Zero-knowledge proof polynomial computing apparatus and method, and computer-readable storage medium

Abstract

A zero-knowledge proof polynomial computing apparatus and method, and a computer-readable storage medium. The apparatus comprises a control unit and m parallel processing units, m being greater than 1, wherein: the control unit is configured to acquire a challenge value α and n+1 polynomial coefficients a0 to an, output the challenge value α to each processing unit, and allocate the n+1 polynomial coefficients a0 to an to the m processing units, the x-th polynomial coefficient allocated to the i-th processing unit being a(x-1)m+i-1, x being a natural number greater than or equal to 1 and satisfying that x≤⌈(n+1) / m⌉, ⌈⌉ being a ceiling function symbol, i being a natural number ranging from 1 to m, and n being a natural number greater than 1; and each processing unit is configured to receive the challenge value α and the corresponding polynomial coefficient, and calculate a polynomial value of a corresponding part on the basis of the challenge value α and the corresponding polynomial coefficient.

Description

Zero-knowledge proof polynomial calculation device, method and computer readable storage medium TECHNICAL FIELD

[0001] Embodiments of the present disclosure relate to, but are not limited to, the technical field of zero-knowledge proof (ZKP), and particularly relate to a zero-knowledge proof polynomial calculation device, method and computer readable storage medium. BACKGROUND

[0002] Zero-knowledge proof is a method of proving the validity of a statement without exposing the statement itself, where the "prover" is the party trying to prove the statement, and the "verifier" is responsible for verifying the statement. There are many proof systems in zero-knowledge succinct non-interactive argument of knowledge (ZK-SNARK), and KZG (Kate, Zaverucha, Goldberg) polynomial commitment is a widely used commitment method.

[0003] In the KZG polynomial commitment process, the verifier randomly gives a challenge value, and the prover calculates and generates a proof according to the challenge value. However, in the current calculation process of the prover, if multiple parallel central processing units (CPUs) are used for calculation, the order of the polynomial needs to be obtained, the task amount of a single CPU calculation is determined according to the order of the polynomial and the number of parallel CPUs, and an additional strategy is needed to ensure that the task amount of each CPU calculation is close.

[0004] SUMMARY

[0005] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0006] Embodiments of the present disclosure provide a zero-knowledge proof polynomial calculation device, comprising a control unit, and further comprising m parallel processing units, m being a natural number greater than 1, wherein: the control unit is configured to obtain a challenge value a and n+1 polynomial coefficients a0 to an, and output the challenge value a to each processing unit and distribute the n+1 polynomial coefficients a0 to an to the m processing units. n n The xth polynomial coefficient distributed to the ith processing unit is a(x-1)m+i-1, x is a natural number greater than or equal to 1, and i is a natural number greater than or equal to 1. ​the rounding up symbol, i is a natural number between 1 and m, n is a natural number greater than 1; each of the processing units is configured to receive a challenge value a and respective corresponding polynomial coefficients, and calculate a polynomial value of a corresponding part according to the challenge value a and the respective corresponding polynomial coefficients.

[0007] The embodiment of the present disclosure further provides a zero-knowledge proof polynomial calculation method, comprising the following steps:

[0008] The control unit obtains a challenge value a and n+1 polynomial coefficients a0 to an. n The challenge value a is output to the m processing units, and the n+1 polynomial coefficients a0 to an are distributed to the m processing units. n The xth polynomial coefficient distributed to the ith processing unit is a(x-1)m+i-1, x is a natural number greater than or equal to 1, and i is a natural number between 1 and m. the rounding up symbol, i is a natural number between 1 and m, n is a natural number greater than 1, and m is a natural number greater than 1;

[0009] Each of the processing units receives a challenge value a and respective corresponding polynomial coefficients, and calculates a polynomial value of a corresponding part according to the challenge value a and the respective corresponding polynomial coefficients.

[0010] The embodiment of the present disclosure further provides a zero-knowledge proof polynomial calculation device, comprising a memory and a processor connected to the memory, the memory is used to store instructions, and the processor is configured to execute the steps of the zero-knowledge proof polynomial calculation method according to any one of the embodiments of the present disclosure based on the instructions stored in the memory.

[0011] The embodiment of the present disclosure further provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the zero-knowledge proof polynomial calculation method according to any one of the embodiments of the present disclosure.

[0012] The zero-knowledge proof polynomial calculation device, method and computer readable storage medium provided by the embodiments of the present disclosure can increase the compatibility of the processing units to the polynomial calculation by re-dividing the polynomial values of the corresponding parts calculated by each processing unit (the xth polynomial coefficient allocated by the ith processing unit is a(x-1)m+i-1), and the multiple parallel processing units do not need to care about the order of the polynomial, only need to obtain the challenge value α, and the number m of the processing units and the index value i of each processing unit are transmitted and saved in the memory of each processing unit at the start, and do not need to be transmitted again in the calculation process, and each processing unit calculates the polynomial value of the corresponding part according to the challenge value α and the corresponding polynomial coefficient, thereby increasing the compatibility of the processing units to the polynomial calculation. The control unit only needs to output the polynomial coefficients every m to the processing unit, and if the number n+1 of the polynomial terms cannot be divided by the number m of the processing units, each processing unit can also calculate the number of polynomial terms with a difference of no more than 1, thereby balancing the load of each processing unit.

[0013] Other aspects can become apparent from the following detailed description when taken in conjunction with the drawings. BRIEF DESCRIPTION OF DRAWINGS

[0014] The accompanying drawings are included to provide a further understanding of the present disclosure and constitute a part of the specification, which together with the present disclosure, serve to explain the technical solutions of the present disclosure, and do not constitute a limitation on the technical solutions of the present disclosure.

[0015] FIG. 1 is a structural schematic diagram of a zero-knowledge proof polynomial calculation device according to an exemplary embodiment of the present disclosure;

[0016] FIG. 2 is a structural schematic diagram of another zero-knowledge proof polynomial calculation device according to an exemplary embodiment of the present disclosure;

[0017] FIG. 3 is a structural schematic diagram of a second loop unit in FIG. 2;

[0018] FIG. 4 is a structural schematic diagram of a zero-knowledge proof hardware accelerator according to an exemplary embodiment of the present disclosure;

[0019] FIG. 5 is a flow schematic diagram of a zero-knowledge proof polynomial calculation method according to an exemplary embodiment of the present disclosure;

[0020] FIG. 6 is a structural schematic diagram of another zero-knowledge proof polynomial calculation device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0021] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. The embodiments in the present disclosure and the features in the embodiments can be combined with each other as long as there is no conflict.

[0022] Unless otherwise defined, technical and scientific terms used in the present disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The terminology used in the present disclosure, e.g. "first", "second", and the like, is used for the purpose of clarity only and does not necessarily have to imply any order or sequence or importance. The use of words like "comprise", "comprises", "comprising", "contain", "contains", "containing", "include", "includes", "including", and the like, is meant to encompass the items listed thereafter, and equivalents thereof, as well as additional items.

[0023] In the KZG polynomial commitment process, the prover claims to know a polynomial, but does not disclose the polynomial to the verifier, and needs to let the verifier believe that the prover knows this polynomial f(x) = a0+ a1x+ a2x 2 +…+a n x n , the prover needs to make a commitment to f(x): where g is a point on an elliptic curve, is a public set of the zero-knowledge proof system, and the prover and the verifier know in advance.

[0024] In the KZG system, the commitment is actually a calculation of an elliptic curve: com f = a0+ a1G1+ a2G2+…+a n G n . When the verifier challenges a random value x = a, the prover calculates f(a) = a0+ a1a+ a2a 2 +…+a n a n . At the same time, the prover makes a polynomial division to get the quotient polynomial h(x), the prover makes a commitment to h(x) to get com h = g h(β) .

[0025] The prover submits: the commitment com f = g f(β) of f(x), the commitment com h = g h(β) of h(x), and the calculated value f(a) of f(x) at x = a to the verifier. The verifier verifies whether the equation g f(β)-f(α) = g (β-α)h(β) is established at x = b, that is, whether the equation gf(b) - f(a) + a h(b) = g βh(β) is established. Since the verifier does not know what b is, an elliptic curve pair, i.e. a multiplicative homomorphism e(g a , g b ) = e(g, g) abThen, the verifier only needs to verify whether the equation e(gf(β)-f(α)+αh(β),g 1 )=e(g β ,g h(β) ) is established or not.

[0026] In the above KZG polynomial commitment process, the prover needs to calculate: f(α)=a0+a1α+a2α 2 +…+a n α n When using multi-CPU parallel computing, the common practice is to calculate by segments by each CPU. For example, assuming there are m CPUs, then each CPU calculates the sum of k=(n+1) / m items, where n is the order of the polynomial. Specifically,

[0027] CPU1 calculates the first segment polynomial: f1(α)=a0+a1α+a2α 2 +…+a k-1 α k-1 ;

[0028] CPU2 calculates the second segment polynomial: f2(α)=a k α k +a k+1 α k+1 +a k+2 α k+2 +…+a 2k-1 α 2k-1 =α k (a k +a k+1 α 1 +a k+2 α 2 +…+a 2k-1 α k-1 );

[0029] …

[0030] CPUm calculates the mth segment polynomial: f m (α)=a (m-1)k α (m-1)k +a (m-1)k+1 α (m-1)k+1 +a (m-1)k+2 α (m-1)k+2 +…+a mk-1 α mk-1 =α (m-1)k (a (m-1)k +a (m-1)k+1 α 1 +a (m-1)k+2 α 2 +…+a mk-1 α k-1 )。

[0031] The calculation results of the m CPUs are then accumulated to obtain a final calculation result f(a).

[0032] Since the CPUs 2, 3, …, m need to calculate the respective multiplication factors a k , a 2k , …, a (m-1)k , k is related to the order n of the polynomial, and thus the value of the multiplication factor a k is variable when different polynomials are processed. When calculating, the calculation unit in each CPU needs to obtain the order n of the polynomial and the challenge value a, as well as the index value of the CPU and the number m of CPUs, to further calculate the value of the multiplication factor a k . In addition, k = (n + 1) / m may not be divisible, and additional strategies are needed to ensure that the difference in the number of polynomial terms processed by each CPU does not exceed 1.

[0033] As shown in FIG. 1, the disclosure provides a zero-knowledge proof polynomial calculation device, comprising a control unit, and further comprising m parallel processing units, m being a natural number greater than 1, wherein:

[0034] The control unit is configured to obtain a challenge value a and n + 1 polynomial coefficients a0 to a n , and output the challenge value a to each processing unit and distribute the n + 1 polynomial coefficients a0 to a n to the m processing units. The xth polynomial coefficient distributed to the ith processing unit is a(x-1)m+i-1, x is a natural number greater than or equal to 1, and is a rounding up symbol, i is a natural number between 1 and m, and n is a natural number greater than 1.

[0035] Each processing unit is configured to receive the challenge value a and the respective corresponding polynomial coefficient, and calculate the corresponding partial polynomial value according to the challenge value a and the respective corresponding polynomial coefficient.

[0036] In the existing zero-knowledge proof polynomial calculation process, the multiple parallel processing units of the prover need to obtain the order n of the corresponding polynomial to calculate the multiplication factor a k; the zero-knowledge proof polynomial calculation device of the embodiment of the disclosure, by re-dividing the polynomial value of the corresponding part calculated by each processing unit (the xth polynomial coefficient allocated by the ith processing unit is a(x-1)m+i-1), the plurality of parallel processing units do not need to care about the order of the polynomial, only need to obtain the challenge value a, and the number m of processing units and the index value i of each processing unit are transmitted and saved in the memory of each processing unit at the start, and do not need to be transmitted again in the calculation process, and each processing unit calculates the polynomial value of the corresponding part according to the challenge value a and the corresponding polynomial coefficient, which increases the compatibility of the processing unit for the polynomial calculation. The control unit only needs to output the polynomial coefficient every m to the processing unit, and if the number n+1 of terms of the polynomial cannot be divided by the number m of processing units, each processing unit can also calculate the number of polynomial terms with a difference of not more than 1, so as to balance the load of each processing unit.

[0037] In some example embodiments, the processing unit can be a central processing unit (CPU), but the embodiment of the disclosure is not limited thereto.

[0038] In the embodiment of the disclosure, each processing unit adopts a new segmentation method, taking the processing unit as a CPU for example, for a plurality of parallel CPUs, each CPU does not need to obtain the order n of the polynomial, only needs to obtain the challenge value a, for example, there are m parallel CPUs, and the polynomial part calculated by each CPU is as follows:

[0039] CPU1: calculate f1(a) = a0+a m a m a 2m a 2m a

[0040] CPU2: calculate f2(a) = a1a 1 a m+1 a m+1 a 2m+1 a 2m+1 +… = a(a1+a m+1 a m a 2m+1 a 2m a

[0041] …

[0042] CPUm: calculate f m (a) = a m-1 a m-1 a 2m-1 a 2m-1 a 3m-1 a 3m-1 +… = am-1 (a m-1 +a 2m-1 α m +a 3m-1 α 2m +…)

[0043] Let t = α m , then:

[0044] CPU1: compute f1(α) = a0+a m t+a 2m t 2 +…;

[0045] CPU2: compute f2(α) = α(a1+a m+1 α m +a 2m+1 α 2m +…) = α(a1+a m+1 t+a 2m+1 t 2 +…)

[0046] …

[0047] CPUm: compute f m (α) = α m-1 (a m-1 +a 2m-1 t+a 3m-1 t 2 +…)

[0048] It can be seen that CPU2, CPU3, …, CPUm need to compute α, α 2 , …, α m-1 , respectively, and all need to compute α m , i.e. each CPU needs to compute the value of t = α m and α i-1 , and the computation of these parameters is independent of the order of the polynomial, and only related to the number of CPUs, which facilitates independent computation of the CPUs.

[0049] In some example embodiments, the control unit allocates the n+1 polynomial coefficients a0 to a n to the m processing units through a direct memory access (DMA) transmission channel.

[0050] In some example embodiments, at least one processing unit is further configured to add the polynomial values computed by each processing unit to generate a final polynomial value.

[0051] As shown in FIG. 1, an adder is further arranged at the output end of the third multiplier of the first processing unit in the zero-knowledge proof polynomial calculation device, through which the polynomial values calculated by each processing unit are added to generate a final polynomial value. However, the embodiments of the present disclosure do not limit this, and the adder can be arranged in any processing unit, that is, any processing unit can add the polynomial values calculated by each processing unit to generate the final polynomial value.

[0052] In some example embodiments, as shown in FIG. 2, each processing unit includes a first calculation unit, a second loop unit and a third multiplier;

[0053] The first calculation unit is configured to receive a challenge value α, calculate a first intermediate value and a second intermediate value according to the challenge value α, the first intermediate value of each processing unit being α m , and the second intermediate value of the i th processing unit being α i-1 ; the first intermediate value is input to the second loop unit, and the second intermediate value is input to the third multiplier;

[0054] The second loop unit is configured to receive a corresponding polynomial coefficient and the first intermediate value, and perform a multiply-accumulate operation using the corresponding polynomial coefficient and the first intermediate value, and output the multiply-accumulate operation result to the third multiplier;

[0055] The third multiplier is configured to receive the second intermediate value and the multiply-accumulate operation result, and calculate the product of the multiply-accumulate operation result and the second intermediate value, and take the calculated product as the polynomial value of the corresponding part.

[0056] In some example embodiments, as shown in FIG. 3, the multiply-accumulate operation using the corresponding polynomial coefficient and the first intermediate value includes:

[0057] The corresponding polynomial coefficient is assigned to c0 to c q in the order of ascending power;

[0058] The multiply-accumulate operation result is initialized as c q ;

[0059] From j=q-1 to 0 with a step of 1, the following operations are sequentially and circularly performed: the product of the multiply-accumulate operation result and the first intermediate value α m is re-assigned to the multiply-accumulate operation result, and the value of c j is added to the multiply-accumulate operation result.

[0060] Looking at the polynomial product term after the single CPU extracts the coefficient, it is equivalent to each CPU calculating the polynomial: c0+c1t+c2t 2 +…+c q t q, wherein the coefficients c0, c1, c2, … are different for different CPUs. For example, for CPU1, the coefficients c0, c1, c2, … are a0, a1, a2, … in turn; for CPU2, the coefficients c0, c1, c2, … are a1, a2, a3, … in turn; and for other CPUs, the same applies. m , a 2m , …; for CPU2, the coefficients c0, c1, c2, … are a1, a2, a3, … in turn; and for other CPUs, the same applies. m+1 , a 2m+1 , …, and so on for other CPUs.

[0061] For the polynomial: c0+c1t+c2t 2 +…+c q t q , the general calculation method is as follows:

[0062] Initialize sum = c0;

[0063] Loop j = 1 … q, step 1;

[0064] {tmp = c j *t;

[0065] sum = sum + tmp;

[0066] t = t * t;}

[0067] Using the general calculation method, a total of 2q multiplications and q additions are required to obtain the calculation result of the polynomial: c0+c1t+c2t 2 +…+c q t q .

[0068] In the zero-knowledge proof polynomial calculation device of the embodiments of the present disclosure, when the second loop unit performs the multiplication and accumulation operation with the corresponding polynomial coefficients and the first intermediate value, the calculation starts from the high-order coefficient, and a total of q multiplications and q additions are required, which is q less than the general calculation method, i.e., the calculation amount during the internal calculation of each processing unit is reduced. The specific calculation method is as follows:

[0069] Initialize acc = c q ;

[0070] Loop ji = q-1 … 0, step 1;

[0071] {acc = acc * t;

[0072] acc = acc + c j ;}

[0073] In the ZKG system, the prover will evaluate the value f(α) and the commitment value com f , com hThe verification party judges whether the evaluation value f(α) and the commitment value com generated by the same polynomial through the multiplication homomorphism method of the elliptic curve pair f , com h .

[0074] As shown in FIG. 2, in the embodiment of the present disclosure, each CPU has only two corresponding input data (challenge value α, corresponding polynomial coefficient data), and the CPU number m and the CPU index value i are transmitted and saved in the CPU memory at the start, and do not need to be transmitted again in the calculation process. The CPU calculates the values of α m and α i-1 . CPU1 performs f1(α) operation, CPU2 performs f2(α) operation, …, and CPUm performs f m (α) operation. After CPU1, CPU2, …, CPUm complete the respective part calculations, an addition operation is performed on the calculation results of CPU1, CPU2, …, CPUm (the addition operation can be performed by one of the CPUs or can be distributed in multiple CPUs, for example, when distributed in multiple CPUs, first, two CPUs form a group, and the calculation results of the two CPUs in each group are added, for example, the calculation result of CPU1 and the calculation result of CPU2 are added, the calculation result of CPU3 and the calculation result of CPU4 are added, …, and so on, and then, the results of adding each two groups are added, for example, the result of adding the first group CPU1 and CPU2 and the result of adding the second group CPU3 and CPU4 are added again, and so on; …, until the cumulative sum of the calculation results of CPU1 to CPUm is obtained).

[0075] Assuming that the CPU index is i, the CPU number is m, the first calculation unit calculates the value of the multiplication factor α i-1 corresponding to the CPU and the input t=α m of the second loop unit, the second loop unit calculates c0+c1t+c2t 2 +…+c q t q , and obtains the multiplication accumulation operation result; the third multiplier calculates the product of α i-1 and the multiplication accumulation operation result, and obtains the corresponding part polynomial value f i (α). Then, the calculated corresponding part polynomial values f2(α) to f m (α) of CPU2 to CPUm are sent to the adder in CPU1, and added with the calculated corresponding part polynomial value f1(α) of CPU1, to obtain the final output value: the value of f(α).

[0076] The commitment value can be calculated by the following method:

[0077] CPU1: Calculate comf1 = a0+ a m G m + a 2m G 2m +…;

[0078] CPU2: compute com f2 = a1+ a m+1 G m+1 + a 2m+1 G 2m +…

[0079] …

[0080] CPUm: compute com fm = a m-1 + a 2m-1 G 2m-1 + a 3m-1 G 3m-1 +….

[0081] Each CPU can realize the commitment value calculation through the elliptic addition and the elliptic double multiplication module, each CPU can reuse the polynomial coefficient allocated when calculating f(a) to calculate the commitment value, without retransmitting the polynomial coefficient, that is, the disclosure does not increase the data transmission amount required for commitment value calculation.

[0082] As shown in FIG. 4, the embodiment of the disclosure further provides a zero-knowledge proof hardware accelerator, which comprises the zero-knowledge proof polynomial calculation device as described in any embodiment of the disclosure, and further comprises an interface control module. Wherein, the interface control module is configured to receive input polynomial coefficients a0 to a n and challenge value a, and output the polynomial coefficients a0 to a n and challenge value a to the zero-knowledge proof polynomial calculation device. The zero-knowledge proof polynomial calculation device completes the zero-knowledge proof polynomial calculation process, and the specific implementation method can refer to the foregoing description, which will not be described here. The zero-knowledge proof hardware accelerator provided by the disclosure redivides the corresponding part of the polynomial value calculated by each processing unit, and the multiple parallel processing units do not need to care about the order of the polynomial, only need to obtain the challenge value a, and the number m of the processing units and the index value i of each processing unit are transmitted and saved in the memory of each processing unit at the start, and do not need to be transmitted again in the calculation process, each processing unit calculates the corresponding part of the polynomial value according to the challenge value a and the corresponding polynomial coefficient, which increases the compatibility of the processing unit for the polynomial calculation. The control unit only needs to output the polynomial coefficient every m to the processing unit, and if the number of terms n+1 of the polynomial cannot be evenly divided by the number m of the processing units, each processing unit can also calculate the number of polynomial terms with a difference of not more than 1, so as to balance the load of each processing unit.

[0083] As shown in FIG. 5, the embodiment of the present disclosure further provides a zero-knowledge proof polynomial calculation method, comprising:

[0084] Step 501, the control unit acquires a challenge value a and n+1 polynomial coefficients a0 to an. n The challenge value a is output to each processing unit, and the n+1 polynomial coefficients a0 to an are distributed to m processing units. n The xth polynomial coefficient distributed to the ith processing unit is a(x-1)m+i-1, x is a natural number greater than or equal to 1, and is a rounding up symbol, i is a natural number between 1 and m, n is a natural number greater than 1, and m is a natural number greater than 1;

[0085] Step 502, each processing unit receives the challenge value a and the corresponding polynomial coefficient, and calculates the corresponding partial polynomial value according to the challenge value a and the corresponding polynomial coefficient.

[0086] The zero-knowledge proof polynomial calculation method of the embodiment of the present disclosure re-divides the corresponding partial polynomial value calculated by each processing unit (the xth polynomial coefficient distributed to the ith processing unit is a(x-1)m+i-1), so that the multiple parallel processing units do not need to care about the order of the polynomial, but only need to acquire the challenge value a, and the number m of processing units and the index value i of each processing unit are transmitted and saved in the memory of each processing unit at the start, and do not need to be transmitted again during the calculation process. Each processing unit calculates the corresponding partial polynomial value according to the challenge value a and the corresponding polynomial coefficient, which increases the compatibility of the processing unit for polynomial calculation. The control unit only needs to output the polynomial coefficients every m to the processing unit, and if the number n+1 of polynomial terms cannot be evenly divided by the number m of processing units, each processing unit can also calculate the number of polynomial terms with a difference of not more than 1, so as to balance the load of each processing unit.

[0087] In some example embodiments, the method further comprises:

[0088] The at least one processing unit adds the polynomial values calculated by each processing unit to generate a final polynomial value.

[0089] In the embodiments of the present disclosure, the addition operation of adding the polynomial values calculated by each processing unit can be performed by one of the processing units, or can be performed by multiple processing units. For example, when the addition operation is performed by multiple processing units, two processing units can be grouped into one group, and the calculation results of the two processing units in each group are added, for example, the calculation result of the processing unit 1 and the calculation result of the processing unit 2 are added, the calculation result of the processing unit 3 and the calculation result of the processing unit 4 are added, and so on. Then, the results of the addition of each two groups are added, for example, the result of the addition of the first group of the processing unit 1 and the processing unit 2 and the result of the addition of the second group of the processing unit 3 and the processing unit 4 are added, and so on. Until the cumulative sum of the calculation results of the processing unit 1 to the processing unit m is obtained.

[0090] In some example embodiments, each processing unit calculates the polynomial value of the corresponding part according to the challenge value α and the respective corresponding polynomial coefficient, including:

[0091] The first intermediate value and the second intermediate value are calculated according to the challenge value α, the first intermediate value of each processing unit is α m , and the second intermediate value of the i th processing unit is α i-1 .

[0092] The multiplication and accumulation operation is performed in a loop using the corresponding polynomial coefficient and the first intermediate value, and the multiplication and accumulation operation result is obtained.

[0093] The product of the multiplication and accumulation operation result and the second intermediate value is calculated, and the calculated product is taken as the polynomial value of the corresponding part.

[0094] In some example embodiments, the multiplication and accumulation operation is performed in a loop using the corresponding polynomial coefficient and the first intermediate value, including:

[0095] The corresponding polynomial coefficient is assigned to c0 to c q in the order of ascending power.

[0096] The multiplication and accumulation operation result is initialized as c q .

[0097] From j = q-1 to 0 with a step of 1, the following operations are performed in a loop: the product of the multiplication and accumulation operation result and the first intermediate value α m is re-assigned to the multiplication and accumulation operation result, and the value of c j is added to the multiplication and accumulation operation result.

[0098] The zero-knowledge proof polynomial calculation method of the embodiments of the present disclosure, when performing multiplication and accumulation operation on the corresponding polynomial coefficients and the first intermediate value, starts from the high-order coefficient, and a total of q multiplications and q additions are required, which is q less than the usual calculation method, that is, the calculation amount of the internal calculation of each processing unit is reduced.

[0099] The embodiments of the present disclosure also provide a zero-knowledge proof polynomial calculation device, comprising a memory and a processor connected to the memory, the memory is used to store instructions, and the processor is configured to execute the steps of the zero-knowledge proof polynomial calculation method according to any one of the embodiments of the present disclosure based on the instructions stored in the memory.

[0100] As shown in FIG. 6, in one example, the zero-knowledge proof polynomial calculation device can comprise a processor 610, a memory 620, a bus system 630 and a transceiver 640, wherein the processor 610, the memory 620 and the transceiver 640 are connected through the bus system 630, the memory 620 is used to store instructions, the processor 610 is used to execute the instructions stored in the memory 620 to control the transceiver 640 to transceive signals, and the processor 610 comprises m parallel processing units. Specifically, the transceiver 640 can obtain the challenge value α and the n+1 polynomial coefficients a0 to an under the control of the processor 610, and the transceiver 640 can output the challenge value α to each processing unit and distribute the n+1 polynomial coefficients a0 to an to the m processing units. n The challenge value α is output to each processing unit, and the n+1 polynomial coefficients a0 to an are distributed to the m processing units. n The xth polynomial coefficient distributed to the ith processing unit is a(x-1)m+i-1, x is a natural number greater than or equal to 1, and i is a natural number between 1 and m. The symbol is rounded up, i is a natural number between 1 and m, and n is a natural number greater than 1; each processing unit receives the challenge value α and the corresponding polynomial coefficient, and calculates the corresponding part of the polynomial value according to the challenge value α and the corresponding polynomial coefficient.

[0101] It should be understood that the processor 610 can be a central processing unit (CPU), and the processor 610 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), ready programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0102] The memory 620 can include read-only memory and random access memory, and provide instructions and data to the processor 610. A portion of the memory 620 can also include non-volatile random access memory. For example, the memory 620 can also store device type information.

[0103] The bus system 630 can include not only a data bus, but also a power bus, a control bus, and a status signal bus, etc. However, for the sake of clarity, all the buses are marked as the bus system 630 in FIG. 6.

[0104] In the implementation process, the processing performed by the processing device can be completed by the integrated logic circuit of the hardware in the processor 610 or the instructions in the form of software. That is, the method steps of the embodiments of the present disclosure can be embodied as being completed by a hardware processor or being completed by a combination of hardware and software modules in the processor. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, or the like storage medium. The storage medium is located in the memory 620, and the processor 610 reads the information in the memory 620 and completes the steps of the above method in combination with the hardware. To avoid repetition, it will not be described in detail here.

[0105] The embodiments of the present disclosure also provide a computer readable storage medium, which stores a computer program. The program is executed by a processor to implement the zero-knowledge proof polynomial calculation method according to any of the embodiments of the present disclosure. The method of driving the zero-knowledge proof polynomial calculation by executing executable instructions is basically the same as the zero-knowledge proof polynomial calculation method provided by the above embodiments of the present disclosure, and will not be described here.

[0106] In some possible implementations, various aspects of the zero-knowledge proof polynomial calculation method provided by the present disclosure can also be implemented in the form of a program product, which includes program codes for causing a computer device to perform the steps of the zero-knowledge proof polynomial calculation method according to various exemplary embodiments of the present disclosure described above in the specification when the program product is run on the computer device, for example, the computer device can execute the zero-knowledge proof polynomial calculation method recorded in the embodiments of the present disclosure.

[0107] The program product can employ any combination of one or more computer-readable media. The computer-readable media can be a computer-readable storage medium or a computer-readable signal medium. Computer-readable storage media can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0108] Those of ordinary skill in the art will appreciate that all or certain steps in the methods disclosed above, functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units referred to in the above description does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be performed by several physical components in cooperation. Certain components or all components can be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on computer-readable media, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile discs (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer. Further, it should be noted that computer storage media can be embodied in a computer program product. As is well known to those of ordinary skill in the art, the term computer program product includes any computer readable medium, which can be tangibly embodied in a computer readable storage medium or communication medium.

[0109] It should be noted that the above-described embodiments or implementations are merely exemplary, and not limiting. Therefore, the present disclosure is not limited to what is specifically shown and described herein. Various modifications, substitutions, and omissions, which do not depart from the spirit of the present disclosure, can be made by those skilled in the art.

Claims

1. A zero-knowledge proof polynomial computing device, comprising a control unit and m parallel processing units, where m is a natural number greater than 1, wherein: The control unit is configured to acquire the challenge value α and n+1 polynomial coefficients a0 to a n The challenge value α is output to each processing unit, and the n+1 polynomial coefficients a0 to a1 are output. n The polynomial is assigned to m processing units. The coefficient of the x-th polynomial assigned to the i-th processing unit is a(x-1)m+i-1, where x is a natural number greater than or equal to 1. The floor function is used for rounding up, where i is a natural number between 1 and m, and n is a natural number greater than 1. Each of the processing units is configured to receive a challenge value α and its corresponding polynomial coefficients, and to calculate the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients.

2. The apparatus according to claim 1, wherein, At least one of the processing units is further configured to add the polynomial values ​​calculated by each of the processing units to generate a final polynomial value.

3. The apparatus according to claim 1, wherein, Each of the processing units includes: a first calculation unit, a second loop unit, and a third multiplier; The first calculation unit is configured to receive a challenge value α, and calculate a first intermediate value and a second intermediate value based on the challenge value α, wherein the first intermediate value of each processing unit is α. m The second intermediate value of the i-th processing unit is α. i-1 The first intermediate value is input into the second loop unit, and the second intermediate value is input into the third multiplier. The second loop unit is configured to receive the corresponding polynomial coefficients and the first intermediate value, and to perform a cyclic multiplication and accumulation operation on the corresponding polynomial coefficients and the first intermediate value, and output the result of the multiplication and accumulation operation to the third multiplier. The third multiplier is configured to receive the second intermediate value and the result of the multiplication-accumulation operation, calculate the product of the result of the multiplication-accumulation operation and the second intermediate value, and use the calculated product as the polynomial value of the corresponding part.

4. The apparatus according to claim 3, wherein, The step of using the corresponding polynomial coefficients and the first intermediate value to perform a cyclic multiplication and accumulation operation includes: Assign the corresponding polynomial coefficients to c0 through c in ascending power order. q ; The result of the multiplication-accumulation operation is initialized to c. q ; From j = q-1 to 0 with a step size of 1, the following operation is executed sequentially: the result of the multiplication and accumulation operation is compared with the first intermediate value α. m The product is reassigned to the result of the multiplication-accumulation operation, and c is... j The value is added to the result of the multiplication-accumulation operation. Fruit.

5. The apparatus according to claim 1, wherein, The control unit transfers the n+1 polynomial coefficients a0 to a1 via a direct memory access (DMA) channel. n It is allocated to m processing units.

6. A zero-knowledge proof polynomial computation method, comprising: The control unit obtains the challenge value α and n+1 polynomial coefficients a0 to a n The challenge value α is output to each processing unit, and the n+1 polynomial coefficients a0 to a1 are output. n The polynomial is assigned to m processing units. The coefficient of the x-th polynomial assigned to the i-th processing unit is a(x-1)m+i-1, where x is a natural number greater than or equal to 1. The floor function is the floor function, where i is a natural number between 1 and m, n is a natural number greater than 1, and m is a natural number greater than 1. Each processing unit receives a challenge value α and its corresponding polynomial coefficients, and calculates the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients.

7. The method according to claim 6, wherein, Each processing unit calculates the polynomial value of its corresponding part based on the challenge value α and its corresponding polynomial coefficients, including: The first intermediate value and the second intermediate value are calculated based on the challenge value α. The first intermediate value for each processing unit is α. m The second intermediate value of the i-th processing unit is α. i-1 ; The corresponding polynomial coefficients are used to perform a cyclic multiplication and accumulation operation with the first intermediate value to obtain the result of the multiplication and accumulation operation. Calculate the product of the result of the multiplication and accumulation operation and the second intermediate value, and use the calculated product as the polynomial value of the corresponding part.

8. The method according to claim 7, wherein, The step of using the corresponding polynomial coefficients and the first intermediate value to perform a cyclic multiplication and accumulation operation includes: Assign the corresponding polynomial coefficients to c0 through c in ascending power order. q ; The result of the multiplication-accumulation operation is initialized to c. q ; From j = q-1 to 0 with a step size of 1, the following operation is executed sequentially: the result of the multiplication and accumulation operation is compared with the first intermediate value α. m The product is reassigned to the result of the multiplication-accumulation operation, and c is... j The value is added to the result of the multiplication-accumulation operation.

9. A zero-knowledge proof polynomial computation apparatus, comprising a memory; and a processor connected to the memory, the memory being configured to store instructions, the processor being configured to perform the steps of the zero-knowledge proof polynomial computation method as claimed in any one of claims 6 to 8 based on the instructions stored in the memory.

10. A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the zero-knowledge proof polynomial computation method as described in any one of claims 6 to 8.

Images