Zero-knowledge proof polynomial computing apparatus and method, and computer-readable storage medium

Abstract

A zero-knowledge proof polynomial computing apparatus and method, and a computer-readable storage medium. The apparatus comprises a control unit and m parallel processing units, m being greater than 1, wherein: the control unit is configured to acquire a challenge value α and n+1 polynomial coefficients a0 to an, output the challenge value α to each processing unit, and allocate the n+1 polynomial coefficients a0 to an to the m processing units, the x-th polynomial coefficient allocated to the i-th processing unit being a(x-1)m+i-1, x being a natural number greater than or equal to 1 and satisfying that x≤⌈(n+1) / m⌉, ⌈⌉ being a ceiling function symbol, i being a natural number ranging from 1 to m, and n being a natural number greater than 1; and each processing unit is configured to receive the challenge value α and the corresponding polynomial coefficient, and calculate a polynomial value of a corresponding part on the basis of the challenge value α and the corresponding polynomial coefficient.

Description

Zero-knowledge proof polynomial computing apparatus, method, and computer-readable storage medium Technical Field

[0001] This disclosure relates to, but is not limited to, the field of zero-knowledge proof (ZKP) technology, and in particular to a zero-knowledge proof polynomial computing apparatus, method, and computer-readable storage medium. Background Technology

[0002] Zero-knowledge proofs are a method for proving the validity of a statement without exposing the statement itself. In this method, the "prover" attempts to prove the statement, while the "verifier" verifies it. There are many proof systems within Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (ZK-SNARK), with KZG (Kate, Zaverucha, Goldberg) multinomial commitments being a widely adopted approach.

[0003] In the KZG polynomial commitment process, the verifier randomly assigns a challenge value, and the prover calculates and generates a proof based on that challenge value. However, in the current prover's calculation process, if multiple parallel Central Processing Units (CPUs) are used for computation, the degree of the polynomial needs to be obtained. The workload of each CPU is then determined based on the degree of the polynomial and the number of parallel CPUs, and additional strategies are needed to ensure that the workload of each CPU is approximately the same.

[0004] Summary of the Invention

[0005] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0006] This disclosure provides a zero-knowledge proof polynomial computation apparatus, including a control unit and m parallel processing units, where m is a natural number greater than 1. The control unit is configured to acquire a challenge value α and n+1 polynomial coefficients a0 to a10. n The challenge value α is output to each processing unit, and the n+1 polynomial coefficients a0 to a... n The polynomial is assigned to m processing units. The coefficient of the x-th polynomial assigned to the i-th processing unit is a(x-1)m+i-1, where x is a natural number greater than or equal to 1. The rounding up sign is used, where i is a natural number between 1 and m, and n is a natural number greater than 1; each of the processing units is configured to receive a challenge value α and its corresponding polynomial coefficients, and to calculate the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients.

[0007] This disclosure also provides a zero-knowledge proof polynomial computation method, including:

[0008] The control unit obtains the challenge value α and n+1 polynomial coefficients a0 to a n The challenge value α is output to m processing units, and the n+1 polynomial coefficients a0 to a... n The polynomial is assigned to m processing units. The coefficient of the x-th polynomial assigned to the i-th processing unit is a(x-1)m+i-1, where x is a natural number greater than or equal to 1. The floor function is the floor function, where i is a natural number between 1 and m, n is a natural number greater than 1, and m is a natural number greater than 1.

[0009] Each processing unit receives a challenge value α and its corresponding polynomial coefficients, and calculates the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients.

[0010] This disclosure also provides a zero-knowledge proof polynomial computation apparatus, including a memory; and a processor connected to the memory, the memory being used to store instructions, the processor being configured to execute the steps of the zero-knowledge proof polynomial computation method according to any embodiment of this disclosure based on the instructions stored in the memory.

[0011] This disclosure also provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the zero-knowledge proof polynomial computation method as described in any embodiment of this disclosure.

[0012] The zero-knowledge proof polynomial computation apparatus, method, and computer-readable storage medium provided in this disclosure re-divide the polynomial values ​​of the corresponding part calculated by each processing unit (the x-th polynomial coefficient allocated to the i-th processing unit is a(x-1)m+i-1). Multiple parallel processing units do not need to concern themselves with the order of the polynomial; they only need to obtain the challenge value α. The number of processing units m and the index value i of each processing unit are transmitted and stored in the memory of each processing unit at startup and do not need to be transmitted again during computation. Each processing unit calculates the corresponding part of the polynomial value based on the challenge value α and its corresponding polynomial coefficients, increasing the compatibility of the processing units with polynomial computation. The control unit only needs to output the polynomial coefficients every m to the processing unit. If the number of terms n+1 of the polynomial is not divisible by the number of processing units m, it is easy to ensure that the number of polynomial terms calculated by each processing unit does not differ by more than 1, thereby achieving load balancing for each processing unit.

[0013] After reading and understanding the accompanying diagrams and detailed descriptions, the other aspects can be understood. Attached Figure Description

[0014] The accompanying drawings are used to provide an understanding of the technical solutions of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the technical solutions of this disclosure and do not constitute a limitation on the technical solutions of this disclosure.

[0015] Figure 1 is a schematic diagram of the structure of a zero-knowledge proof polynomial computing device according to an exemplary embodiment of the present disclosure;

[0016] Figure 2 is a schematic diagram of the structure of another zero-knowledge proof polynomial computing device according to an exemplary embodiment of the present disclosure;

[0017] Figure 3 is a schematic diagram of the structure of the second loop unit in Figure 2;

[0018] Figure 4 is a schematic diagram of the structure of a zero-knowledge proof hardware accelerator according to an exemplary embodiment of the present disclosure;

[0019] Figure 5 is a flowchart illustrating an exemplary embodiment of the present disclosure of a zero-knowledge proof polynomial computation method;

[0020] Figure 6 is a schematic diagram of the structure of another zero-knowledge proof polynomial computing device according to an exemplary embodiment of the present disclosure. Detailed Implementation

[0021] The embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. Unless otherwise specified, the embodiments and features described herein can be combined arbitrarily.

[0022] Unless otherwise defined, the technical or scientific terms used in the embodiments of this disclosure shall have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in the embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" indicate that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, but do not exclude other elements or objects.

[0023] In the KZG polynomial commitment process, the prover claims to know a polynomial but does not reveal it to the verifier. The verifier needs to be convinced that the prover knows this polynomial f(x) = a0 + a1x + a2x. 2 +…+a n x n The prover needs to make a commitment about f(x): Where g is a point on the elliptic curve. It is a public set of zero-knowledge proof systems, which is known in advance by both the prover and the verifier.

[0024] In the KZG system, a commitment is essentially a calculation of an elliptic curve: com f = a0 + a1G1 + a2G2 + ... + a n G n When the verifier challenges a random value x = α, the prover calculates f(α) = a0 + a1α + a2α. 2 +…+a n α n The prover then performs a polynomial division to obtain the quotient polynomial h(x). The prover makes a commitment to h(x) and obtains com h =g h(β) .

[0025] Proofreader submits: commitment of f(x).com f =g f(β) The promise of h(x) com h =g h(β) The calculated value of f(x) at x = α is given to the verifier. The verifier verifies that when x = β, equation g... f(β)-f(α) =g (β-α)h(β) Whether the equation gf(β)-f(α)+αh(β)=g holds true, that is, to verify the equation gf(β)-f(α)+αh(β)=g βh(β) Whether it holds true. Since the verifier does not know the specific value of β, an elliptic curve pair is introduced, namely the multiplicative homomorphism e(g). a ,g b )=e(g,g) abTherefore, the verifier only needs to verify: e(gf(β)-f(α)+αh(β),g 1 )=e(g β ,g h(β) It is sufficient to check whether the equation is true.

[0026] In the above KZG polynomial commitment process, the prover needs to calculate: f(α) = a0 + a1α + a2α 2 +…+a n α n When using multi-CPU parallel computing, the common practice is for each CPU to perform the computation in segments. For example, assuming there are m CPUs, each CPU would calculate the sum of k = (n+1) / m terms, where n is the order of the polynomial. Specifically,

[0027] CPU1 calculates the first polynomial: f1(α) = a0 + a1α + a2α 2 +…+a k-1 α k-1 ;

[0028] CPU2 calculates the second polynomial: f2(α)=a k α k +a k+1 α k+1 +a k+2 α k+2 +…+a 2k-1 α 2k-1 =α k (a k +a k+1 α 1 +a k+2 α 2 +…+a 2k-1 α k-1 );

[0029] ...

[0030] CPUm calculates the m-th polynomial: f m (α)=a (m-1)k α (m-1)k +a (m-1)k+1 α (m-1)k+1 +a (m-1)k+2 α (m-1)k+2 +…+a mk-1 α mk-1 =α (m-1)k (a (m-1)k +a (m-1)k+1 α 1 +a (m-1)k+2 α 2 +…+a mk-1 α k-1 ).

[0031] Then, the calculation results of m CPUs are summed up to obtain the final calculation result f(α).

[0032] Since CPU2, CPU3, ..., CPUm each need to calculate their respective multiplication factors α. k α 2k , ..., α (m-1)k Since k is related to the order n of the polynomial, the multiplication factor α varies when dealing with different polynomials. k The value of α is uncertain. Each computing unit within a CPU needs to obtain the polynomial's order n, the challenge value α, the CPU's index, and the number of CPUs m, in order to further calculate the multiplication factor α. k The value of k = (n+1) / m may not be divisible, requiring additional strategies to ensure that the difference in the number of polynomial terms processed by each CPU does not exceed one.

[0033] As shown in Figure 1, this embodiment of the present disclosure provides a zero-knowledge proof polynomial computation device, including: a control unit, and further including: m parallel processing units, where m is a natural number greater than 1, wherein:

[0034] The control unit is configured to acquire the challenge value α and n+1 polynomial coefficients a0 to a n The challenge value α is output to each processing unit, and the n+1 polynomial coefficients a0 to a... n The polynomial is assigned to m processing units. The coefficient of the x-th polynomial assigned to the i-th processing unit is a(x-1)m+i-1, where x is a natural number greater than or equal to 1. The floor function is used for rounding up, where i is a natural number between 1 and m, and n is a natural number greater than 1.

[0035] Each processing unit is configured to receive a challenge value α and its corresponding polynomial coefficients, and to calculate the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients.

[0036] In existing zero-knowledge proof polynomial computation processes, the prover's multiple parallel processing units need to obtain the order n of the corresponding polynomial to calculate the multiplication factor α. kThe zero-knowledge proof polynomial computation apparatus of this disclosure, by re-dividing the polynomial values ​​of the corresponding part calculated by each processing unit (the x-th polynomial coefficient allocated to the i-th processing unit is a(x-1)m+i-1), allows multiple parallel processing units to disregard the order of the polynomial and only need to obtain the challenge value α. The number of processing units m and the index value i of each processing unit are transmitted and stored in the memory of each processing unit at startup and do not need to be transmitted again during the calculation process. Each processing unit calculates the corresponding part of the polynomial value based on the challenge value α and its corresponding polynomial coefficients, thereby increasing the compatibility of the processing unit with polynomial calculation. The control unit only needs to output the polynomial coefficients every m to the processing unit. If the number of terms n+1 of the polynomial is not divisible by the number of processing units m, it is also easy to ensure that the number of polynomial terms calculated by each processing unit does not differ by more than 1, thereby balancing the load of each processing unit.

[0037] In some exemplary embodiments, the processing unit may be a central processing unit (CPU); however, this disclosure does not limit this.

[0038] In this embodiment of the disclosure, each processing unit adopts a new segmentation method. Taking a CPU as an example, for multiple parallel CPUs, each CPU does not need to obtain the order n of the polynomial, but only needs to obtain the challenge value α. For example, if there are m parallel CPUs, the polynomial part calculated by each CPU is as follows:

[0039] CPU1: Calculate f1(α) = a0 + a m α m +a 2m α 2m +…

[0040] CPU2: Calculate f2(α) = a1α 1 +a m+1 α m+1 +a 2m+1 α 2m+1 +…=α(a1+a m+1 α m +a 2m+1 α 2m +…)

[0041] ...

[0042] CPUm: Calculate f m (α)=a m-1 α m-1 +a 2m-1 α 2m-1 +a 3m-1 α 3m-1 +…=αm-1 (a m-1 +a 2m-1 α m +a 3m-1 α 2m +…)

[0043] Let t = α m ,but:

[0044] CPU1: Calculate f1(α) = a0 + a m t+a 2m t 2 +…;

[0045] CPU2: Calculate f2(α) = α(a1 + a m+1 α m +a 2m+1 α 2m +…)=α(a1+a m+1 t+a 2m+1 t 2 +…)

[0046] ...

[0047] CPUm: Calculate f m (α)=α m-1 (a m-1 +a 2m-1 t+a 3m-1 t 2 +…)

[0048] As can be seen, CPU2, CPU3, ..., CPUm require calculation of α, α 2 , ..., α m-1 And α needs to be calculated for all of them. m That is, each CPU needs to calculate t = α m and α i-1 The values ​​of these parameters are independent of the order of the polynomial, but only related to the number of CPUs, which facilitates independent calculation by the CPUs.

[0049] In some exemplary embodiments, the control unit transfers the n+1 polynomial coefficients a0 to a0 via a Direct Memory Access (DMA) transfer channel. n It is allocated to m processing units.

[0050] In some exemplary embodiments, at least one processing unit is further configured to add the polynomial values ​​calculated by each processing unit to generate a final polynomial value.

[0051] As shown in Figure 1, an adder is also provided at the output of the third multiplier of the first processing unit in the zero-knowledge proof polynomial computing device. The adder adds the polynomial values ​​calculated by each processing unit to generate the final polynomial value. However, this embodiment of the present disclosure does not limit this. The adder can be set in any processing unit, that is, the polynomial values ​​calculated by each processing unit can be added by any processing unit to generate the final polynomial value.

[0052] In some exemplary embodiments, as shown in FIG2, each processing unit includes: a first calculation unit, a second loop unit, and a third multiplier;

[0053] The first computing unit is configured to receive a challenge value α and calculate a first intermediate value and a second intermediate value based on the challenge value α. The first intermediate value for each processing unit is α. m The second intermediate value of the i-th processing unit is α. i-1 The first intermediate value is input into the second loop unit, and the second intermediate value is input into the third multiplier.

[0054] The second loop unit is configured to receive the corresponding polynomial coefficients and the first intermediate value, and to perform a cyclic multiplication and accumulation operation on the corresponding polynomial coefficients and the first intermediate value, and output the result of the multiplication and accumulation operation to the third multiplier.

[0055] The third multiplier is configured to receive the second intermediate value and the result of the multiplication-accumulation operation, calculate the product of the result of the multiplication-accumulation operation and the second intermediate value, and use the calculated product as the polynomial value of the corresponding part.

[0056] In some exemplary embodiments, as shown in FIG3, the multiplication and accumulation operation is performed iteratively using the corresponding polynomial coefficients and the first intermediate value, including:

[0057] Assign the corresponding polynomial coefficients to c0 through c in ascending power order. q ;

[0058] The initial multiplication-accumulation operation result is c. q ;

[0059] From j = q-1 to 0 with a step size of 1, perform the following operation in a loop: combine the result of the multiplication and accumulation operation with the first intermediate value α. m The product is reassigned to the result of the multiplication-accumulation operation, and c is... j The value is added to the result of the multiplication-accumulation operation.

[0060] Looking at the polynomial product terms after extracting the coefficients for a single CPU, it's equivalent to each CPU needing to calculate the polynomial: c0 + c1t + c2t. 2 +…+c q t qThe coefficients c0, c1, c2, ... vary depending on the CPU. For example, for CPU1, the coefficients c0, c1, c2, ... are a0, a... m a 2m ...; For CPU2, the coefficients c0, c1, c2, ... are respectively: a1, a... m+1 a 2m+1 ...and so on for other CPUs.

[0061] For the polynomial: c0 + c1t + c2t 2 +…+c q t q The usual calculation method is as follows:

[0062] Initialize sum = c0;

[0063] The loop j = 1...q, with a step size of 1;

[0064] {tmp=c j *t;

[0065] sum = sum + tmp;

[0066] t = t * t;

[0067] Using the usual calculation method, a total of 2q multiplications and q additions are needed to obtain the polynomial: c0 + c1t + c2t 2 +…+c q t q The calculation results.

[0068] In the zero-knowledge proof polynomial computation apparatus of this disclosure, when the second loop unit performs cyclic multiplication and accumulation operations using the corresponding polynomial coefficients and the first intermediate value, it starts the calculation from the higher-order coefficients, requiring a total of q multiplications and q additions. This is q fewer multiplications than the usual calculation method, thus reducing the computational load within each processing unit. The specific calculation method is as follows:

[0069] Initialize acc = c q ;

[0070] The loop ji = q - 1 ... 0 has a step size of 1;

[0071] {acc = acc * t;

[0072] acc = acc + c j ;}

[0073] Within the ZKG system, the prover will use the evaluation value f(α) and the commitment value com f ,com hThe evaluation value f(α) and commitment value com are sent to the verifier, who uses the multiplicative homomorphism method of elliptic curve pairs to determine whether they are generated by the same polynomial. f ,com h .

[0074] As shown in Figure 2, in this embodiment of the present disclosure, each CPU has only two corresponding input data (challenge value α, corresponding polynomial coefficient data). The number of CPUs m and the CPU index value i are transferred and stored in the CPU memory at startup and do not need to be transferred again during the calculation process. The CPU calculates α. m and α i-1 The value of f. CPU1 performs the operation f1(α), CPU2 performs the operation f2(α), ..., CPUm performs the operation f. m (α) Operation. After CPU1, CPU2, ..., CPUm complete their respective calculations, an addition operation is performed on the calculation results of CPU1, CPU2, ..., CPUm. (This addition operation can be performed by one of the CPUs or distributed among multiple CPUs. For example, when distributed among multiple CPUs, each pair of CPUs can be grouped together, and the calculation results of the two CPUs in each group can be added together. For example, the calculation results of CPU1 and CPU2 can be added together, the calculation results of CPU3 and CPU4 can be added together, and so on. Then, the results of each pair of groups can be added together. For example, the result of the first group of CPU1 and CPU2 can be added together with the result of the second group of CPU3 and CPU4, and so on; ... until the cumulative sum of the calculation results of CPU1 to CPUm is obtained.)

[0075] Assuming the CPU index is i and the number of CPUs is m, the first computing unit calculates the multiplication factor α corresponding to that CPU. i-1 The value of the second loop unit's input t = α m The second loop unit calculates c0 + c1t + c2t. 2 +…+c q t q The result of the multiplication and accumulation operation is obtained; the third multiplier calculates α. i-1 The product of the results of the summation and multiplication operations yields the polynomial value f for the corresponding part. i (α). Then, the polynomial values ​​f2(α) to f2(α) of the corresponding parts calculated by CPU2 to CPUm are obtained. m (α) is sent to the adder in CPU1 and added to the corresponding polynomial value f1(α) calculated by CPU1 to obtain the final output value: the value of f(α).

[0076] The commitment value can be calculated using the following method:

[0077] CPU1: Computing.comf1 =a0+a m G m +a 2m G 2m +…;

[0078] CPU2: Computing com f2 =a1+a m+1 G m+1 +a 2m+1 G 2m +…

[0079] ...

[0080] CPUm: Computing.com fm =a m-1 +a 2m-1 G 2m-1 +a 3m-1 G 3m-1 +…

[0081] Each CPU can calculate the commitment value through the elliptic addition and elliptic doubling modules. Each CPU can reuse the polynomial coefficients allocated when calculating f(α) to calculate the commitment value without retransmitting the polynomial coefficients. That is, this disclosure does not increase the amount of data transmission required for the commitment value calculation.

[0082] As shown in Figure 4, this disclosure also provides a zero-knowledge proof hardware accelerator, which includes a zero-knowledge proof polynomial computing device as described in any embodiment of this disclosure, and further includes an interface control module. The interface control module is configured to receive input polynomial coefficients a0 to a0. n And the challenge value α, and the polynomial coefficients a0 to a n The challenge value α is output to the zero-knowledge proof polynomial computation device. The zero-knowledge proof polynomial computation device completes the zero-knowledge proof polynomial computation process. The specific implementation method can be referred to the above description and will not be repeated here. The zero-knowledge proof hardware accelerator provided in this disclosure re-divides the polynomial value of the corresponding part calculated by each processing unit. Multiple parallel processing units do not need to care about the order of the polynomial, but only need to obtain the challenge value α. The number of processing units m and the index value i of each processing unit are transmitted and stored in the memory of each processing unit at startup and do not need to be transmitted again during the computation process. Each processing unit calculates the polynomial value of the corresponding part according to the challenge value α and its corresponding polynomial coefficients, which increases the compatibility of the processing unit with polynomial computation. The control unit only needs to output the polynomial coefficients every m to the processing unit. If the number of terms n+1 of the polynomial is not divisible by the number of processing units m, it is also easy to ensure that the number of polynomial terms calculated by each processing unit does not differ by more than 1, thereby balancing the load of each processing unit.

[0083] As shown in Figure 5, this disclosure also provides a zero-knowledge proof polynomial computation method, including:

[0084] Step 501: The control unit obtains the challenge value α and n+1 polynomial coefficients a0 to a n The challenge value α is output to each processing unit, and the n+1 polynomial coefficients a0 to a1 are output. n The polynomial is assigned to m processing units. The coefficient of the x-th polynomial assigned to the i-th processing unit is a(x-1)m+i-1, where x is a natural number greater than or equal to 1. The floor function is the floor function, where i is a natural number between 1 and m, n is a natural number greater than 1, and m is a natural number greater than 1.

[0085] Step 502: Each processing unit receives the challenge value α and its corresponding polynomial coefficients, and calculates the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients.

[0086] The zero-knowledge proof polynomial computation method of this disclosure re-divides the polynomial values ​​of the corresponding part calculated by each processing unit (the x-th polynomial coefficient assigned to the i-th processing unit is a(x-1)m+i-1). Multiple parallel processing units do not need to concern themselves with the order of the polynomial; they only need to obtain the challenge value α. The number of processing units m and the index value i of each processing unit are transmitted and stored in the memory of each processing unit at startup and do not need to be transmitted again during computation. Each processing unit calculates the corresponding part of the polynomial value based on the challenge value α and its corresponding polynomial coefficients, increasing the compatibility of the processing units with polynomial computation. The control unit only needs to output the polynomial coefficients every m to its own processing unit. If the number of terms n+1 of the polynomial is not divisible by the number of processing units m, it is easy to ensure that the number of polynomial terms calculated by each processing unit does not differ by more than 1, thereby achieving load balancing for each processing unit.

[0087] In some exemplary embodiments, the method further includes:

[0088] At least one processing unit adds the polynomial values ​​calculated by each processing unit to generate the final polynomial value.

[0089] In this embodiment of the disclosure, the addition operation of summing the polynomial values ​​calculated by each processing unit can be performed by one of the processing units or distributed among multiple processing units. For example, when distributed among multiple processing units, each pair of processing units can be grouped together, and the calculation results of the two processing units in each group can be added together. For example, the calculation results of processing unit 1 and processing unit 2 can be added together, the calculation results of processing unit 3 and processing unit 4 can be added together, and so on. Then, the results of each pair of groups can be added together. For example, the result of adding processing unit 1 and processing unit 2 in the first group can be added together with the result of adding processing unit 3 and processing unit 4 in the second group, and so on; until the cumulative sum of the calculation results of processing unit 1 to processing unit m is obtained.

[0090] In some exemplary embodiments, each processing unit calculates the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients, including:

[0091] The first and second intermediate values ​​are calculated based on the challenge value α. The first intermediate value for each processing unit is α. m The second intermediate value of the i-th processing unit is α. i-1 ;

[0092] The corresponding polynomial coefficients are used to perform a cyclic multiplication and accumulation operation with the first intermediate value to obtain the result of the multiplication and accumulation operation.

[0093] Calculate the product of the result of the multiplication and accumulation operation and the second intermediate value, and use the calculated product as the polynomial value of the corresponding part.

[0094] In some exemplary embodiments, the multiplication and accumulation operation is performed iteratively using the corresponding polynomial coefficients and the first intermediate value, including:

[0095] Assign the corresponding polynomial coefficients to c0 through c in ascending power order. q ;

[0096] The initial multiplication-accumulation operation result is c. q ;

[0097] From j = q-1 to 0 with a step size of 1, perform the following operation in a loop: combine the result of the multiplication and accumulation operation with the first intermediate value α. m The product is reassigned to the result of the multiplication-accumulation operation, and c is... j The value is added to the result of the multiplication-accumulation operation.

[0098] The zero-knowledge proof polynomial calculation method of this disclosure, when using the corresponding polynomial coefficients and the first intermediate value to perform cyclic multiplication and accumulation operations, starts from the higher-order coefficients and requires a total of q multiplications and q additions, which is q fewer than the usual calculation method, thus reducing the amount of computation in each processing unit.

[0099] This disclosure also provides a zero-knowledge proof polynomial computation apparatus, including a memory; and a processor connected to the memory, the memory being used to store instructions, the processor being configured to execute the steps of the zero-knowledge proof polynomial computation method as described in any embodiment of this disclosure based on the instructions stored in the memory.

[0100] As shown in Figure 6, in one example, a zero-knowledge proof polynomial computing device may include: a processor 610, a memory 620, a bus system 630, and a transceiver 640. The processor 610, memory 620, and transceiver 640 are connected via the bus system 630. The memory 620 stores instructions, and the processor 610 executes the instructions stored in the memory 620 to control the transceiver 640 to send and receive signals. The processor 610 includes m parallel processing units. Specifically, the transceiver 640, under the control of the processor 610, can acquire the challenge value α and n+1 polynomial coefficients a0 to a... n The challenge value α is output to each processing unit, and the n+1 polynomial coefficients a0 to a... n The polynomial is assigned to m processing units. The coefficient of the x-th polynomial assigned to the i-th processing unit is a(x-1)m+i-1, where x is a natural number greater than or equal to 1. The rounding symbol is used for rounding up. i is a natural number between 1 and m, and n is a natural number greater than 1. Each processing unit receives the challenge value α and its corresponding polynomial coefficients, and calculates the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients.

[0101] It should be understood that processor 610 can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0102] Memory 620 may include read-only memory and random access memory, and provides instructions and data to processor 610. A portion of memory 620 may also include non-volatile random access memory. For example, memory 620 may also store device type information.

[0103] In addition to the data bus, the bus system 630 may also include a power bus, a control bus, and a status signal bus. However, for clarity, all buses are labeled as bus system 630 in Figure 6.

[0104] In implementation, the processing performed by the processing device can be accomplished through integrated logic circuits in the hardware of the processor 610 or through software instructions. That is, the method steps of this embodiment can be executed by a hardware processor, or by a combination of hardware and software modules within the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other storage media. This storage medium is located in memory 620, and the processor 610 reads information from memory 620 and, in conjunction with its hardware, completes the steps of the aforementioned method. To avoid repetition, further details are omitted here.

[0105] This disclosure also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the zero-knowledge proof polynomial computation method as described in any embodiment of this disclosure. The method of driving zero-knowledge proof polynomial computation by executing executable instructions is essentially the same as the zero-knowledge proof polynomial computation method provided in the above embodiments of this disclosure, and will not be described in detail here.

[0106] In some possible implementations, various aspects of the zero-knowledge proof polynomial computation method provided in this disclosure can also be implemented as a program product comprising program code that, when the program product is run on a computer device, causes the computer device to perform the steps in the zero-knowledge proof polynomial computation method according to various exemplary embodiments of this disclosure as described above. For example, the computer device can execute the zero-knowledge proof polynomial computation method described in the embodiments of this disclosure.

[0107] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0108] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0109] It should be noted that the above embodiments or implementation methods are merely exemplary and not restrictive. Therefore, this disclosure is not limited to the content specifically shown and described herein. Various modifications, substitutions, or omissions can be made to the form and details of the implementations without departing from the scope of this disclosure.

Claims

1. A zero-knowledge proof polynomial computing device, comprising a control unit and m parallel processing units, where m is a natural number greater than 1, wherein: The control unit is configured to acquire the challenge value α and n+1 polynomial coefficients a0 to a n The challenge value α is output to each processing unit, and the n+1 polynomial coefficients a0 to a1 are output. n The polynomial is assigned to m processing units. The coefficient of the x-th polynomial assigned to the i-th processing unit is a(x-1)m+i-1, where x is a natural number greater than or equal to 1. The floor function is used for rounding up, where i is a natural number between 1 and m, and n is a natural number greater than 1. Each of the processing units is configured to receive a challenge value α and its corresponding polynomial coefficients, and to calculate the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients.

2. The apparatus according to claim 1, wherein, At least one of the processing units is further configured to add the polynomial values ​​calculated by each of the processing units to generate a final polynomial value.

3. The apparatus according to claim 1, wherein, Each of the processing units includes: a first calculation unit, a second loop unit, and a third multiplier; The first calculation unit is configured to receive a challenge value α, and calculate a first intermediate value and a second intermediate value based on the challenge value α, wherein the first intermediate value of each processing unit is α. m The second intermediate value of the i-th processing unit is α. i-1 The first intermediate value is input into the second loop unit, and the second intermediate value is input into the third multiplier. The second loop unit is configured to receive the corresponding polynomial coefficients and the first intermediate value, and to perform a cyclic multiplication and accumulation operation on the corresponding polynomial coefficients and the first intermediate value, and output the result of the multiplication and accumulation operation to the third multiplier. The third multiplier is configured to receive the second intermediate value and the result of the multiplication-accumulation operation, calculate the product of the result of the multiplication-accumulation operation and the second intermediate value, and use the calculated product as the polynomial value of the corresponding part.

4. The apparatus according to claim 3, wherein, The step of using the corresponding polynomial coefficients and the first intermediate value to perform a cyclic multiplication and accumulation operation includes: Assign the corresponding polynomial coefficients to c0 through c in ascending power order. q ; The result of the multiplication-accumulation operation is initialized to c. q ; From j = q-1 to 0 with a step size of 1, the following operation is executed sequentially: the result of the multiplication and accumulation operation is compared with the first intermediate value α. m The product is reassigned to the result of the multiplication-accumulation operation, and c is... j The value is added to the result of the multiplication-accumulation operation. Fruit.

5. The apparatus according to claim 1, wherein, The control unit transfers the n+1 polynomial coefficients a0 to a1 via a direct memory access (DMA) channel. n It is allocated to m processing units.

6. A zero-knowledge proof polynomial computation method, comprising: The control unit obtains the challenge value α and n+1 polynomial coefficients a0 to a n The challenge value α is output to each processing unit, and the n+1 polynomial coefficients a0 to a1 are output. n The polynomial is assigned to m processing units. The coefficient of the x-th polynomial assigned to the i-th processing unit is a(x-1)m+i-1, where x is a natural number greater than or equal to 1. The floor function is the floor function, where i is a natural number between 1 and m, n is a natural number greater than 1, and m is a natural number greater than 1. Each processing unit receives a challenge value α and its corresponding polynomial coefficients, and calculates the polynomial value of the corresponding part based on the challenge value α and its corresponding polynomial coefficients.

7. The method according to claim 6, wherein, Each processing unit calculates the polynomial value of its corresponding part based on the challenge value α and its corresponding polynomial coefficients, including: The first intermediate value and the second intermediate value are calculated based on the challenge value α. The first intermediate value for each processing unit is α. m The second intermediate value of the i-th processing unit is α. i-1 ; The corresponding polynomial coefficients are used to perform a cyclic multiplication and accumulation operation with the first intermediate value to obtain the result of the multiplication and accumulation operation. Calculate the product of the result of the multiplication and accumulation operation and the second intermediate value, and use the calculated product as the polynomial value of the corresponding part.

8. The method according to claim 7, wherein, The step of using the corresponding polynomial coefficients and the first intermediate value to perform a cyclic multiplication and accumulation operation includes: Assign the corresponding polynomial coefficients to c0 through c in ascending power order. q ; The result of the multiplication-accumulation operation is initialized to c. q ; From j = q-1 to 0 with a step size of 1, the following operation is executed sequentially: the result of the multiplication and accumulation operation is compared with the first intermediate value α. m The product is reassigned to the result of the multiplication-accumulation operation, and c is... j The value is added to the result of the multiplication-accumulation operation.

9. A zero-knowledge proof polynomial computation apparatus, comprising a memory; and a processor connected to the memory, the memory being configured to store instructions, the processor being configured to perform the steps of the zero-knowledge proof polynomial computation method as claimed in any one of claims 6 to 8 based on the instructions stored in the memory.

10. A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the zero-knowledge proof polynomial computation method as described in any one of claims 6 to 8.

Images