Arithmetic enhancements of c-like smart contracts for verifiable computation

Abstract

To provide a system and a method for converting high-level source code into an arithmetic circuit that represents the functions expressed in the source code.SOLUTION: A method for providing arithmetic enhancements of C-like smart contracts for verifiable computation includes processing a portion of high-level source code (e.g., a smart contract) to generate an arithmetic circuit C including one or more arithmetic gates that represent at least a portion of the functionality expressed in the source code. The processing evaluates one or more constants provided in the source code to produce one or more expressions including Boolean and / or arithmetic operators. The arithmetic circuit C includes n-bit wires connected to the arithmetic gates and is used to provide hardware and / or software circuits and to generate secondary programs executable on a processor.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates generally to the field of tools, techniques, and systems, e.g., interpreters, that convert high-level source code into another format. The present invention further relates to blockchain technology, and in particular to tools for building blockchain-enabled solutions. The present invention further relates to improved generation of machine-executable technologies, such as, for example, smart contracts configured to run on a blockchain. [Background technology]

[0002] In this document, the term "blockchain" refers to any of several types of electronic, computer-based distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and unpermissioned ledgers, shared ledgers, and variations thereof. It also includes private and public blockchains.

[0003] The most widely known application of blockchain technology is the Bitcoin® ledger, although other blockchain implementations have been proposed and developed. While this disclosure may refer to the example of Bitcoin for convenience and illustrative purposes, it should be noted that the present invention is not limited to use with any particular implementation or variation of the Bitcoin blockchain or related protocols, and alternative blockchain implementations and protocols are within the scope of the present invention.

[0004] A blockchain is a peer-to-peer electronic ledger, realized as a computer-based, decentralized system composed of blocks, which in turn are composed of transactions. Each transaction is a data structure that encodes the transfer of control of a digital asset between participants in the blockchain system and contains at least one input and at least one output. Each block contains a hash of the previous block, thereby chaining blocks together to create a permanent, immutable record of all transactions written to the blockchain since its inception.

[0005] The Bitcoin blockchain's scripting language, known as Script, is stack-based. Items can be pushed onto or popped from the top of the stack. For example, the OP_EQUAL operation pops the top two items from the stack, compares them, and pushes the result (e.g., 1 if equal, 0 if not equal) onto the top of the stack. In some scripting languages ​​employed by some of the present embodiments, there may be at least two stacks: a main stack and an alternate stack.

[0006] For a transaction to be written to the blockchain, it must be "validated." Network nodes (miners) perform the work to ensure each transaction is valid; invalid transactions are rejected by the network. Nodes can have different standards for validity than other nodes. Because validity in the blockchain is consensus-based, a transaction is considered valid if a majority of nodes agree that the transaction is valid. A software client installed on a node performs this validation work for transactions that reference unspent transaction (UTXO)s, in part by executing UTXO locking and unlocking scripts. A transaction is validated by a node if the execution of the locking and unlocking scripts evaluates to TRUE and other validation conditions, if applicable, are met. Validated transactions are propagated to other network nodes, and miner nodes can then choose to include the transaction in the blockchain.

[0007] Therefore, for a transaction to be written to the blockchain, it must be i) verified by the first node that receives the transaction, which if verified, relays it to other nodes in the network; ii) added to a new block constructed by a miner; or iii) mined, i.e., added to the public ledger of past transactions. A transaction is considered confirmed when enough blocks have been added to the blockchain to make the transaction effectively irreversible.

[0008] While blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to explore the use of both the cryptographic security system upon which Bitcoin is based and the data that can be stored on the blockchain to realize new systems. It would be highly advantageous if blockchain could be used for automated tasks and processes that are not limited to the cryptocurrency realm. Such solutions would be more versatile in their application while also being able to take advantage of the benefits of blockchain (e.g., a permanent, tamper-proof record of events, distributed processing, etc.).

[0009] One area of ​​current research is the use of blockchain for the implementation of "smart contracts." These are computer programs designed to automate the fulfillment of the terms of machine-readable agreements or agreements. Unlike traditional contracts, which are written in natural language, smart contracts are machine-executable programs containing rules that can process inputs and generate results, which can then cause actions to be taken depending on those results.

[0010] In embodiments, a smart contract is "smart" in the sense that a creator or any other specific entity is not required to enforce and / or execute the smart contract. No human interaction is required for execution or enforcement. That is, while interaction with a specific entity may be encoded in specific steps within the smart contract, the smart contract is otherwise automatically executable and self-enforcing. It is machine-readable and executable. In some examples, automatic execution refers to any entity being able to consume the UTXO and having an incentive (e.g., a reward) to do so. Note that in such examples, "any entity" that can consume the UTXO refers to an entity that can create an unlock script without being required to prove knowledge of any secret. In other words, a spend transaction is verifiable without verifying that the source of the data has access to a cryptographic secret (e.g., a private asymmetric key, a symmetric key, etc.). Furthermore, in such examples, self-enforcement refers to the ability of attesting nodes in the blockchain network to enforce spend transactions according to constraints. In some instances, "spending" a UTXO refers to creating a spending transaction that references the UTXO and executes it as valid.

[0011] Therefore, there is a lot of interest around the applications that blockchain technology can be used for beyond just being a means of cryptocurrency payments, including controlling IoT devices and intelligent systems incorporating AI technology.

[0012] However, while many people are skilled in the field of programming using high-level languages ​​such as C, C++, and Java, relatively few are able to create blockchain applications. This is in part due to the current need to code for blockchains at a relatively low level, using op_codes that manipulate the main and alt stacks. In particular, programming smart contracts for blockchain implementations is known to be difficult and error-prone, as explored in Delmolino, K. et al. (2015) Step by Step Towards Creating a Safe Smart Contract: Lessons and Insights from a Cryptocurrency Lab and Juels, A. et al. (2013) The Ring of Gyges: Using Smart Contracts for Crime.

[0013] An improved blockchain and related platform is provided by enabling the creation of solutions and applications that can be used with the blockchain. Solutions for the computation of arithmetic gates are further provided. Arithmetic circuits can be configured as predicates or for the execution of predicates. The present invention enables the creation and encoding of executable programs (as opposed to simply providing verification or proof as per prior art disclosures). Summary of the Invention

[0014] It is therefore desirable to provide a method and system that improves upon blockchain and distributed computing technologies in one or more aspects. Such an improved solution has now been devised. Thus, in accordance with the present invention, there is provided a method and system as defined in the appended claims.

[0015] The present invention may include systems and methods arranged to provide and facilitate programmability in decentralized systems, which may be, for example, cryptocurrency systems, blockchain-enabled systems, and / or distributed computing systems. From one perspective, it reduces errors, time, effort, cost, and resources required during the programming process. Thus, it provides a technical solution to a technical problem. From another perspective, it provides an enhanced blockchain solution due to the reduction of errors and bugs. It also preserves the integrity of the software.

[0016] Advantageously, unlike known interpreters and compilers, the present invention provides an architecture-independent solution, and furthermore, it does not require the use of a virtual machine (VM) to enable execution.

[0017] The present invention may provide a computer-implemented system and method that takes source code as input and generates an arithmetic circuit c. The resulting circuit C may be a representation of the functionality of the HLL source code (as opposed to a proof for verification). When executed, the arithmetic circuit C provides a result of the computation, which may then be verified. The circuit C may be machine-executable or may be processed for execution on a machine. The source code may represent or represent a computation.

[0018] This circuit is the field

number

[0019] The present invention may convert or translate computations expressed in source code into executable (machine / processor) predicates. (HLL / GPL) Source code may be pre-compiled or pre-processed. In one or more embodiments, a public evaluation key (EK) and a public verification key (VK) may be derived using the secret value s. The method may include using the EK and VK to evaluate a calculation for a particular input x. The output y, the value of one or more circuit wires, and the EK may be used to generate a proof-of-correctness π. The proof π may be stored in a blockchain. It may be stored in a blockchain transaction. The method may include providing a proof to a blockchain transaction, which may include submitting the transaction to the blockchain and / or storing it in the blockchain.

[0020] The method may include verifying the proof stored in the blockchain, which may be verified by one or more parties. Advantageously, it may be verified by multiple parties without requiring a prover to interact with each of the parties separately. This provides a more efficient and faster solution compared to prior art.

[0021] All or a subset of the nodes in a blockchain network (e.g., Bitcoin) may verify transactions. Verification may be performed to verify a smart contract using a public verification key VK and a proof π.

[0022] One advantage of the present invention is that miners validate transactions according to known conventional blockchain protocols. The validation process is part of the miner's role within the network. Therefore, the present invention can use the effort put in by nodes to its technical advantage, since it is performed as part of the existing operations that require validation. This provides an efficient arrangement compared to the prior art.

[0023] In some embodiments, the present invention may form part of a workflow from a smart contract encoded in a DSL to a quadratic arithmetic program (QAP), as shown in FIG.

[0024] As shown in Figure 2, a Domain Specific Language (DSL) smart contract can be converted into a high-level language contract. A DSL smart contract may be written in a formal language with precise semantics. A DSL smart contract may include a set of conditions. The outcome of the DSL smart contract may depend on the fulfillment of the set of conditions.

[0025] An HLL pre-compiler (also called a pre-processor) may incorporate external libraries referenced by HLL contracts to generate HLL pre-processed contracts. The HLL pre-compiler may be referred to as a C pre-compiler in Figure 2. The HLL contracts may be referred to as C language contracts in Figure 2.

[0026] The HLL preprocessing contract (i.e., source code) may then be transformed into an arithmetic circuit according to one embodiment of the present invention, which may be optimized to produce a reduced arithmetic circuit from which the QAP polynomial is derived.

[0027] The preprocessing transformation may be performed by a software program (referred to in FIG. 2 as a C precompiler) that, as a result of its execution, receives a set of conditions, such as a DSL smart contract written in a DSL, and translates the DSL code into HLL source code, such as an HLL contract. This may be referred to in FIG. 2 as a "C language preprocessing contract." It may also be referred to herein simply as "source code." The HLL contract may be an HLL program, such as a C++ program, that includes the contract defined in the DSL smart contract. The HLL precompiler may be a computer-executable program that processes the HLL contract and any required external libraries to generate a standalone HLL preprocessing contract (i.e., source code).

[0028] An external library may be a collection of pre-written subroutines, functions, classes, containers, values, and / or variable types that are utilized by an HLL contract through a call. For example, by calling an external library, an HLL contract obtains the functionality of that library without having to implement the functionality itself. An HLL pre-processing contract may include a set of expressions and operators. Operators may be arithmetic operators (e.g., addition (+), multiplication (*), etc.), comparison operators (e.g., less than (<), equal to (==), greater than or equal to (>=), etc.), conditional statements (e.g., if-then (?, :)), or logical operators (e.g., AND (&&), OR (||), NOT (!), XOR ().

number

[0029] An arithmetic circuit may be a directed acyclic graph (DAG) over a set of variables. Every node in the DAG with an indegree of zero is a node that is connected to a variable (e.g., x i ), and every other node in the DAG may be a sum gate (+) or a product gate (×). Because every gate (node) may have an outdegree of 1, the underlying graph may be a directed tree. An arithmetic circuit may have two measures of complexity: size and depth. In some examples, the "size" of an arithmetic circuit may be based on the number of gates in the arithmetic circuit. In some examples, the "depth" of an arithmetic circuit may be based on the length of the longest directed path in the arithmetic circuit. After the arithmetic circuit is created, it can be reduced.

[0030] A computer-implemented method according to the invention may include processing portions of source code to generate (executable) arithmetic circuits. The source code may be written in a high-level programming language, and the arithmetic circuits may include one or more arithmetic gates configured to represent some function or calculation expressed in the source code. This is in contrast to compilers and interpreters known in the prior art, which do not translate HLL source code into arithmetic circuits. The arithmetic circuit may be executed on a processor, and the circuit may be provided to a blockchain transaction.

[0031] This is in contrast to prior art disclosures that teach the verification of computations or logic circuits and / or result in the output of (zero-knowledge) proofs. For example, the Pinocchio system generates zero-knowledge proofs that verify general computations. Communications of the ACM, Vol. 59, No. 2, 2016 Parno B et al., "Pinocchio: Nearly Practical Verifiable Computations," pp. 103-112 (Parno). Thus, any prior art verification system, such as Pinocchio, can be used with the present invention for verification purposes, and the present invention provides functionality and results that go beyond the prior art.

[0032] Thus, the present invention provides a machine-executable output that represents and / or provides a computation, which can then be verified. This is in contrast to, for example, the Pinocchio system, which compiles a verification script to verify a (separate) program configured to perform the computation, thus involving a two-part process. Instead, the present invention uses a one-part approach: compiling the high-level computation itself into arithmetic circuitry. Thus, the present invention solves a different technical problem using a significantly different approach than the prior art discussed above.

[0033] Preferably, the source code is a smart contract. The source code may be preprocessed as described above.

[0034] Preferably, the processing step includes the substep of evaluating one or more constants provided in the source code, which may provide one or more expressions including Boolean and / or arithmetic operators. The method may further include providing a hardware and / or software circuit using an arithmetic circuit. The arithmetic circuit may include n-bit wires connected to the arithmetic gates. The arithmetic circuit is architecture-independent, i.e., it is not configured for operation or use on a particular hardware or software architecture or platform. It does not require the use of a virtual machine. This is in contrast to prior art compilers and interpreters that are architecture-specific or require the use of a VM.

[0035] The method may further include preprocessing the source code to determine one or more constants. The preprocessing step may include: Steps to delete comments, importing the header declarations from the header file into the source file; Merging multiple source files; Resolving or evaluating directives and macros It may include one or more of the following:

[0036] The method may further comprise the step of finding all global variables declared in the source code, the global variables relating to functions, structures or classes, constants, and / or entry points of execution. The method may further include generating a table of symbols (identifiers) to associate each symbol (i.e., identifier) ​​provided in the source code with declarative information provided in the source code. The symbols in the table may be global and / or local symbols.

[0037] The method may further include performing a line-by-line evaluation of the source code that results in an arithmetic and / or logical expression that represents one or more out variables as a combination of logical and / or arithmetic operations applied to one or more input variables. This may further include steps of decoding types, decoding expressions, evaluating expressions, and / or allocating memory for data structures required by the functions.

[0038] The method may further comprise the step of mapping arithmetic and / or logical operations of the expression to arithmetic gates, wherein the step of mapping may comprise the sub-step of performing wire expansion and / or the sub-step of performing wire compression. The method may further include using the arithmetic circuit to generate a secondary program including a set of polynomials that provide a description of the circuit. The method may further include providing the secondary program to an entity for execution of the secondary program using the one or more inputs.

[0039] The present invention may further provide a system arranged to implement or perform any of the above-described method steps. The system may include a translation or transformation component (i.e., an interpreter / compiler) arranged to perform source code processing. While compilers for the generation of (zero-knowledge) proofs are known in the art (see, for example, "Pinocchio: Nearly Practical Verifiable Computations" (Parno), supra), these do not compile to arithmetic circuits as in the present invention. The present invention generates answers, but not proofs or verifications of answers.

[0040] A computer-implemented system a processor; and a memory containing executable instructions that, when executed by a processor, cause the system to perform a computer-implemented method of any one or more embodiments of the inventions / methods described or claimed herein. The instructions may include instructions to provide a translation or transformation component (i.e., an interpreter / compiler) configured to perform processing of source code.

[0041] A non-transitory computer-readable storage medium stores executable instructions that, when executed by a processor of a computer system, cause the computer system to perform at least one or more embodiments of the inventions / methods described or claimed herein. [Brief explanation of the drawings]

[0042] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiment(s) described hereinafter. One embodiment of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which: [Figure 1] The following illustrates a protocol for verifiable computations and actors involved in exemplary uses and embodiments of the present invention: clients, workers (also known as "provers"), and verifiers. [Figure 2] 1 illustrates a DSL contract to quadratic arithmetic program (QAP) translation process according to one embodiment of the present invention. [Figure 3] 1 illustrates an example of an arithmetic circuit according to an embodiment of the present invention. [Figure 4] 1 illustrates a high-level description of a packet (header+body) including a circuit representation according to one embodiment of the present invention. [Figure 5] As the example explained below shows, "Check if variable Here is one implementation of a 4-bit wire expander that expresses the statement "is even." [Figure 6] 1 illustrates a building block according to one exemplary implementation of the present invention, which implements a conditional statement. [Figure 7] 1 illustrates how the constant generator module is responsible for creating constants used by the arithmetic circuit, according to one embodiment of the present invention. In the example used, three constants (C1, C2, and C3) are generated, plus default one (1) and zero (0) values. [Figure 8] FIG. 1 is a schematic diagram illustrating a computing environment in which various embodiments may be implemented. DETAILED DESCRIPTION OF THE INVENTION

[0043] [overview] An example of how the present invention may be operationally implemented, according to one embodiment, is now provided. This example describes a possible implementation of an interpreter configured to translate high-level language contracts (e.g., C / C++) into circuits containing arithmetic gates. However, the present invention may also be configured to translate other HLL languages. To facilitate this translation, specific structures or building blocks can be used. In one or more embodiments, this representation can be viewed as the first step in building a comprehensive pipeline capable of providing distributed, verifiable computation.

[0044] The building blocks presented in this example are not intended to be an exhaustive list of all possible high-level language constructs that may be handled by embodiments of the present invention. Furthermore, alternative implementations of the presented examples may be provided that are within the scope of those skilled in the art.

[0045] An exemplary embodiment of the present invention will now be provided. However, it is important to note that this is only one example of an application in which the present invention may be used. Those skilled in the art will appreciate that the present invention may be advantageously used in other contexts and applications. The present invention is not limited to use with smart contracts or financial instruments.

[0046] Exemplary embodiments and exemplary use cases of the present invention For example, consider a protocol that allows users to create contracts for financial instruments using a Domain Specific Language (DSL). Once the contract is created, its execution can be outsourced to untrusted parties (called "workers" or "provers") and its correctness can be publicly verified. The protocol: Integrity, i.e., an honest verifier is confident of the validity of the output if the protocol is followed correctly. Soundness, i.e., a cheating prover cannot convince a legitimate verifier of the authenticity of the output Zero-knowledge, i.e., a dishonest verifier learns nothing but the validity of the output Use cryptographic primitives that ensure

[0047] The main advantages of the protocol are: · No communication between participants is required, preventing man-in-the-middle attacks · Due to the use of blockchain technology, it becomes difficult for malicious nodes to tamper with data. · Trusted third parties, such as trusted hardware devices, are avoided. Proving a contract does not mean re-executing the code. Computations are not replicated by every node in the network. Instead, proofs of correct execution are stored on the public blockchain and are used solely for proving purposes.

[0048] Such systems can process various types of smart contracts corresponding to various types of tasks and products, not limited to financial applications or uses. Due to its decentralized and distributed nature, the (Bitcoin) blockchain provides a well-suited environment for resolving agreements between two or more parties.

[0049] Such systems are necessary to provide and facilitate programmability in decentralized cryptocurrency systems. However, it is recognized in the art that smart contract programming is an error-prone process. See Delmolino, K. et al. (2015) Step by Step Towards Creating a Safe Smart Contract: Lessons and Insights from a Cryptocurrency Lab and Juels, A. et al. (2013) The Ring of Gyges: Using Smart Contracts for Crime.

[0050] It would therefore be advantageous to be able to use a DSL that makes smart contracts easier to write and read by programmers, thereby reducing errors and reducing time, effort, cost, and resources during the programming process. Ideally, non-expert programmers would be able to write contracts without having to implement any cryptography. Instead, a compiler / interpreter would automatically compile the source code into a cryptographic protocol between the user and the blockchain. These are among the technical problems solved by the present invention. Such advantages are not offered by prior art approaches to proof verification and generation.

[0051] This framework uses state-of-the-art cryptographically verifiable computation (see Quadratic Span Programs and Succint NIZKs without PCPs in Gennaro, R. et al. (2013)) to ensure correct function evaluation. That is, an adversary who obtains secret information cannot manipulate the results thanks to the use of verifiable computation. The model uses blockchain technology to store proof-of-correctness and combines a "correct-by-construction" cryptographic approach with smart contracts.

[0052] This example focuses on the implementation of a translation component that can translate high-level language contracts (e.g., C / C++) into circuits containing arithmetic gates. The resulting circuit is a machine-executable representation of the HLL source code (as opposed to a proof for verification purposes). To facilitate this translation, specific structures or building blocks are used. In the example, the present invention can be used to provide the first step in the construction of a pipeline configured to realize a distributed, verifiable computing system. However, it is again noted that the present invention is not limited to this use case and can be used to implement in a wider range of applications and contexts.

[0053] To illustrate an exemplary implementation, we provide an overview of a framework for verifiable computation, followed by an introduction to a circuit representation of a smart contract in accordance with the present invention.

[0054] [Illustrative Use: Verifiable Computation: Framework] Problem statement: A client sends a specification of a computation P and input x to an untrusted prover (worker). The worker computes an output y and returns it to the client. If y=P(x), a correct prover should be able to produce a certificate of correctness that can convince anyone (not just the client) of the correctness of y. If not, the verifier should reject y with high probability.

[0055] The protocol should be cheaper for the verifier than running P(x) locally, or the protocol should handle computations P that the verifier cannot perform itself. Furthermore, no assumptions about the correctness of the worker's behavior are required.

[0056] Data Access. There are two distinct decentralized databases in the system: (i) DHT - Off-chain data is stored in the DHT. Data is fully randomized across nodes and replicated to ensure high availability, and (ii) Public Ledger - Proofs of correct execution are stored on the blockchain and can be audited.

[0057] Protocol. The steps required by the protocol are shown in Figure 1. A computation P is represented by a circuit C. The client supplies input x, and the worker executes the circuit on input x, claiming that the output is y. The prover is expected to obtain a valid transcript for {C,x,y}. A valid transcript for {C,x,y} is an assignment of values ​​to the circuit wires such that: The value assigned to the input wire is that of x The intermediate values ​​correspond to the correct operation of each gate in C. The value assigned to the output wire is y If the asserted output is incorrect, i.e., y≠P(x), then there is no valid transcript for {C,x,y}.

[0058] The setup phase involves writing the contract in a formal language with precise semantics. According to the invention, an interpreter takes source code as input and

number

[0059] From the circuit C, the system generates a quadratic program Q, i.e., Q contains a set of polynomials that provide a complete description of the original circuit C. Public parameters are then generated that are used by all provers and verifiers.

[0060] A public evaluation key EK and a public verification key VK are derived using a secret value s chosen by the client. The worker uses this public information to evaluate the computation for a particular input x. The output y, the values ​​of the internal circuit wires, and EK are used to generate a proof of correctness π. The proof π is stored on the blockchain and can be verified by multiple parties without requiring the prover to interact with each of these entities separately.

[0061] Every Bitcoin node can verify the payment transaction and therefore the contract using the public verification key VK and the proof π.

[0062] [Smart contract and circuit representation] A Domain Specific Language (DSL) is required to realize smart contracts, such as Actulus Modeling Language (AML), Digital Asset Modeling Language (DAML), Financial Products Markup Language (FpML), etc., but for simplicity of illustration, this specification describes the use of more general languages ​​that can offer a larger range of types, operators, and constructs, such as High Level Language (HLL), C. However, the present invention can be configured to convert different DSL languages ​​to C (or another HLL) using dedicated tools.

[0063] In the example used herein, the interpreter processes source code written in C. The present invention can be adapted to work with other high-level languages ​​(which may also be called "general purpose languages" (GPLs)). Examples of general purpose programming languages ​​include Ada, ALGOL, assembly language, BASIC, Boo, C, C++, C#, Clojure, COBOL, Crystal, D, Dart, Elixir, Erlang, F#, Fortran, Go, Harbour, Haskell, Idris, Java, JavaScript, Julia, Lisp, Lua, Modula-2, NPL, Oberon, Objective-C, Pascal, Perl, PHP, Pike, PL / I, Python, Ring, RPG, Ruby, Rust, Scala, Simula, Swift, and Tcl.

[0064] A comprehensive pipeline for translating a high-level language into a logic circuit is shown in Figure 2. In accordance with the present invention, we focus on the modules highlighted in the dotted box in Figure 2. The high-level C program containing the contract and any required external libraries is linked together to create a standalone preprocessed contract. At this stage, the C precompiler is responsible for checking that all required resources are available. Preprocessor directives are further evaluated. · Constant expressions are evaluated and all symbols are registered. The result is a set of expressions with C-like operators such as addition (+), multiplication (*), comparison (<), equality (==), conditional statements (?, :), and logical operators (and, or, not, xor). A main function with a predefined name and format is required. Arithmetic circuits (see Figure 3) are constructed by representing symbols with n-bit wires connected to basic arithmetic gates, e.g., addition and multiplication. A polynomial in a quadratic arithmetic program (QAP) is defined in terms of its evaluation at the root of an arithmetic circuit, as presented in Quadratic Span Programs and Succinct NIZKs Without PCPs by Gennaro, R. et al. (2013).

[0065] Figure 3 shows an example of an arithmetic circuit. Each wire comes from a field F, and all operations are performed over the field F. The circuit computes y = x1 + x2 · x3 · (x3 + x4). Because the final output of the circuit is a sum, an additional multiplication gate (which multiplies by a constant ℓ) is required.

[0066] [C language interpreter] In accordance with one exemplary embodiment of the present invention, an interpreter is now described that can recognize a subset of the instructions defined for the C programming language, including preprocessor directives, conditional statements, arithmetic and bitwise Boolean operators, and global functions. As will be readily apparent to those skilled in the art, support for arrays and structures can also be provided without additional logic.

[0067] The interpreter consolidates the expressions into an arithmetic gate language using multiplication, addition, and specific building blocks presented below in the section entitled "Generating Arithmetic Primitives." Each wire has a specified bit width. If it is 1 bit wide, the wire represents a binary variable.

[0068] [Arithmetic Strengthening of C-like Programs for Implementation on Blockchain] Next, we detail the process of constructing an arithmetic circuit that represents the functionality expressed in C source code. At each stage of the process, unexpected behavior (e.g., missing symbols, incorrect syntax, or unknown operators) results in immediate termination of program execution with appropriate code errors.

[0069] [Preprocessing] A smart contract may consist of multiple files and libraries, as shown in Figure 2. The first step of the protocol involves the creation of a single source file containing the full set of instructions needed to implement the contract. The individual substeps can be listed as follows: All comments will be removed. Header declarations are imported from header files into source files. All source files are merged. Preprocessor C directives and macros are resolved or evaluated. These include #define directives and conditional #ifdef directives.

[0070] At the end of this step, the actual values ​​of all preprocessor constants must be known. The values ​​of variables used in the source code must depend only on the values ​​of the contract's inputs. Furthermore, the declaration of the entry point in the source code must have the following syntax: [Table 1]

[0071] The types inputType and outputType are user-defined. The source code box below shows a simple example of a smart contract containing a single sum operation between two unsigned integer inputs. [Table 2]

[0072] The outputs can be represented by variables of different types depending on the particular contract. In the above case, the single output is simply connected to the result of the arithmetic operation.

[0073] [Integer and real number] In this exemplary embodiment, for simplicity, we assume that only operations between integers (signed or unsigned) are available. If this assumption were removed, the circuit building blocks (see the "Generating Arithmetic Primitives" section) would have to be expanded. Therefore, operations between real numbers would have to be converted to operations between integers. Consider the following portion of a contract: "Check if the average employee salary is higher than $32.5K"

[0074] This statement requires division (by N employees) to calculate the average value. However, this statement can be transformed into the following expression between integers:

number

[0075] Creating a global table of symbols In computer science, a table of symbols is a data structure used by a compiler / interpreter to associate each identifier (symbol) in the source code with information about its declaration. In this second step, the interpreter finds all global symbols declared in the source file. ·function Structure (or class) Note: The use of classes (in OOP languages ​​such as C++) requires additional logic to check the scope of the public, protected, and private sections. ·constant (Global variables are allowed, but not recommended. The scope of a contract(...) function should be treated as an independent black box. Its behavior should not depend on external variables.)

[0076] For each of these symbols, a hierarchy of local symbols is built that represents the internal declarations of those identifiers. At the end of this stage, each global symbol (name, type, and value) in the table may be directly addressed for further processing.

[0077] [Contract entry point detection] One of the global symbols must be the entry point of the contract (the Contract function in the "Preprocessing" section). The names, number, and types of its parameters are checked against the expected syntax. There may be further logic to check that all input structures are used in the contract and that all output structures are linked to some part of the contract.

[0078] [Evaluate row by row] Each line of code is analyzed independently. Local symbols representing internal declarations of identifiers are included in the hierarchy of the global table of symbols. More specifically, this stage is responsible for the following tasks: Type decoding, including declarations of structures and arrays, basic types (Boolean, Integer, etc.) and pointers. Decoding expressions, e.g., unary or binary operations, constants, identifiers, data structures, and function calls. · Expression evaluation, i.e. evaluation of (numeric) expressions independent of input values. Memory allocation, i.e., temporary storage allocation for data structures required by the contract functionality.

[0079] This stage links all the statements of the arithmetic expression in terms of space (i.e. memory used) and time (i.e. operator precedence). Each output variable is therefore represented as a combination of logical and arithmetic operations applied to the input variables.

[0080] [Create an explicit formula] Using the data structures defined in the "Row-by-Row" section, a general arithmetic / logical expression e is folded to be expressed in explicit form according to the following syntax: OP N (OP N-1 (...(OP1(OP0))...))

[0081] Following this syntax, any operator OP i+1 is the operator OP i is applied to e after

[0082] For example, given the following code: [Table 3] The explicit expression e can be expressed as follows: out0=(?(<15(ADD(ADD(ADD in0in1)in0)in1))50(MUL(MUL in0in1)in1))

[0083] As described in the "Generating Arithmetic Primitives" section, the expression e is used to create the arithmetic primitives needed to express the contract function.

[0084] [Generating Arithmetic Primitives] At this stage, the interpreter is ready to make a one-to-one mapping between the operations used to generate the expression e and the structures required to realize these functionalities on a circuit.

[0085] The key parameter needed to create a circuit is the bit width, n bit , i.e., the number of bits used to represent a signed (or unsigned) integer. Different computer architectures use different n bitIf the client does not know the worker's preferred bit-width value, that value is chosen arbitrarily and specified in the circuit's header along with further information, as shown in Figure 4. (Just as compilation is performed for a specific target architecture, knowing the bit-width value can result in a more efficient implementation and execution of the circuit.)

[0086] The version field gives important information about the particular algorithm used to create a particular building block in the circuit. In the exemplary implementation, two's complement binary representation of signed integers was chosen.

[0087] [Addition and multiplication operations] Addition and multiplication operations are mapped one-to-one to addition and multiplication gates in the circuit. Given two n-bit wire inputs, the addition wire output requires n+1 bits, and the multiplication wire output requires 2n bits. For example, given two n bit Multiplication between wires a and b can be expressed as follows: MUL[id a id b ]TO[id c ]

[0088] (Any arithmetic or Boolean wire x in the circuit will have a value id x For binary variables, counting starts from value zero.) The result c is bit It is automatically expressed in bits.

[0089] Boolean The full set of Boolean gates can be computed using arithmetic gates. Given two Boolean values ​​a and b, the following equivalents are valid: ·AND(a,b)=ab NAND(a,b)=1-ab OR(a,b)=1-(1-a)(1-b) NOR(a,b)=(1-a)(1-b) XOR(a,b)=(1-a)b+(1-b)a

[0090] With the exception of the XOR operator, each Boolean gate requires only one multiplication. All arithmetic operations are performed on 1-bit wide wires.

[0091] A bitwise Boolean operation on an n-bit wide input requires n 1-bit multiplications (for AND) or additions (for OR). Starting with the least significant output bit, each element is then multiplied by 2 and added to the next element to build the resulting n-bit integer value (see the "Wire Compression" section).

[0092] Wire Extension Wire extension is usually done by arithmetic wire a to n a n bits are used to translate into output wires a is the logarithm to the base 2 of the maximum value that can be represented by a. For example, consider the following contract fragment: Check if variable is even」

[0093] n a = 4, this statement is realized using wire expansion as shown in Figure 5. Assuming a0 represents the least significant bit of a, the output of the statement is equal to a0 itself. This circuit building block can be expressed as follows: EXPAND[id a ]TO[id a3 id a2 id a1 id a0 ]

[0094] Looking at the circuit in more detail, it is clear that only one bit of a is needed for further processing, and the remaining one-bit wires can be removed. The interpreter may generate only the individual one-bit wires that are used in the rest of the contract. Figure 5 shows the "Check if variable Here is one implementation of a 4-bit wire expander that expresses the statement "is even."

[0095] The interpreter applies a specific syntax to the optimized wire expander. EXPAND[id a ]TO[0->id a0 ]

[0096] That is, only the least significant 1-bit wire (i.e., identifier number zero) is captured and assigned the identifier id a0 n a The larger , the more effective the optimization can be. (In this context, optimization is defined as the possibility of saving space for storing or transmitting low-level directives used to represent arithmetic circuits.)

[0097] Wire Compression Wire compression is 1 bit wire a i n a Used to couple back to the bit output wires.

number

[0098] This building block consists of additions and multiplications by constants, so the size of the QAP polynomial is not affected (see Quadratic Span Programs and Succinct NIZKs With PCPs by Genaro R. et al. (2013)). a = 256, and the range [id a0 ,id a255 Assuming that the identifiers in ] are contiguous, an optimized way to represent this building block is as follows: COMPRESS[id a0 :id a255 ]TO[id a ]

[0099] The resulting wire a is then id a It is identified by

[0100] [Negation] The negation operation is necessary to compare two variables because their difference can be compared to the value zero. The negation of an n-bit wire can be realized as a multiplication by the constant -1. This constant must be expressed as follows:

number

[0101] Equal To Zero Operation n bit This building block for bit wire a can be realized as follows: n bit Wire extension for bits (a0, ..., a nbit-1 ) Negate each 1-bit wire (a i →b i ) Resulting b i Multiplying the wires, i.e.,

number

[0102] Therefore, the 1-bit variable c=1 if and only if a=0.

[0103] Compare To Zero Operation The "greater than" operation can be transformed into a "less than" operation using simple equality rules. In two's complement representation, this operation corresponds to checking whether the difference between two signed integers is positive or negative (or equal to zero, in the case of the "less than or equal to" operation). The sign of the difference c = ab is given by the most significant bit x in the binary representation. Negative numbers are characterized by x = 1, and positive numbers by x = 0. EXPAND[id c ]TO[n bit -1 -> x]

[0104] Depending on the type of comparison (positive vs. negative), the binary value x needs to be negated.

[0105] [Conditional Statement] A conditional statement in a high-level language can be expressed in the following form: IF(S c ) S a ELSE S b

[0106] Statement S c depends on the contract input, so branch S a and S b Both statements must be implemented in the circuit. The logic flow is shown in Figure 6. c Depending on the (binary) output of a or Statement S b is performed. The binary operation x+1 is used to negate x.

[0107] [Generate Constants] The constant values ​​do not depend on the input wires of the circuit. We use a dedicated unary multiplication gate of the mul-by-const-c style and provide the following further circuit to generate the constant values ​​required by the contract: · Constant zero is calculated by multiplying the input wire by 0. (A contract must have at least one input. Thus, the input with identifier 1 (e.g., in1 in FIG. 7) can be used to generate the constant zero.) The constant one is calculated by adding one to the constant zero. any further constant c i is computed by using mul-by-const-ci for the constant ichi.

[0108] The constants zero and one are always added to the circuit, so implementing k arbitrary constants requires k+2 gates. This process is illustrated in Figure 7. A constant generator module is provided in accordance with one embodiment of the present invention, responsible for creating constants used by the arithmetic circuit. In this example, three constants (C1, C2, and C3) are generated, along with default one (1) and zero (0) values.

[0109] The constants have a known bit width as defined by the two's complement standard.

[0110] Referring now to FIG. 8 , an exemplary simplified block diagram of a computing device 2600 that may be used to implement at least one embodiment of the present disclosure is provided. In various embodiments, the computing device 2600 may be used to implement any of the systems illustrated and described above. For example, the computing device 2600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 8 , the computing device 2600 may include one or more processors (collectively labeled 2602) having one or more levels of cache memory and a memory controller, which may be configured to communicate with a storage subsystem 2606 that includes a main memory 2608 and persistent storage 2610. The main memory 2608 may include dynamic random access memory (DRAM) 2618 and read-only memory (ROM) 2620, as shown. The storage subsystem 2606 and cache memory 2602 may be used for storage of information such as details associated with transactions and blocks as described in this disclosure. The processor 2602 may be utilized to provide the steps or functions of any of the embodiments described in this disclosure.

[0111] The processor 2602 may also be in communication with one or more user interface input devices 2612 , one or more user interface output devices 2614 , and a network interface subsystem 2616 .

[0112] The bus subsystem 2604 may provide a mechanism that allows the various components and subsystems of the computing device 2600 to communicate with each other as intended. Although the bus subsystem 2604 is shown schematically as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses.

[0113] The network interface subsystem 2616 may provide an interface to other computing devices and networks. The network interface subsystem 2616 may act as an interface for receiving data from other systems and transmitting data from the computing device 2600 to other systems. For example, the network interface subsystem 2616 may allow a data technician to connect the device to a network, thereby allowing the data technician to send data to and receive data from the device while at a remote location, such as a data center.

[0114] User interface input devices 2612 may include one or more user input devices, such as a keyboard; a pointing device, such as an integrated mouse, trackball, touchpad, or graphics tablet; a scanner; a barcode scanner; a touchscreen integrated into a display; audio input devices, such as a voice recognition system, a microphone; and other types of input devices. In general, use of the term "input device" is intended to encompass all possible types of devices and mechanisms for inputting information into computing device 2600.

[0115] The one or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display such as an audio output device. The display subsystem may be a flat panel device such as a cathode ray tube (CRT), a liquid crystal display (LCD), a light emitting diode (LED) display, or a projection or other display device. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms that output information from computing device 2600. The one or more user interface output devices 2614 may be used, for example, to present a user interface and facilitate user interaction with applications that perform the described processes and variations thereof, when such interaction may be appropriate.

[0116] Storage subsystem 2606 may provide a computer-readable storage medium that stores basic programming and data constructs that may provide functionality of at least one embodiment of the present disclosure. Applications (programs, code modules, instructions), which when executed by one or more processors, may provide functionality of one or more embodiments of the present disclosure, may be stored in storage subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. Storage subsystem 2606 may also provide a repository for storing data used in accordance with the present disclosure. For example, main memory 2608 and cache memory 2602 may provide volatile storage of programs and data. Persistent storage 2610 may provide persistent (non-volatile) storage of programs and data and may include flash memory, one or more solid-state drives, one or more magnetic hard disk drives, one or more floppy disk drives with associated removable media, one or more optical drives (e.g., CD-ROM, DVD, or Blue-Ray) with associated removable media, and other similar storage media. Such programs and data may include programs that perform the steps of one or more embodiments described in this disclosure and data associated with the transactions and blocks described in this disclosure.

[0117] Computing device 2600 may be of various types, including a portable computing device, a tablet computer, a workstation, or any other device described below. Additionally, computing device 2600 may include another device that may be connected to computing device 2600 through one or more ports (e.g., USB, headphone jack, Lightning connector, etc.). A device that may be connected to computing device 2600 may include multiple ports configured to accept fiber optic connectors. Thus, the device may be configured to convert optical signals into electrical signals that may be transmitted through the ports connecting the device to computing device 2600 for processing. Due to the ever-changing nature of computers and networks, the description of computing device 2600 shown in FIG. 8 is intended only as a specific example for purposes of illustrating a preferred embodiment of the device. Many other configurations are possible, having more or fewer components than the system shown in FIG. 8.

[0118] It should be noted that the above-described embodiments illustrate rather than limit the invention, and that those skilled in the art can design many alternative embodiments without departing from the scope of the invention as defined by the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the scope of the claim. The words "comprises" and "comprises", and the like, do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprises" means "comprises or consists of", and "comprising" means "includes or consists of". The singular reference of an element does not exclude the plural reference of such elements, and vice versa. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.

[0119] All references cited herein, including publications, patent applications, and patents, are hereby incorporated by reference to the same extent as if each reference was individually and specifically indicated to be incorporated by reference and was set forth in its entirety herein, including UK Patent Application Nos. GB1719998.5, GB1718505.9, and GB1720768.9.

Claims

1. 1. A computer-implemented method comprising: processing portions of the source code to generate an arithmetic circuit; the source code is written in a high-level programming language; the arithmetic circuit includes one or more arithmetic gates configured to represent some or all of the functionality expressed in the source code, the arithmetic circuit being architecture independent and including n-bit wires connected to the arithmetic gates, and the outputs of the one or more circuit wires and a public evaluation key EK are used to generate a proof of correctness; A method comprising:

2. The method of claim 1 , wherein the proof of correctness is stored on a blockchain.

3. The method of claim 1 , wherein the public evaluation key EK is derived using a secret value.

4. The method of claim 1 , wherein the public verification key is derived using a secret value.

5. providing a hardware and / or software circuit using said arithmetic circuit; The method of claim 1 further comprising:

6. the arithmetic circuit includes an n-bit wire connected to an arithmetic gate; The method of claim 1.

7. The method further includes preprocessing the source code to determine one or more constants, the preprocessing comprising: removing comments; importing header declarations from a header file into a source file; merging a plurality of source files; resolving or evaluating directives and macros; The method of claim 1 , comprising one or more of:

8. 2. The method of claim 1, further comprising: detecting all global variables declared in the source code, the global variables relating to functions, structures or classes, constants, and / or execution entry points.

9. The method comprises: generating a table of symbols to associate each symbol (i.e., identifier) ​​provided in the source code with declarative information provided in the source code, the symbols in the table being global and / or local symbols; The method of claim 1 further comprising:

10. 10. The method of claim 1, further comprising performing a line-by-line evaluation of the source code that results in an arithmetic and / or logical expression that represents one or more out variables as a combination of logical and / or arithmetic operations applied to one or more input variables.

11. The row-by-row evaluation is Type decoding, Decoding the expression, Expression evaluation, and / or Allocating memory for data structures required by said functions The method of claim 10, comprising the substeps of:

12. mapping said arithmetic and / or logical operations of said formula onto arithmetic gates; The method of claim 10 further comprising:

13. The mapping step includes: performing wire expansion; and / or Substeps to perform wire compression 13. The method of claim 12, comprising:

14. using said arithmetic circuit to generate a quadratic program including a set of polynomials that provide a description of said circuit; The method of claim 1 further comprising:

15. providing the secondary program to an entity for execution of the secondary program using one or more inputs; The method of claim 14 further comprising:

16. 2. A computer-implemented system configured to perform the steps of claim 1, preferably including an interpreter configured to perform processing of said source code.

Images