographic problems. Miner nodes that solve cryptographic problems create new blocks for the blockchain and broadcast the new blocks to other nodes 102. Other nodes 102 verify the miner node's work and, upon verification, accept the block into the blockchain (e.g., by adding it to the blockchain's distributed ledger). In some examples, a block is a group of transactions, often marked with a timestamp and a "fingerprint" (e.g., a hash) of the previous block. In this way, each block can become linked to the previous block, thereby creating a "chain" that links the blocks in the blockchain. In embodiments, valid blocks are added to the blockchain by consensus of the nodes 102. Also, in some examples, the blockchain includes a list of attested blocks.

[0037] In one embodiment, at least some of the nodes 102 operate as attesting nodes that attest transactions, as described in this disclosure. In some examples, a transaction includes data providing proof of ownership of a digital asset (e.g., multiple bitcoins) and conditions for accepting or transferring ownership / control of the digital asset. In some examples, an "unlocking transaction" refers to a blockchain transaction that reassociates (e.g., transfers ownership or control of) at least a portion of a digital asset represented by an unspent transaction output (UTXO) of a previous transaction to an entity associated with a blockchain address. In some examples, a "previous transaction" refers to a blockchain transaction that includes a UTXO referenced by the unlocking transaction. In some embodiments, a transaction includes a "locking script" that encumbers the transaction with conditions that must be met before ownership / control can be transferred ("unlocked").

[0038] In some embodiments, a blockchain address is an alphanumeric string associated with an entity to which control of at least a portion of a digital asset is being transferred or reassociated. In some blockchain protocols implemented in some embodiments, there is a one-to-one correspondence between public keys associated with entities and blockchain addresses. In some embodiments, verifying a transaction includes verifying one or more conditions specified in a lock script and / or an unlock script. Upon successful verification of a transaction 104, the verifying node adds the transaction 104 to the blockchain and distributes it to nodes 102.

[0039] FIG. 2 illustrates a method for generating a proof π and a verification key V when executed by a client computer system and a worker computer system, according to one embodiment. K2 is a swim diagram illustrating an example process for enabling a client to verify work performed by a worker using a . Portions or all of process 200 (or any other processes described, or variations and / or combinations of these processes) may be performed under the control of one or more computer systems configured with executable instructions and / or other data, and may be realized as executable instructions collectively executing on one or more processors. The executable instructions and / or other data may be stored on a non-transitory computer-readable storage medium (e.g., a computer program persistently stored on magnetic, optical, or flash media).

[0040] For example, some or all of process 200 may be performed by one or more computing devices (e.g., by a server in a data center, by a client computing device, by multiple computing devices in a distributed system of a computational resource service provider, or by any suitable electronic client device, such as computing device 600 of FIG. 6).

[0041] In various embodiments, a client computer system submits a computation to be performed by a worker computer system. The worker computer system may not be fully trusted by the client computer system, and therefore the worker computer system provides information that allows the client computer system or another trusted verification computer system to verify that the computation performed by the worker computer system is correct. In many instances, the client does not fully trust the worker computer system, and therefore, to satisfy the client computer system, the worker computer system submits information that allows the client computer system to attest that the computation was performed correctly. In some embodiments, verification of the work performed by the worker computer system is performed by a verification computer system trusted by the client computer system.

[0042] In various embodiments, the public verification key parameter V K , the proof π, and the I / O data are used to verify an alleged proof of correct computation provided by an untrusted worker computer system. In various embodiments, the verifying computer system collects materials used in the verification process from the client computer system and the untrusted worker computer system and performs the verification on behalf of the client computer system. In one embodiment, verification of the computation performed by the untrusted worker computer system occurs during transaction attestation, and thus the verifying computer system may be any Bitcoin or blockchain node.

[0043] Processing begins at block 202, where a client computer system identifies a function to be evaluated by a worker computer system. At block 204, the client computer system submits an evaluation key E for the function to be submitted to the worker computer system. K At block 206, a verification key V is constructed that the client computer system can use to verify work performed by the worker computer system. K At block 208, the client computer system generates the function and the evaluation key E K to the worker computer system.

[0044] In one embodiment, the public evaluation key E K Construction of is achieved as follows:

number

[0045] In the above embodiment, i represents an index into the internal wires of the circuit, deg(t) is the degree of the polynomial t(x), and deg(t) is equal to the number of multiplication gates in the circuit. In the circuit shown in FIG. 3, the public evaluation key E K is as follows:

number

[0046] In block 210, the worker computer system receives the evaluation key E from the client computer system. K and information describing the function to be executed. The worker computer system evaluates the function requested by the client computer system and builds (212) a proof π that can be used to verify the computation performed by the worker computer system. In block 214, the worker computer system provides the proof π and I / O data of the computation to the client computer system. In one embodiment, the I / O data are the inputs and outputs of the function evaluated by the worker computer system.

[0047] At block 216, the client computer system receives the I / O data and the proof π from the worker computer system. At block 218, the client computer system K , π, and elements from the I / O data are used to verify the computations performed by the worker computer systems.

[0048] It is noted that one or more of the operations performed at 202-218 may be performed in various orders and combinations, including in parallel.

[0049] It is noted that in the context of describing embodiments of the disclosure, unless otherwise specified, the use of language relating to executable instructions (also called code, applications, agents, etc.) that perform actions that the "instructions" would not normally perform without their assistance (e.g., transmitting data, performing calculations, etc.) indicates that the instructions are executed by a machine, thereby causing the machine to perform the specified actions.

[0050] In a paper titled "Quadratic Span Programs and Succinct NIZKs without PCPs" by Gennaro, R. et al. (2013), they describe a protocol for verifiable computation based on quadratic arithmetic programs. In the protocol, a circuit takes n elements as input and produces an output of n' elements for a total of N = n + n' IO elements (or I / O data). The circuit can be viewed as a set of multiplication and addition gates, where the circuit contains m wires connected to d multiplication gates, and the addition gates are modeled by their contribution to the multiplication gates.

[0051] Assignment on input / output wires (a1, a2,..., a N ) is valid, the verification entity must prove that the polynomial p(x) has roots (x1,x2,...x d ), i.e., p(x i ) i=1...d = 0, the coefficient (a N+1 ,...a m ) exists. The polynomial p(x) encodes the gate expressions and wire values. Hence there exists a polynomial h(x) such that p(x) = h(x) t(x), where

number

[0052]

number

number

number

[0053]

number

number

number

[0054] Origin

number

number

number

[0055] The proof includes the following elements:

number

[0056] V K , π, and (a1, a2,..., a N ), the verification computer system determines whether t(x) divides p(x) and therefore (x N+1 ,...,x m )=f(x0,...,x N ) as follows: First, the verification computer system checks the three α terms by verifying that:

number

[0057] where:

number

number

[0058] Furthermore, verify that the divisibility requirement is met by checking the following:

number

[0059] 3 shows an example of a circuit for representing an arithmetic function according to one embodiment. The circuit shown in FIG. 3 represents function 302, i.e., f(a1,a2,a3,a4)=a1+a2a3(a3+a4) Represents.

[0060] In the circuit, each wire value is a prime order field.

number

[0061] When input values ​​a1, a2, a3, and a4 are assigned to the circuit, the worker computer system determines the corresponding output values.

number

number

number

number

[0062] In one embodiment, the polynomial {v i (x)} represents the left input of the multiplication gate, and the polynomial {w i (x)} represents the right input of the multiplication gate, and the polynomial {y i (x)} represents the output value of the circuit. In the example circuit shown in Figure 3, the polynomial {v i (x)}, {w i (x)}, {y i The explicit formula for {(x)} is:

number

[0063] In one embodiment, P and Q are

number

number

number

number

number

number

[0064] In the example shown in Figure 3, the public verification key V K can be determined as follows:

number

[0065] In one embodiment, the public verification key is implemented as a bit sequence with subsequences each representing a different component, although different methods of encoding the components into the public verification key are considered within the scope of this disclosure.

[0066] The proof π includes the following elements:

number

[0067] where (h0, h1, h2, h3) are the coefficients of the polynomial h(x) evaluated by the worker, and h(x) = h0 + h1x + h2x 2 +h3x 3 In one embodiment, the proof is realized as a bit sequence with subsequences each representing a different component of the proof, although different ways of encoding the components into the proof are considered within the scope of this disclosure. The set of elements χ is K Belongs to.

number

[0068] In one embodiment, the following formula is used to verify the asserted proof π: K , proof π, IO value a i ={a0,a1,a2,a3,a4,a7}, the verification algorithm is v V mid (s)P, r w W mid (s) Q and r y Y mid (s)P is the evaluation key E K That is, the protocol first verifies the following equations (1) to (3):

number

[0069] The verification computer system then calculates the same coefficient a mid ={a5,a6} is V mid (s)P, W mid (s) Q and Y mid (s) Check whether P is used in P. In one embodiment, the verification computer system accomplishes this by verifying the following equation (4):

number

[0070] Furthermore, the verification computer system performs a divisibility check on the proof term h(x) by combining terms from the commitments. That is, the verification computer system:

number

number

[0071] FIG. 4 illustrates the verification key V when executed by a client computer system, according to one embodiment. K 4 is a flowchart illustrating an example of a process for determining a metric. Part or all of process 400 (or any other processes described, or variations and / or combinations of these processes) may be performed under the control of one or more computer systems configured with executable instructions and / or other data, and may be implemented as executable instructions collectively executing on one or more processors. The executable instructions and / or other data may be stored on a non-transitory computer-readable storage medium (e.g., a computer program persistently stored on magnetic, optical, or flash media).

[0072] For example, some or all of process 400 may be performed by one or more computing devices (e.g., by a server in a data center, by a client computing device, by multiple computing devices in a distributed system of a computational resource service provider, or by any suitable electronic client device, such as computing device 600 of FIG. 6).

[0073] In various embodiments, a client computer system submits a computation to be performed by a worker computer system. The worker computer system may not be fully trusted by the client computer system, and therefore the worker computer system provides information that allows the client computer system or another trusted verification computer system to verify that the computation performed by the worker computer system is correct. In many instances, the client does not fully trust the worker computer system, and therefore, to satisfy the client computer system, the worker computer system provides the client computer system with information that allows the client computer system to attest that the computation performed by the worker computer system was correct. In various embodiments, the public verification key parameter V K , the proof π, and the I / O data are used to verify the asserted proof of correct computation provided by the worker computer system. K The process of generating

[0074] In one embodiment, at block 402, a client computer system identifies a function F to be executed by an untrusted worker computer system. The function F takes n values ​​as inputs. The client computer system generates a model of a circuit corresponding to the function, which consists of a set of multiplication gates and addition gates. At block 404, the client computer system identifies the multiplication gates in the circuit.

[0075] In one embodiment, at block 406, the client computer system randomly selects root values ​​corresponding to the output of each multiplication gate in the circuit. For a circuit with m multiplication gates, the client computer system randomly selects m root values ​​(x n+1 ...x n+m ).

[0076] In one embodiment, at block 408, the client computer system calculates the selected root value (x n+1 ...x n+m ) to find the target polynomial t(x)=(xx n )(xx n+1 )...(xx n+m In block 410, the client computer system determines the left input {v i (x)}, the right input of the multiplication gate {w i (x)}, and the output value of the multiplication gate {y i (x)}.

[0077] In one embodiment, in block 412, the client computer system y =r v ·r w A random element r for degeneration from a field of prime order r such that v ,r w ,s,α v ,α w ,α y ,β,γ are selected.

[0078] In one embodiment, at block 414, the client computer system receives the public verification key V K Determine P and Q.

number

number

number

number

number

number

number

number

[0079] It is noted that one or more of the operations performed at 202-214 may be performed in various orders and combinations, including in parallel.

[0080] It is noted that in the context of describing embodiments of the disclosure, unless otherwise specified, the use of language relating to executable instructions (also called code, applications, agents, etc.) that perform actions that the "instructions" would not normally perform without their assistance (e.g., transmitting data, performing calculations, etc.) indicates that the instructions are executed by a machine, thereby causing the machine to perform the specified actions.

[0081] 5 is a flowchart illustrating an example of a process that, when executed by a client computer system, uses proof π to verify a computation performed by a worker computer system, according to one embodiment. Part or all of process 500 (or any other processes described, or variations and / or combinations of these processes) may be performed under the control of one or more computer systems comprised of executable instructions and / or other data, and may be implemented as executable instructions collectively executing on one or more processors. The executable instructions and / or other data may be stored on a non-transitory computer-readable storage medium (e.g., a computer program persistently stored on magnetic, optical, or flash media).

[0082] For example, some or all of process 500 may be performed by one or more computing devices (e.g., by a server in a data center, by a client computing device, by multiple computing devices in a distributed system of a computational resource service provider, or by any suitable electronic client device, such as computing device 600 of FIG. 6).

[0083] In various embodiments, a client computer system submits a computation to be performed by a worker computer system. The worker computer system may not be fully trusted by the client computer system, and therefore the worker computer system provides information that allows the client computer system or another trusted verification computer system to verify that the computation performed by the worker computer system is correct. In many instances, the client does not fully trust the worker computer system, and therefore, to satisfy the client computer system, the worker computer system provides the client computer system with information that allows the client computer system to attest that the computation performed by the worker computer system was correct. In various embodiments, the public verification key parameter V K , proof π, and the I / O data are used to verify the asserted proof of correct computation provided by the worker computer system. Flowchart 500 shows a process for verifying a computation performed by a worker computer system using a proof π provided by the worker computer system.

[0084] In one embodiment, the client computer system receives the proof π and I / O data from the worker computer system in block 502. The proof includes:

number

[0085] In one embodiment, in block 504, the client computer system begins a process to verify that the work performed by the worker computer system is correct. v V mid (s)P, r w W mid (s) Q and r y Y mid (s)P is the evaluation key E K Verify that the element is constructed using elements from:

number

[0086] where:

number

[0087] At block 506, the client computer system verifies that matching coefficients are used for Vmid(s)P, Wmid(s)Q, and Ymid(s)P as follows:

number

[0088] At block 508, the client computer system performs a divisibility check on the proof term h(x) by combining terms from the commitment as follows:

number

[0089] where:

number

[0090] If the above checks are successful, the client computer system determines that the calculations performed by the worker computer system are correct, and the results provided by the worker computer system can be trusted by the client computer system.

[0091] It is noted that one or more of the operations performed at 502-508 may be performed in various orders and combinations, including in parallel.

[0092] It is noted that in the context of describing embodiments of the disclosure, unless otherwise specified, the use of language relating to executable instructions (also called code, applications, agents, etc.) that perform actions that the "instructions" would not normally perform without their assistance (e.g., transmitting data, performing calculations, etc.) indicates that the instructions are executed by a machine, thereby causing the machine to perform the specified actions.

[0093] This document describes systems and methods that enhance and extend the capabilities of blockchain. Various embodiments enable users to securely enumerate and exchange rights through a public blockchain and orchestrate near-completely anonymous digital transactions. Various embodiments may be used to provide solutions to (i) the storage problem of common reference strings (CRSs) and worker proofs (π), and (ii) the interactions between unlock scripts and CRSs, and between unlock scripts and π.

[0094] Various embodiments may be used to provide a secure and compact representation of smart contracts. Smart contracts may follow formatting rules using specialized languages ​​such as the XML derivative FpML. Various embodiments may be used to outsource contract execution to untrusted parties or to publicly verify the correctness of contract execution. Contract verification may not mean re-executing code. Computations may not be replicated by every node in the network. In some embodiments, proofs of correct execution are stored on a public blockchain and used for verification purposes.

[0095] FIG. 6 is an exemplary simplified block diagram of a computing device 600 that may be used to implement at least one embodiment of the present disclosure. In various embodiments, the computing device 600 may be used to implement any of the systems illustrated and described above. For example, the computing device 600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 6 , the computing device 600, in embodiments, may include one or more processors 602 in communication with and operatively coupled to multiple peripheral subsystems via a bus subsystem 604. In some embodiments, these peripheral subsystems include a storage subsystem 606, including a memory subsystem 608 and a file / disk storage subsystem 610, one or more user interface input devices 612, one or more user interface output devices 614, and a network interface subsystem 616. Such storage subsystems 606 may be used for temporary or long-term storage of information.

[0096] In some embodiments, the bus subsystem 604 provides a mechanism that allows the various components and subsystems of the computing device 600 to communicate with each other as intended. While the bus subsystem 604 is shown schematically as a single bus, alternative embodiments of the bus subsystem utilize multiple buses. In some embodiments, the network interface subsystem 616 provides an interface to other computing devices and networks. The network interface subsystem 616, in some embodiments, serves as an interface for receiving data from other systems and transmitting data from the computing device 600 to other systems. In some embodiments, the bus subsystem 604 is utilized to communicate data such as details, search terms, etc.

[0097] In some embodiments, the user interface input device(s) 612 include one or more user input devices, such as a keyboard; a pointing device, such as an integrated mouse, trackball, touchpad, or graphics tablet; a scanner; a barcode scanner; a touchscreen integrated into a display; an audio input device, such as a voice recognition system, a microphone; and other types of input devices. In general, use of the term “input device” is intended to include all possible types of devices and mechanisms for inputting information into the computing device 600. In some embodiments, the one or more user interface output devices 614 include a display subsystem, a printer, or a non-visual display, such as an audio output device. In some embodiments, the display subsystem includes a flat-panel device, such as a cathode ray tube (CRT), a liquid crystal display (LCD), a light-emitting diode (LED) display, or a projection or other display device. In general, use of the term “output device” is intended to include all possible types of devices and mechanisms for outputting information from the computing device 600. The one or more user interface output devices 614 may be used, for example, to present a user interface and facilitate user interaction with applications that perform the described processes and variations thereof, where such interaction may be appropriate.

[0098] In some embodiments, storage subsystem 606 provides a computer-readable storage medium that stores basic programming and data constructs that provide the functionality of at least one embodiment of the present disclosure. Applications (programs, code modules, instructions), which in some embodiments when executed by one or more processors, provide the functionality of one or more embodiments of the present disclosure, and in some embodiments are stored in storage subsystem 606. These application modules or instructions can be executed by one or more processors 602. In various embodiments, storage subsystem 606 further provides a repository for storing data used in accordance with the present disclosure. In some embodiments, storage subsystem 606 includes memory subsystem 608 and file / disk storage subsystem 610.

[0099] In embodiments, memory subsystem 608 includes multiple memories, such as a main random access memory (RAM) 618 for storing instructions and data during program execution and / or a read-only memory (ROM) 620 capable of storing fixed instructions. In some embodiments, file / disk storage subsystem 610 provides non-transitory, persistent (non-volatile) storage for program and data files and may include a hard disk drive, a floppy disk drive with associated removable media, a compact disk read-only memory (CD-ROM) drive, an optical drive, a removable media cartridge, or other similar storage media.

[0100] In some embodiments, computing device 600 includes at least one local clock 624. Local clock 624, in some embodiments, is a counter that represents the number of ticks that have occurred since a particular start date and, in some embodiments, is integrally located within computing device 600. In various embodiments, local clock 624 is used to synchronize data transfers within the processor and included subsystems for computing device 600 at particular clock pulses, and may also be used to coordinate synchronous operations between computing device 600 and other systems in a data center. In another embodiment, the local clock is a timer with a programmable interval.

[0101] Computing device 600 can be any of a variety of types, including a portable computing device, a tablet computer, a workstation, or any other device described below. Additionally, computing device 600, in some embodiments, can include another device that can connect to computing device 600 through one or more ports (e.g., USB, headphone jack, Lightning connector, etc.). In embodiments, such a device includes a port that accepts a fiber optic connector. Thus, in some embodiments, the device converts optical signals into electrical signals that are transmitted through the port connecting the device to computing device 600 for processing. Due to the ever-changing nature of computers and networks, the description of computing device 600 shown in FIG. 6 is intended only as a specific example for purposes of illustrating a preferred embodiment of the device. Many other configurations are possible, having more or fewer components than the system shown in FIG. 6.

[0102] Accordingly, the specification and drawings are to be interpreted in an illustrative rather than a restrictive sense. However, it will be apparent that various modifications and changes can be made thereto without departing from the scope of the invention as set forth in the appended claims. Likewise, other variations are within the scope of this disclosure. Thus, while the disclosed techniques are susceptible to various modifications and alternative constructions, certain illustrative embodiments thereof have been shown in the drawings and have been described above in detail. It is to be understood, however, that there is no intention to limit the invention to the particular forms or configurations disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the scope of the invention as defined by the appended claims.

[0103] Use of the terms "a," "an," "the," and similar referents in the context of describing embodiments of the disclosure (particularly in the context of the claims below) should be construed to cover both the singular and the plural unless otherwise indicated or clearly contradicted by context. The terms "comprise," "have," "include," and "comprise" should be construed as open-ended (i.e., meaning "including but not limited to") unless otherwise noted. The term "connected," when referring to an unmodified physical connection, should be construed as being partially or wholly contained within, attached to, or joined together, even if there is something intervening. Recitation of ranges of values ​​in this disclosure is merely intended to serve as a shorthand method of referring individually to each separate value falling within the range, unless otherwise indicated, and each separate value is incorporated herein as if it were individually set forth. Use of the term "set" (e.g., "set of items") or "subset" should be construed as a non-empty collection containing one or more members, unless otherwise stated or contradicted by context. Further, unless otherwise stated or contradicted by context, the term "subset" of a corresponding set does not necessarily indicate a proper subset of the corresponding set, although a subset and a corresponding set may be equivalent.

[0104] Conjunctive language, such as phrases of the form "at least one of A, B, and C" or "at least one of A, B, and C," unless specifically indicated otherwise or clearly contradicted by context, is understood in the context of otherwise common usage to indicate that an item, term, etc. may be either A or B or C, or any non-empty subset of the set A, B, and C. For example, in the illustrative example of a set having three members, the conjunctive phrases "at least one of A, B, and C" and "at least one of A, B, and C" refer to any of the following sets: {A}, {B}, {C}, {A, B}, {A, C}, {B, C}, {A, B, C}. Thus, such conjunctive language is generally not intended to imply that a particular embodiment requires that at least one of A, at least one of B, and at least one of C each be present.

[0105] The actions of the processes described can be performed in any suitable order unless otherwise indicated or otherwise clearly contradicted by context. The processes described (or variations and / or combinations thereof) can be performed under the control of one or more computer systems configured with executable instructions, implemented in hardware, or a combination thereof as code (e.g., executable instructions, one or more computer programs, or one or more applications) that collectively execute on one or more processors. In some embodiments, the code can be stored on a computer-readable storage medium, for example, in the form of a computer program including a plurality of instructions executable by one or more processors. In some embodiments, the computer-readable storage medium is non-transitory.

[0106] Any or all examples provided, or the use of exemplary language (e.g., "such as"), are intended merely to better clarify embodiments of the invention and do not impose limitations on the scope of the invention unless otherwise claimed. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the invention.

[0107] Embodiments of the present disclosure have been described, including the best mode known to the inventors for carrying out the invention. Variations of these embodiments will become apparent to those skilled in the art upon reading the foregoing description. The inventors anticipate that skilled artisans will adopt such variations as appropriate, and the inventors intend for the embodiments of the present disclosure to be practiced otherwise than as specifically described. Accordingly, the scope of the present disclosure includes all modifications and equivalents of the subject matter recited in this specification and the appended claims as permitted by applicable law. Moreover, any combination of the above-described elements in all possible variations thereof is encompassed within the scope of the present disclosure unless otherwise indicated or otherwise clearly contradicted by context.

[0108] All references, including cited publications, patent applications, and patents, are herein incorporated by reference to the same extent as if each reference was individually and specifically indicated to be incorporated by reference and set forth in its entirety.

[0109] The above-described embodiments illustrate rather than limit the invention, and it should be noted that those skilled in the art can design many alternative embodiments without departing from the scope of the invention as defined by the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the scope of the claim. The words "comprises" and "comprises", and the like, do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprises" means "comprises or consists of", and "comprising" means "includes or consists of". The singular reference of an element does not exclude the plural reference of such elements, and vice versa. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.

[0110] [summary] The techniques described and suggested in this disclosure involve the use of a public verification key parameter V K and I / O data to verify a proof π provided by a third party, thereby improving the field of computation, and specifically the field of verifying the correctness of computations performed by third-party computer systems. Furthermore, the techniques described and suggested in this disclosure improve the functionality of computing systems by enabling computations to be distributed across a network of untrusted third-party computer systems. Furthermore, the techniques described and suggested in this disclosure are necessarily rooted in computer technology and overcome problems that arise specifically in verifying the performance of digital contracts by modeling contracts as logic circuits.

Claims

1. 1. A computer-implemented method comprising: providing tasks to worker computer systems within the set of independent computer systems, the tasks specifying computations to be performed; verifying that the computation is correctly executed by a worker computer system in the set of independent computer systems, the computation comprising at least: generating an evaluation key; providing the evaluation key to the worker computer system; receiving a proof from the worker computer system, the proof being based at least in part on the evaluation key; generating a verification key; verifying that the calculation is correct using the proof and the verification key; based on a circuit having a set of multiplication gates by wherein the computer system performing the validation is adapted to process blockchain transactions, and the validation of the computations performed by the worker computer system occurs during validation of the blockchain transactions. Computer-implemented methods.

2. the verification key is based on the inputs to the multiplication gate and the output of the multiplication gate; The computer-implemented method of claim 1 .

3. the proof is based at least in part on a set of intermediate outputs of the multiplication gate; 3. The computer-implemented method of claim 1 or 2.

4. the proof is based at least in part on a public reputation key; A computer-implemented method according to any one of claims 1 to 3.

5. the proof and the verification key are based at least in part on a first generator and a second generator that generate different groups; A computer-implemented method according to any one of claims 1 to 4.

6. verifying that elements of the proof are consistent with elements of the evaluation key; The computer-implemented method of claim 1 , further comprising:

7. verifying that the elements of the proof are constructed using matching coefficients; The computer-implemented method of claim 1 , further comprising:

8. verifying a divisibility requirement on the terms of the proof; The computer-implemented method of claim 1 , further comprising:

9. the worker computer system provides a set of I / O values ​​corresponding to input and output values ​​of the circuit; A computer-implemented method according to any one of claims 1 to 8.

10. the circuit includes one or more addition gates modeled with their contributions to the multiplication gate; A computer-implemented method according to any one of claims 1 to 9.

11. The calculation is part of a Bitcoin transaction verification. A computer-implemented method according to any one of claims 1 to 10.

12. Verifying that the calculation is correct includes at least providing the proof, the verification key, and a set of I / O values ​​to a verification computer system; receiving an indication from the verification computer system that the calculation is correct; This is achieved by 12. A computer-implemented method according to any one of claims 1 to 11.

13. The validating computer system is a blockchain node.

13. A computer-implemented method according to any one of claims 1 to 12.

14. 1. A system comprising: a processor; a memory containing executable instructions that, when executed by the processor, cause the system to perform the computer-implemented method of any one of claims 1 to 13; A system including:

15. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by a processor of a computer system, cause the computer system to perform at least the computer-implemented method of any one of claims 1 to 13.

Images