An RSA accumulator-based index proof method for performing index proofs for composite numbers and duplicate elements

Abstract

We provide a Rivest-Shamir-Adleman (RSA) accumulator-based index proof method that provides a prime number table vector by converting composite numbers included in the table vector into prime numbers in the setup stage. [Solution] In an index proof system in which a setup module, a prover, and a verifier are connected via a network that allows them to communicate with each other, an RSA accumulator-based index proof method obtains a table vector including a plurality of table values, generates a plurality of prime random values, generates a plurality of prime table values ​​corresponding to the plurality of table values ​​using the prime random values, generates a prime table vector using the plurality of prime table values ​​and the plurality of prime random values, publishes the prime table vector, and performs RSA accumulator-based index proof to verify whether an index value is included in the table vector using the prime table vector.

Description

[Technical Field]

[0001] The present invention relates to an RSA accumulator-based index proof method for performing index proof for composite numbers and duplicate elements. [Background technology]

[0002] Zero-knowledge proofs are often used to provide verifiability in blockchain systems that guarantee privacy and cloud systems that delegate computations. zk-SNARK (zero-knowledge Succinct Non-interactive ARguments of Knowledge) is a widely used zero-knowledge proof algorithm, and it can prove that an operation on an arbitrary circuit has been performed correctly without disclosing any secret information used within the circuit.

[0003] In addition, utilizing such zero-knowledge proofs, an RSA (Rivest-Shamir-Adleman) accumulator-based membership proof method was introduced (Campanelli, M., Fiore, D., Han, S., Kim, J., Kolonelos, D., Oh, H.: Succinct zero-knowledge batch proofs for set accumulators). The RSA accumulator-based membership proof method is a method that can prove whether an index value is included in the membership without leaking privacy. However, this RSA accumulator-based membership proof method has the problem that it can only be used when the index values ​​are prime numbers and there are no overlaps between index values. Summary of the Invention [Problem to be solved by the invention]

[0004] It is an object of the present invention to provide an RSA accumulator-based lookup proof method that provides a prime number table vector by converting composite numbers included in a table vector into prime numbers in a setup stage.

[0005] It is yet another object of the present invention to provide an RSA accumulator-based index proof method that handles duplicate elements in the proof stage. [Means for solving the problem]

[0006] An RSA accumulator-based index proof method performed by at least one processor according to one embodiment of the present disclosure may include the steps of: obtaining a table vector including a plurality of table values; generating a plurality of prime random values; generating a plurality of prime table values ​​each corresponding to the plurality of table values ​​using the prime random values; generating a prime table vector using the plurality of prime table values ​​and the plurality of prime random values; publishing the prime table vector; and performing RSA accumulator-based index proof using the prime table vector to verify whether an index value is included in the table vector.

[0007] In one embodiment, generating the prime number table vector may include performing a concatenation operation on the table value and the prime random value; determining whether the concatenated value is a prime number; if the concatenated value is a prime number, determining a prime number table value corresponding to the table value; and generating prime number table values ​​corresponding to the plurality of table values ​​as the prime number table vector.

[0008] In one embodiment, the index proof method may further include the steps of: performing a zero-knowledge proof that the prime table value is generated as a result of a concatenation operation on the table value and the prime random value; and transmitting a first proof value resulting from the zero-knowledge proof.

[0009] In one embodiment, the index proof method may further include receiving an index vector including a plurality of index values ​​each corresponding to at least one prime table value; and generating a temporary vector including a plurality of temporary values ​​by processing duplicate values ​​among the plurality of index values ​​using the prime table vector.

[0010] In one embodiment, the step of generating the temporary vector may include: substituting an index value among the plurality of index values ​​that overlaps with other elements of the index vector with any one value of the prime number table vector; and generating the vector generated as a result of the substituting step as the temporary vector.

[0011] In one embodiment, the index proof method is to convert the i-th element of the temporary vector into e i The number of elements in the temporary vector is m, and the i-th element of the index vector is f i When it is assumed that: ∑ i = ∑ j ...

[0012]

number

[0013] In one embodiment, the step of performing the RSA accumulator-based index proof is performed outside of a zero-knowledge proof circuit.

[0014] An RSA accumulator-based index proof method performed by at least one processor according to one embodiment of the present disclosure may include: obtaining a prime table vector including a plurality of prime table values; receiving an index vector including a plurality of index values ​​each corresponding to at least one prime table value; generating a temporary vector including a plurality of temporary values ​​by processing duplicate values ​​among the plurality of index values ​​using the prime table vector; and performing RSA accumulator-based index proof using the temporary vector to determine whether the plurality of index values ​​are included in the prime table vector.

[0015] In one embodiment, the step of generating the temporary vector may include: substituting an index value among the plurality of index values ​​that overlaps with other elements of the index vector with any one value of the prime number table vector; and generating the vector generated as a result of the substituting step as the temporary vector.

[0016] In one embodiment, the index proof method is to convert the i-th element of the temporary vector into e i The number of elements in the temporary vector is m, and the i-th element of the index vector is f i When x = 1, the method may further include performing a zero-knowledge proof for the following equation: and transmitting a proof value generated as a result of the zero-knowledge proof.

[0017]

number

[0018] According to the technical idea of ​​the present invention, when converting a composite number into a prime number in the setup stage, by utilizing a concatenation function, zero-knowledge proof can be performed in a short time and the RSA accumulator-based index proof method can be utilized. Furthermore, by processing duplicate elements in the proof stage, the RSA accumulator-based index proof method can be utilized even if index elements are duplicated. [Brief explanation of the drawings]

[0019] [Figure 1] FIG. 1 is a block diagram illustrating an index certification system according to an exemplary embodiment of the present disclosure. [Figure 2] 1 is a flowchart illustrating an index certification method according to an exemplary embodiment of the present disclosure. [Figure 3] 1 is a flowchart illustrating a setup stage (S10) according to an exemplary embodiment of the present disclosure. [Figure 4] 1 is a diagram illustrating a setup algorithm according to an exemplary embodiment of the present disclosure. [Figure 5] 1 is a diagram illustrating a setup stage according to an exemplary embodiment of the present disclosure. [Figure 6] 10 is a flowchart illustrating the certification step (S20) according to an exemplary embodiment of the present disclosure. [Figure 7] 1 is a diagram illustrating a proof algorithm according to an exemplary embodiment of the present disclosure. [Figure 8] 1 is a diagram illustrating a certification stage according to an exemplary embodiment of the present disclosure. [Figure 9] 1 is a diagram illustrating a verification algorithm according to an exemplary embodiment of the present disclosure. [Figure 10] FIG. 1 is a block diagram illustrating a computing system according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0020] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, as well as methods for achieving them, will become apparent from the following detailed description of the embodiments together with the accompanying drawings. However, the technical concept of the present invention is not limited to the following embodiments and may be embodied in various different forms. However, the following embodiments are provided to complete the technical concept of the present invention and to fully convey the scope of the present invention to those skilled in the art, and the technical concept of the present invention is defined only by the scope of the claims.

[0021] In assigning reference numerals to components in each drawing, it should be noted that the same components are assigned the same numerals as much as possible even if they are displayed in different drawings. Furthermore, in the description of the present invention, if it is determined that a detailed description of related known structures or functions may obscure the gist of the present invention, the detailed description thereof will be omitted.

[0022] Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used in a manner commonly understood by a person of ordinary skill in the art to which the present invention belongs. Furthermore, terms defined in commonly used dictionaries should not be interpreted ideally or excessively unless expressly defined otherwise. The terms used herein are intended to describe the embodiments and are not intended to limit the present invention. In this specification, the singular form includes the plural form unless otherwise specified in the context.

[0023] Furthermore, when describing components of the present invention, terms such as first, second, A, B, (a), (b), etc. may be used. These terms are merely used to distinguish a component from other components, and do not limit the nature, order, or sequence of the components. When a component is described as being "coupled," "coupled," or "connected" to another component, it should be understood that the component may be directly coupled or connected to the other component, but that other components may also be "coupled," "coupled," or "connected" between the components.

[0024] As used herein, "comprises" and / or "comprising" means that a stated component, step, operation and / or element does not exclude the presence or addition of one or more other components, steps, operations and / or elements.

[0025] Components included in one embodiment and components having common functions may be described using the same names in other embodiments. Unless otherwise specified, the description of one embodiment may be applied to other embodiments, and detailed descriptions may be omitted to the extent that they overlap or are obvious to a person skilled in the art.

[0026] Hereinafter, some embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0027] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to preferred embodiments thereof and the accompanying drawings.

[0028] FIG. 1 is a block diagram illustrating an index certification system according to an exemplary embodiment of the present disclosure.

[0029] 1, index proof system 10 is a system for verifying whether index vector e is an element included in table vector T, and the components included in index proof system 10 may be configured with a plurality of terminals. In one example, setup module 100, prover 200, and verifier 300 may each be configured with at least one terminal, and at least one terminal may include various terminal devices capable of communication, such as a cellular phone, a smartphone, a laptop, a personal computer (PC), a navigation system, a personal communication system (PCS), a global system for mobile communications (GSM), a personal digital cellular system (PDC), a personal handyphone system (PHS), a personal digital assistant (PDA), an international mobile telecommunication (IMT)-2000, a code division multiple access (CDMA)-2000, a wireless broadband internet (W-CDMA), a Wibro (Wireless Broadband Internet) terminal, a smartpad, and a tablet PC. In yet another example, the setup module 100, the prover 200, and the verifier 300 may each be implemented in a server.

[0030] The setup module 100, the certifier 200, and the verifier 300 can be connected through a network that can communicate with each other via wired / wireless. When connected via wired, the network can use a serial method, and when connected wirelessly, the network can communicate using a wireless communication network. Wireless communication networks include, but are not limited to, local area networks (LANs), wide area networks (WANs), the Internet (WWW: World Wide Web), wired / wireless data communication networks, telephone networks, wired / wireless television communication networks, 3G, 4G, 5G, 3GPP (registered trademark) (3rd Generation Partnership Project), 5GPP (5th Generation Partnership Project), LTE (Long Term Evolution), WIMAX (World Interoperability for Microwave Access), Wi-Fi, the Internet, LANs (Local Area Networks), Wireless LANs (Wireless Local Area Networks), WANs (Wide Area Networks), PANs (Personal Area Networks), RF (Radio Frequency), Bluetooth (registered trademark) networks, NFC (Near-Field Communication) networks, satellite broadcasting networks, analog broadcasting networks, DMB (Digital Multimedia Broadcasting) networks, and blockchain networks.

[0031] In this specification, the operation of the index verification system 10 and each component included in the index verification system 10 may refer to an operation performed by a processor included in each component based on a computer program including at least one instruction stored in a storage device included in each component, and the storage device may include non-volatile memory, volatile memory, flash memory, a hard disk drive (HDD), a solid state drive (SSD), etc. Also, the processor may include at least one of a central processing unit (CPU), a graphic processing unit (GPU), a neural processing unit (NPU), RAM, ROM, a system bus, and an application processor.

[0032] The setup module 100 can generate a prime table vector Th based on the table vector T. In one embodiment, the setup module 100 can generate the prime table vector Th by concatenating random prime values ​​with the table values ​​of the table vector T, which will be described in detail below with reference to FIGS.

[0033] The prover 200 receives the index vector e and the accumulation value (acc) and can verify whether the index vector e is a valid value included in the table vector T using an RSA accumulator-based index proof method or an RSA accumulator-based membership proof method. To this end, the prover 200 can include a zero-knowledge proof module 210 and an RSA accumulator index proof module 220. The zero-knowledge proof module 210 can generate a first proof value indicating whether the prime table vector Th is validly created based on a zero-knowledge proof circuit, and a second proof value indicating whether the duplicate processing of the index vector e is validly performed. The RSA accumulator index proof module 220 can generate a third proof value indicating whether the index vector e is included in the table vector T based on an RSA accumulator membership proof method using a zero-knowledge proof circuit. The first to third proof values ​​can be transmitted to the verifier 300 as a proof value pi. The zero-knowledge proof module 210 and the RSA accumulator index proof module 220 can include software and / or hardware modules for performing each proof.

[0034] The verifier 300 can verify whether the proof of the prover 200 has been performed in a valid manner based on the proof value pi. In one embodiment, the verifier 300 can verify the proof value pi using a zero-knowledge proof method. In this specification, a zero-knowledge proof method is a method for verifying the integrity of a message without checking the message (e.g., index vector e), and in one example, a zk-SNARK (zero-knowledge SNARK) or a cc-SNARK can be used as the zero-knowledge proof method.

[0035] According to the technical idea of ​​the present disclosure, the index proof system 10 generates a prime table vector Th by primalizing the table vector T, and processes duplicate elements of the index vector e, thereby making it possible to utilize the RSA accumulator membership proof method even under conditions where duplicate elements are present, including composite numbers that are not prime, and as a result, RSA accumulator index proof may become possible.

[0036] Furthermore, according to an embodiment of the present disclosure, the index proof system 10 may generate the prime table vector Th using a concatenation operation, thereby enabling fast proof when performing zero-knowledge proof on the prime table vector Th.

[0037] Furthermore, according to one embodiment of the present disclosure, when the index proof system 10 performs overlap processing of the index vector e, it can perform zero-knowledge proof using a simple formula, which may result in fast zero-knowledge proof.

[0038] FIG. 2 is a flowchart illustrating an index certification method according to an exemplary embodiment of the present disclosure.

[0039] Referring to FIG. 2, the index proof method may include a setup step (S10), a proof step (S20), and a verification step (S30). In the setup step (S10), various parameters for the index proof method may be defined. In one embodiment, in the setup step (S10), a prime table vector may be generated based on the table vector. In addition, various parameters for the RSA accumulator-based membership proof method may be additionally defined. The setup step (S10) will be described in detail below with reference to FIGS. 3 to 5.

[0040] In the proof step (S20), a proof value pi for the zero-knowledge proof can be generated using the zero-knowledge proof module 210 and the RSA accumulator index proof module 220. In one embodiment, in the proof step (S20), a temporary vector without duplicates is generated by performing a duplication process on the index vector, and an RSA accumulator-based membership proof method can be performed using the temporary vector.

[0041] In the verification step (S30), using the proof value generated in the proof step (S20), it can be verified whether the prime table vector generated in the setup step (S10) was generated correctly, whether the duplication process of the temporary vector generated in the proof step (S20) was performed correctly, and whether the RSA accumulator index proof performed in the proof step (S20) was performed correctly.

[0042] FIG. 3 is a flowchart illustrating a setup step (S10) according to an exemplary embodiment of the present disclosure, and FIG. 4 is a diagram illustrating a setup algorithm according to an exemplary embodiment of the present disclosure.

[0043] 3 and 4, the setup module 100 may obtain a table vector T including a plurality of table values ​​(S110). The table vector T may be publicly disclosed in advance to utilize the RSA accumulator membership proof, and the setup module 100 may obtain the public table vector T.

[0044] The setup module 100 generates a plurality of prime random values ​​(S120) and generates a plurality of prime table values ​​corresponding to a plurality of table values ​​using the generated prime random values ​​(S130). In one embodiment, the setup module 100 generates the prime table values ​​by concatenating the prime random values ​​with the table values. In one embodiment, the setup module 100 generates the prime table values ​​by repeating the process of concatenating the prime random values ​​with the table values ​​using the prime random values ​​and then checking whether the generated values ​​are prime numbers.

[0045] In one example, the table value is T i , a prime random value z i , prime number table value Th i Then, the prime number table value can be determined according to the following mathematical formula 1 (N is the number of digits of the prime number random value).

[0046]

number

[0047] The setup module 100 may generate a prime table vector Th using a plurality of prime table values ​​and a plurality of prime random values ​​(S140). The setup module 100 may publish the generated prime table vector to utilize the RSA accumulator-based index proof method according to the technical idea of ​​the present disclosure (S150).

[0048] In order to utilize the conventional RSA accumulator-based membership proof method, all elements are required to be prime numbers. However, the RSA accumulator-based index proof method according to the technical idea of ​​the present disclosure can utilize the conventional RSA accumulator-based membership proof method even for table vectors containing composite numbers by converting the elements of the table vector to be indexed, even if they are not prime numbers and are composite numbers, into prime numbers. As a result, it may become possible to perform RSA accumulator-based index proof for table vectors that utilize composite numbers.

[0049] In addition, the RSA accumulator-based index proof method according to the technical idea of ​​the present disclosure can convert a composite number into a prime number using a concatenation operation rather than a method such as a hash function, and since the concatenation operation allows zero-knowledge proofs to be performed relatively quickly and easily, the proof of the RSA accumulator-based index proof method can also be performed quickly.

[0050] In addition, the RSA accumulator-based index proof method according to one embodiment of the present disclosure includes not only prime table values ​​but also prime random values ​​in the prime table vector Th, thereby enabling proof of the prime random values ​​to be performed as well, and utilizing the prime random values ​​may enable rapid and accurate zero-knowledge proof.

[0051] FIG. 5 is a diagram illustrating a setup stage according to an exemplary embodiment of the present disclosure.

[0052] 5, the setup module 100 may obtain a table vector T including a plurality of table values ​​t1 to t5 and may obtain a plurality of prime random values ​​z1 to z5. In one example, the setup module 100 may randomly determine a plurality of prime random values ​​from a group including a plurality of prime numbers.

[0053] The setup module 100 can generate a plurality of prime number table values ​​th1 to th5 by performing a concatenation operation (concat) on a plurality of table values ​​t1 to t5 and a plurality of prime number random values ​​z1 to z5. In one example, the setup module 100 can generate a first prime number table value th1 by concatenating a prime number random value (z1='0101') to a first table value (t1='0010') and checking whether the concatenated value '00100101' is a prime number. If the concatenated value is not a prime number, the setup module 100 can change the prime number random value and perform the same method.

[0054] As a result, the setup module 100 can generate the first prime table value (th1='00100101') by concatenating the first prime random value (z1='0101') to the first table value (t1='0010'), and can generate the second prime table values ​​th2 to th5 corresponding to the second table values ​​t2 to t5, respectively, in the same manner.

[0055] The setup module 100 can generate a prime number table vector Th composed only of prime numbers, including the generated first prime number table values ​​th1 to th5 and the first prime number random values ​​z1 to z5 used to generate the first prime number table values ​​th1 to th5.

[0056] According to one embodiment of the present disclosure, the setup module 100 converts the table vector into a prime table vector composed only of prime numbers using a concatenation operation, thereby enabling not only index proof using the conventional RSA accumulator-based membership proof method but also fast zero-knowledge proof.

[0057] FIG. 6 is a flowchart illustrating the verification step (S20) according to an exemplary embodiment of the present disclosure, and FIG. 7 is a diagram illustrating a verification algorithm according to an exemplary embodiment of the present disclosure.

[0058] 6 and 7, the prover 200 may acquire a prime table vector (S210) and receive an index vector including a plurality of index values ​​corresponding to the prime table values ​​(S220). In this specification, the index vector may be checked to see if it is included in the prime table vector.

[0059] The prover 200 can generate a temporary vector by processing duplicate values ​​among a plurality of index values ​​using a prime table vector (S230). In one embodiment, the prover 200 can generate a temporary vector by changing duplicate values ​​among a plurality of index values ​​to prime table values ​​included in the prime table vector.

[0060] According to one embodiment of the present disclosure, for a prime table vector whose components may be duplicated, the prover 200 can utilize an RSA accumulator-based membership proof method that does not allow duplication by replacing the duplicated components with other values ​​of the prime table vector, thereby enabling index proof.

[0061] The prover 200 can perform a zero-knowledge proof on the prime table value (S240). In one embodiment, the prover 200 can perform a zero-knowledge proof on Equation 1 regarding whether the prime table value was generated using the table value and the prime random value. The prover 200 can generate a first proof value as a result of the zero-knowledge proof.

[0062] The prover 200 can perform zero-knowledge proof on the temporary vector and the index vector (S250). In one embodiment, the prover 200 can verify whether the temporary vector contains a component of the index vector and whether the temporary vector has overlaps through zero-knowledge proof. In one example, the prover 200 can verify whether the component e of the temporary vector is i and the component f of the index vector i A zero-knowledge proof can be performed on the following mathematical formula 2 to generate a second proof value.

[0063]

number

[0064] According to one embodiment of the present disclosure, in a zero-knowledge proof that takes a long time to prove, fast index proof may be possible by performing proof using Mathematical Formula 1 and Mathematical Formula 2, which take a relatively short time to prove.

[0065] The prover 200 can perform an RSA accumulator-based index proof to check whether the index value is included in the prime table vector using the temporary vector (S260). In one embodiment, the prover 200 can perform the index proof by applying an RSA accumulator-based membership proof method to the temporary vector and the prime table vector.

[0066] According to one embodiment of the present disclosure, index proof can also be performed using the RSA accumulator-based membership proof method by performing preprocessing for composite numbers and duplicated components that may occur when using index proof, thereby changing the components to prime numbers and removing duplicates.

[0067] FIG. 8 is a diagram illustrating the certification stage according to an exemplary embodiment of the present disclosure.

[0068] Referring to FIG. 8, the proving element 200 can receive an index vector f including a first index value f1 corresponding to the first prime table vector th1, a second index value f2 and a third index value f3 corresponding to the second prime table vector th2, and a fourth index value f4 corresponding to the third prime table vector th3.

[0069] The prover 200 can generate a temporary vector e by removing duplicates of the index vector f. In one embodiment, the prover 200 can generate the temporary vector e by replacing duplicate index values ​​of the index vector f with prime table values ​​that are not used in the index vector f in the prime table vector Th.

[0070] In the example of Figure 8, since the second index value f2 and the third index value f3 of the proof 200 overlap as the second prime table vector th2, a temporary vector e can be generated by replacing the third index value f3 with the fifth prime table vector th5, which is not used for the index vector f.

[0071] According to one embodiment of the present disclosure, for a prime table vector whose components may be duplicated, the prover 200 replaces the duplicated components with other values ​​of the prime table vector, thereby making it possible to utilize an RSA accumulator-based membership proof method that does not allow duplication, and as a result, index proof may be possible.

[0072] FIG. 9 is a diagram illustrating a verification algorithm according to an exemplary embodiment of the present disclosure.

[0073] 9, the verifier 300 receives the proof value (pi, π) from the prover and can verify whether the proof of the prover 200 is valid based on a zero-knowledge verification method using the proof value. In particular, the verifier 300 can use the proof value to verify whether the prime number table vector generated by the setup module 100 was generated correctly, whether the duplication process of the temporary vector generated by the prover 200 was performed correctly, and whether the RSA accumulator index proof performed by the prover 200 was performed correctly.

[0074] FIG. 10 is a block diagram illustrating a computing system according to an exemplary embodiment of the present disclosure.

[0075] 10, computing system 1000 may constitute at least one of components 100, 200, 300, and 400 constituting system 10, and may include a processor 1100, a memory device 1200, a storage device 1300, a power supply 1400, and a display device 1500. Meanwhile, although not shown in FIG. 10, computing system 1000 may further include a port for communicating with a video card, a sound card, a memory card, a USB device, or the like, or for communicating with other electronic devices.

[0076] In this manner, the processor 1100, memory device 1200, storage device 1300, power supply 1400, and display device 1500 included in computing system 1000 can perform the RSA accumulator-based indexing method according to an embodiment of the present invention. Specifically, the processor 1100 can perform the RSA accumulator-based indexing method described in detail in FIGS. 1 to 9 by controlling the memory device 1200, storage device 1300, power supply 1400, and display device 1500.

[0077] The processor 1100 can perform a specific calculation or task. Depending on the embodiment, the processor 1100 may be a microprocessor or a central processing unit (CPU). The processor 1100 can communicate with the memory device 1200, the storage device 1300, and the display device 1500 through a bus 1600 such as an address bus, a control bus, and a data bus. Depending on the embodiment, the processor 1100 can also be connected to an expansion bus such as a Peripheral Component Interconnect (PCI) bus.

[0078] The memory device 1200 can store data necessary for the operation of the computing system 1000. For example, the memory device 1200 can be implemented with DRAM, mobile DRAM, SRAM, PRAM, FRAM, RRAM, and / or MRAM. The storage device 1300 can include a solid state drive, a hard disk drive, a CD-ROM, etc. The storage device 1300 can store programs related to the RSA accumulator-based indexing method described in detail in FIGS. 1 to 9, application program data, system data, operating system data, etc.

[0079] The display device 1500 is an output means for notifying a user and can display various information described herein to the user, etc. The power supply 1400 can supply the operating voltage required for the operation of the computing system 1000.

[0080] As described above, exemplary embodiments have been invented in the drawings and specification. Although specific terms have been used in the description of the embodiments herein, these terms are used solely for the purpose of explaining the technical idea of ​​the present invention and are not intended to limit the meaning or the scope of the present invention as described in the claims. Therefore, a person skilled in the art will understand that various modifications and equivalent embodiments are possible. Therefore, the true technical scope of protection of the present invention should be determined by the technical idea of ​​the appended claims. [Explanation of symbols]

[0081] 100: Setup module 200: Proof 210: Zero-knowledge proof module 220: RSA Accumulator Index Proof Module 300: Verifier S10: Setup stage S20: Proof stage S30: Verification stage S110: Acquire a table vector containing multiple table values S120: Multiple prime random value generation S130: Generate multiple prime number table values ​​corresponding to each of the multiple table values ​​using the prime number random value. S140: Generate a prime number table vector using multiple prime number table values ​​and multiple prime number random values S150: Prime number table vector published S210: Acquire prime number table vector S220: Receiving an index vector including a plurality of index values ​​each corresponding to a prime number table value. S230: Generate temporary vectors by using prime number table vectors to process duplicated values ​​among multiple index values. S240: Zero-knowledge proof for prime table values S250: Zero-Knowledge Proofs for Temporary and Index Vectors S260: RSA Accumulator-Based Index Proof Using Temporary Vectors to Check Whether an Index Value is Contained in a Prime Table Vector 1100: Processor 1200: Memory device 1300: Storage device 1400: Power supply 1500: Display device

Claims

1. 1. A method for RSA accumulator-based index proof performed by at least one processor, comprising: obtaining a table vector containing a plurality of table values; generating a plurality of prime random values; generating a plurality of prime number table values ​​respectively corresponding to the plurality of table values ​​by utilizing the prime number random value; generating a prime number table vector using the plurality of prime number table values ​​and the plurality of prime number random values; publishing the prime table vector; and performing an RSA accumulator-based index proof using the prime number table vector to check whether an index value is included in the table vector.

2. The step of generating the prime number table vector comprises: performing a concatenation operation on the table value and the prime random value; determining whether the value obtained by the concatenation operation is a prime number; determining a prime number table value corresponding to the table value if the value on which the concatenation operation is performed is a prime number; and 2. The index proving method of claim 1, further comprising: generating prime table values ​​corresponding to the plurality of table values ​​as the prime table vector.

3. performing a zero-knowledge proof that the prime table value is generated as a result of concatenating the table value and the prime random value; and The index proving method of claim 2 , further comprising: transmitting the first proof value of the zero-knowledge proof result.

4. receiving an index vector including a plurality of index values ​​each corresponding to at least one prime number table value; and The index proving method of claim 1 , further comprising: generating a temporary vector including a plurality of temporary values ​​by processing duplicate values ​​among the plurality of index values ​​using the prime number table vector.

5. The step of generating the temporary vector comprises: replacing an index value among the plurality of index values ​​that overlaps with another element of the index vector with any one value of the prime number table vector; and 5. The index verification method of claim 4, further comprising: generating a vector generated as a result of the substituting step as the temporary vector.

6. The i-th element of the temporary vector is e ｉ The number of elements of the temporary vector is m, and the i-th element of the index vector is f ｉ performing a zero-knowledge proof for the following formula: [Equation 1] The index proving method of claim 4 , further comprising: transmitting the second proof value of the zero-knowledge proof result.

7. 2. The index proving method of claim 1, wherein the step of performing the RSA accumulator-based index proving is performed outside a zero-knowledge proof circuit.

8. 1. A method for RSA accumulator-based index proof performed by at least one processor, comprising: obtaining a prime table vector comprising a plurality of prime table values; receiving an index vector including a plurality of index values ​​each corresponding to at least one prime number table value; generating a temporary vector including a plurality of temporary values ​​by processing duplicate values ​​among the plurality of index values ​​using the prime number table vector; and performing an RSA accumulator-based index proof using the temporary vector to check whether the plurality of index values ​​are included in the prime table vector.

9. The step of generating the temporary vector comprises: replacing an index value among the plurality of index values ​​that overlaps with another element of the index vector with any one value of the prime number table vector; and 9. The index verification method of claim 8, further comprising: generating the vector generated as a result of the substituting step as the temporary vector.

10. The i-th element of the temporary vector is e ｉ Let m be the number of elements in the temporary vector, and let m be the number of elements in the index vector. ｉ When the th element is fi, performing a zero-knowledge proof for the following formula: [Equation 2] The index proving method of claim 9 , further comprising: transmitting a proof value generated as a result of the zero-knowledge proof.

Images