CN116560668A - Data processing device and data processing method - Google Patents

Abstract

The present disclosure relates to a data processing apparatus and a data processing method for converting executable source code into zero knowledge proof for verifying correctness of an execution process of the source code. The data processing apparatus according to the present disclosure includes: an arithmetic circuit constraint generating unit configured to automatically analyze a source code to decompose the source code into a code structure, and generate an arithmetic circuit constraint describing the code structure; and a zero-knowledge proof generation unit configured to generate a zero-knowledge proof using the arithmetic circuit constraint, wherein the zero-knowledge proof is constructed based on a polynomial formed by the arithmetic circuit constraint. According to the data processing technology of the present disclosure, complex on-chain business logic such as blockchain can be transferred to the under-chain computation, and zero knowledge proof is automatically generated for the under-chain computation and related data, thereby reducing the computation cost of the blockchain while ensuring security.

Description

Data processing device and data processing method

technical field

The present disclosure generally relates to the technical field of data processing, and more specifically, relates to a data processing device and data processing method for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code.

Background technique

In various existing data processing technologies, when the business logic involved in data processing is relatively complex, the performance of data processing will be significantly reduced, and the related costs of data processing will increase accordingly.

Contents of the invention

In order to solve the above-mentioned problems in the prior art, the present disclosure proposes a data processing technology for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code.

A brief overview of the present disclosure is given below in order to provide a basic understanding of some aspects of the present disclosure. It should be understood that this summary is not an exhaustive overview of the disclosure, nor is it intended to identify key or critical elements of the disclosure or to delineate the scope of the disclosure. Its purpose is merely to present some concepts in a simplified form as a prelude to the more detailed description that is discussed later.

According to one aspect of the present disclosure, there is provided a data processing device for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code, including: an operation circuit constraint generation unit configured and a zero-knowledge proof generation unit configured to generate a zero-knowledge proof using the operational circuit constraints, wherein the zero-knowledge proof is based on an operation A polynomial formed by circuit constraints is constructed.

According to another aspect of the present disclosure, there is provided a data processing method for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code, including: automatically analyzing the source code to convert The source code is decomposed into a code structure, and operational circuit constraints describing the code structure are generated; and a zero-knowledge proof is generated using the operational circuit constraints, wherein the zero-knowledge proof is constructed based on a polynomial formed by the operational circuit constraints.

According to another aspect of the present disclosure, a computer program capable of implementing the above data processing method is provided. Furthermore, there is also provided a computer program product in at least the form of a computer-readable medium on which computer program codes for realizing the above-mentioned data processing method are recorded.

According to the data processing technology for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code in the present disclosure, it is possible to transfer complex on-chain business logic to off-chain calculations, and automatically Generating zero-knowledge proofs for off-chain calculations and related data to ensure the correctness of off-chain calculations. In particular, this data processing technology can automatically analyze the source code of off-chain calculations to convert the calculation process into circuit constraints, and generate proofs for it with an optimized zero-knowledge proof protocol. In this way, the computational cost of the blockchain can be reduced while ensuring security.

Description of drawings

The above and other objects, features and advantages of the present disclosure will be more easily understood with reference to the following description of embodiments of the present disclosure in conjunction with the accompanying drawings, in which:

FIG. 1 is a block diagram illustrating a data processing device according to an embodiment of the present disclosure;

2 is a schematic diagram illustrating exemplary processing performed by a data processing device according to an embodiment of the present disclosure;

3 is a block diagram illustrating an arithmetic circuit constraint generating unit according to an embodiment of the present disclosure;

4 is a schematic diagram illustrating exemplary processing performed by a static analysis subunit according to an embodiment of the present disclosure;

5 is a schematic diagram illustrating exemplary processing performed by a static analysis subunit for a first code structure according to an embodiment of the present disclosure;

6 is a schematic diagram illustrating exemplary processing performed by a static analysis subunit for a second code structure according to an embodiment of the present disclosure;

7 is a schematic diagram illustrating exemplary processing performed by a static analysis subunit for a third code structure according to an embodiment of the present disclosure;

FIG. 8 is a schematic diagram illustrating exemplary processing performed by a static analysis subunit for a fourth code structure according to an embodiment of the present disclosure;

FIG. 9 is a schematic diagram illustrating exemplary processing performed by a dynamic analysis subunit according to an embodiment of the present disclosure;

10 is a schematic diagram illustrating exemplary processing performed by a dynamic analysis subunit for fifth to eighth code structures according to an embodiment of the present disclosure;

11 is a schematic diagram illustrating exemplary processing performed by a zero-knowledge proof generating unit according to an embodiment of the present disclosure;

12 is a schematic diagram showing an exemplary cumulative proof generation process performed by a zero-knowledge proof generation unit according to an embodiment of the present disclosure;

13 is a schematic diagram illustrating an example of cumulative proof processing performed by a zero-knowledge proof generation unit according to an embodiment of the present disclosure;

14 is a flowchart illustrating a data processing method according to an embodiment of the present disclosure; and

FIG. 15 is a schematic structural diagram showing a general-purpose machine that can be used to implement a data processing method and a data processing device according to an embodiment of the present disclosure.

Detailed ways

Hereinafter, some embodiments of the present disclosure will be described in detail with reference to the accompanying explanatory drawings. When referring to elements of a drawing with reference numerals, the same elements will be denoted by the same reference numerals even though they are shown in different drawings. Also, in the following description of the present disclosure, a detailed description of known functions and configurations incorporated herein will be omitted where it may make the subject matter of the present disclosure unclear.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. As used herein, unless the context dictates otherwise, singular forms are intended to include plural forms as well. It will also be understood that the terms "comprising", "comprising" and "having" used in the specification are intended to specify the existence of stated features, entities, operations and/or components, but do not exclude the presence of one or more The presence or addition of other features, entities, operations and/or components.

Unless otherwise defined, all terms including technical terms and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present inventive concept belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be construed to have a meaning consistent with their meaning in the context of the relevant art and should not be interpreted in an idealized or overly formal sense unless expressly defined herein explain.

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. The present disclosure may be practiced without some or all of these specific details. In other instances, in order to avoid obscuring the present disclosure with unnecessary details, only components closely related to the solutions according to the present disclosure are shown in the drawings, while other details that are not relevant to the present disclosure are omitted.

Zero-knowledge proofs can verify the correctness of general computations without revealing any computation-related information. Zero-knowledge proof transforms general-purpose computing into computing circuits according to the computing steps, constrains each circuit gate, formalizes and unifies the constraints of all circuit gates, and integrates them to form a computing circuit constraint system. Transform the correctness of general computing into the satisfiability of computational circuit constraint systems. Transform the computational circuit constraint system into a polynomial representation, and transform the correctness of general computing into the correctness of polynomials again. By sampling and verifying the values of polynomials in the definition domain, the correctness verification of general calculations is realized. In this process, through the cryptographic scheme, the verifier can verify the correctness of the general calculation without obtaining any information related to the general calculation.

Blockchain can be thought of as a distributed database that operates in a decentralized manner. Through the use of data encryption, time stamps, distributed consensus and economic incentives, blockchain technology realizes point-to-point transactions, coordination and collaboration based on decentralization without the need for mutual trust between transaction nodes in a distributed system, thereby Solve the common problems of high cost, low efficiency and insecure data storage in centralized institutions.

In recent years, blockchain, as a new form of universal distributed underlying architecture, has been widely used in various fields such as finance, economy, technology and even politics.

However, in the current blockchain system, the business logic on the chain is implemented through smart contracts. When the business logic on the chain is more complex, the performance of the transaction on the chain will be significantly reduced, and the transaction fee will increase accordingly

In addition, in order to ensure security, developers of blockchain applications need to manually generate zero-knowledge proofs for this part of the smart contract code when transferring the business logic in the smart contract on the chain to the off-chain, so as to ensure the off-chain execution The business logic process is correct. For developers, generating zero-knowledge proofs requires knowledge of cryptography and mathematics. However, most developers of blockchain applications do not understand cryptography. In addition, it is very time-consuming and difficult to manually write the operational circuit constraints of zero-knowledge proofs. Even if developers can manually generate computational circuit constraints, when generating zero-knowledge proofs, they still need to use existing zero-knowledge proof protocols, and cannot shorten the time to generate zero-knowledge proofs according to specific scenarios.

According to the data processing technology of the present disclosure as described in detail below, circuit constraints can be generated for sequential structures, all branches, loops, API (Application Program Interface) interface function calls, etc. based on static code analysis of program source code; and can be based on Dynamic code analysis of program source code generates circuit constraints for dynamic arrays, dynamic loops, specific execution branches, recursive functions, etc. Furthermore, assignments to code variables can be recorded during calculations of the dynamic execution of the source code. In addition, in the process of generating zero-knowledge proofs, the existing zero-knowledge proof generation methods are optimized. Specifically, for code structures with different (non-repetitive) structures, zero-knowledge proofs are generated concurrently; and for code structures with the same (repetitive) structures, zero-knowledge proofs are generated by accumulation.

Herein, the terms "operational circuit constraint", "circuit constraint", "constraint" and "multiplication circuit constraint" have the same meaning, and thus are used mixedly in the description. In addition, in this article, the terms "zero-knowledge proof" and "proof" have the same meaning, so they are mixedly used in the specification.

In the following, the data processing technology for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code according to the present disclosure will be described in detail with reference to the accompanying drawings and embodiments according to the present disclosure.

FIG. 1 is a block diagram illustrating a data processing device 100 according to an embodiment of the present disclosure. FIG. 2 is a schematic diagram illustrating exemplary processing performed by the data processing apparatus 100 according to an embodiment of the present disclosure.

As shown in FIG. 1 , a data processing device 100 according to an embodiment of the present disclosure may include an arithmetic circuit constraint generation unit 101 and a zero-knowledge proof generation unit 102 .

As shown in FIG. 2 , according to an embodiment of the present disclosure, the input of the data processing apparatus 100 may include program source code, for example, source code written in C language, Java language or Golong language. In addition, as shown in FIG. 2 , the output of the data processing apparatus 100 may be a zero-knowledge proof for verifying the correctness of the execution process of the source code.

In addition, as shown by the dotted line box in FIG. 2 , according to other embodiments of the present disclosure, the input of the data processing apparatus 100 may also include parameters of functions in the program.

According to an embodiment of the present disclosure, source code is used for off-chain pre-processing of application-related data in a blockchain architecture. The application mentioned here can be, for example, on-chain transactions implemented in the form of smart contracts in the blockchain architecture. Those skilled in the art should realize that although the data processing device and data processing method according to the embodiments of the present disclosure are described in detail herein by taking the source code of a smart contract for blockchain as an example, the present disclosure is not limited thereto . Without departing from the spirit and scope of the present disclosure, the inventive concepts of the present disclosure can also be applied to source codes in other related data processing technical fields and are not limited to blockchains. For example, in the technical field where the source code itself cannot be disclosed for security reasons, the inventive concept of the present disclosure can be used to convert the source code into a zero-knowledge proof, so as to verify the correctness of the execution process of the source code.

As shown in FIG. 1 and FIG. 2 , according to an embodiment of the present disclosure, the operation circuit constraint generating unit 101 can automatically analyze the source code to decompose the source code into a code structure, and generate an operation circuit constraint describing the code structure.

As shown in FIG. 2 , according to an embodiment of the present disclosure, the operation circuit constraint generating unit 101 can analyze the static code structure of the source code to generate the operation circuit constraint on the static code structure, wherein the static code structure is during the execution of the source code invariant; and the dynamic code structure of the source code may be executed to generate operational circuit constraints on the dynamic code structure, wherein the dynamic code structure changes dynamically based on variables during execution of the source code. In addition, as shown by the dotted line box in FIG. 2 , according to other implementations of the present disclosure, the operation circuit constraint generation unit 101 may also perform variable assignment of the operation circuit. As shown in FIG. 2 , according to an embodiment of the present disclosure, the arithmetic circuit constraint generation unit 101 may generate arithmetic circuit constraints in the form of multiplication of variables included in the source code based on analysis and execution of the code structure of the source code. The structure and function of the arithmetic circuit constraint generation unit 101 will be described in more detail below in conjunction with FIGS. 3 to 10 .

As shown in FIG. 1 and FIG. 2, according to an embodiment of the present disclosure, the zero-knowledge proof generation unit 102 can use the operation circuit constraints generated by the operation circuit constraint generation unit 101 to generate a zero-knowledge proof, wherein the zero-knowledge proof can be formed based on the operation circuit constraints polynomial to construct. As mentioned above, as shown in the dashed box in FIG. 2 , according to other embodiments of the present disclosure, the zero-knowledge proof generation unit 102 can use both the operation circuit constraints generated by the operation circuit constraint generation unit 101 and the assignment of circuit variables to Generate a zero-knowledge proof.

As shown in FIG. 2 , according to an embodiment of the present disclosure, the zero-knowledge proof generation unit 102 can concurrently generate zero-knowledge proofs for code structures with different structures (not repeated); and for code structures with the same structure (repeated), through Accumulate to generate a zero-knowledge proof. The structure and function of the zero-knowledge proof generation unit 102 will be described in more detail below in conjunction with FIGS. 11 to 13 .

FIG. 3 is a block diagram illustrating the arithmetic circuit constraint generation unit 101 according to an embodiment of the present disclosure. As shown in FIG. 3 , according to an embodiment of the present disclosure, the operation circuit constraint generation unit 101 may include a static analysis subunit 1011 and a dynamic analysis subunit 1012 . The configuration and functions of the static analysis subunit 1011 and the dynamic analysis subunit 1012 will be described in detail below.

FIG. 4 is a schematic diagram illustrating exemplary processing performed by the static analysis subunit 1011 according to an embodiment of the present disclosure.

According to an embodiment of the present disclosure, the static analysis subunit 1011 may analyze the static code structure of the source code to generate operational circuit constraints on the static code structure, wherein the static code structure does not change during the execution of the source code.

As shown in FIG. 4 , the static analysis subunit 1011 can generate an abstract syntax tree based on the code structure of the source code by static analysis, and analyze the dependencies between the code structures. Abstract syntax tree (Abstract Syntax Tree, AST) is an abstract representation of the grammatical structure of the source code. It expresses the grammatical structure of the source code in the form of a tree, and each node on the tree represents a code structure in the source code. Since abstract syntax trees are known to those skilled in the art, their details are not described in more detail herein for the sake of brevity.

As shown in FIG. 4 , according to an embodiment of the present disclosure, the static analysis subunit 1011 may analyze the source code to find an uncertain code structure, so as to modify the uncertain code structure. This is because, in the operation circuit constraint system of the zero-knowledge proof, the constraint number of the operation circuit and the multiplication circuit gate must be definite and cannot be changed. If there is an uncertain code structure, when different parameters are passed in the function code of the program, the code structure will inevitably be different, and thus the operation circuit will also be different. Therefore, it is necessary to analyze the uncertain code structure of the source code of the program.

As shown in FIG. 4 , according to an embodiment of the present disclosure, the code structure with uncertainty includes at least one of a code structure of a recursive function call without returning a result, a code structure of an infinite loop, and a code structure pointing to an uncertain branch. one. According to the embodiments of the present disclosure, if there is an uncertain structure as described above in the source code, the developer may be suggested to modify or delete such code structure.

As shown in FIG. 4 , according to an embodiment of the present disclosure, the static analysis subunit 1011 can generate an operation circuit constraint in the form of a multiplication of variables included in the source code for the static code structure by means of rule matching. According to an embodiment of the present disclosure, the static code structure may include at least one of a first code structure for sequential execution, a second code structure for a fixed pointing branch, a third code structure for a fixed number of loops, and a fourth code structure for an interface function .

FIG. 5 is a schematic diagram illustrating exemplary processing performed by the static analysis subunit 1011 for the first code structure according to an embodiment of the present disclosure.

As shown in FIG. 5, according to an embodiment of the present disclosure, the static analysis subunit 1011 can first analyze the variables (var) related to the constant (constant) for the first code structure executed sequentially, and calculate all the variables (var) related to the constant. variable value. Subsequently, the static analysis subunit 1011 can filter out variables that are not related to function parameters (param), and no operational circuit constraints will be generated for this part of the code. In addition, the static analysis subunit 1011 does not generate arithmetic circuit constraints for variables unrelated to function parameters and return values (Result). Subsequently, the static analysis subunit 1011 can convert all algebraic calculations into multiplication expressions, where each multiplication expression represents an operation circuit constraint. In addition, the static analysis subunit 1011 may combine calculations of multiplying variables and constants for the generated series of multiplication expressions to obtain arithmetic circuit constraints in the form of multiplication circuit constraints.

For example, as shown in Figure 5, the first code structure as an example has four variables (var) a, b, c and d, wherein variables a and b are related to function parameters (param); and variables c and d are related to constant Correlation, i.e. assigned 12 and 3 respectively. In addition, the first code structure has intermediate variables (var) tmp1 and tmp2, and obtains the final return value Result.

As shown in FIG. 5 , according to an embodiment of the present disclosure, the static analysis subunit 1011 calculates all constant-related variable values, for example, 14 is used to replace the intermediate variable tmp2. As mentioned above, for this part of the code, the static analysis subunit 1011 does not generate arithmetic circuit constraints. In Fig. 5, the source code parts related to the generation of arithmetic circuit constraints are indicated by gray boxes, while the source code parts not related to the generation of arithmetic circuit constraints are indicated by white boxes. Therefore, as shown in FIG. 5 , the static analysis subunit 1011 combines the multiplication formulas obtained in the above manner, so as to obtain the operation circuit constraint used to represent the first code structure, ie Result=14*param1*param2.

FIG. 6 is a schematic diagram illustrating exemplary processing performed by the static analysis subunit 1011 for the second code structure according to an embodiment of the present disclosure.

As shown in FIG. 6 , according to an embodiment of the present disclosure, if the branch judgment statement of the source code is definite, that is, static code, the static analysis subunit 1011 can calculate the specific executed branch to directly generate the multiplication circuit constraint.

In addition, according to the embodiment of the present disclosure, if the branch judgment statement of the source code is related to the function parameter, that is, the dynamic code, the static analysis subunit 1011 can list all the branch structures, and for each branch, generate a multiplication of the range proof Circuit constraints and multiplicative circuit constraints for the internal code of that branch.

For example, as shown in FIG. 6 , the branch judgment statement points to two different branches based on whether the value of the function parameter param1 is greater than 10. Therefore, as shown in FIG. 6 , the static analysis subunit 1011 can generate the multiplication circuit constraints "param1>10" and "param1<=10" of the range proof of the two branch structures and the multiplication of the internal codes of the two branch structures Circuit constraints "Result=param1*param2" and "Result=param1*param3".

FIG. 7 is a schematic diagram illustrating exemplary processing performed by the static analysis subunit 1011 for the third code structure according to an embodiment of the present disclosure.

As shown in FIG. 7 , according to an embodiment of the present disclosure, for a third code structure with a fixed number of cycles, if the number of cycles length in the source code is constant, the static analysis subunit 1011 can generate multiplication circuit constraints for the internal code of the cycle , and for each loop, the same circuit constraints are repeatedly generated, where the number of repetitions is the above constant. In addition, if the loop number length in the source code is a variable, then the dynamic analysis subunit 1012 described below will generate the relevant multiplication circuit constraints.

FIG. 8 is a schematic diagram illustrating exemplary processing performed by the static analysis subunit 1011 for the fourth code structure according to an embodiment of the present disclosure.

As shown in FIG. 8 , according to an embodiment of the present disclosure, if there is a fourth code structure of an interface function in the source code, such as calling an application programming interface (API) function, the static analysis subunit 1011 can directly obtain the API function from the database circuit constraints. According to an embodiment of the present disclosure, the arithmetic circuit constraints of the fourth code structure may be predetermined. For example, according to an embodiment of the present disclosure, the circuit constraints of each API function may be generated in advance by the method for generating circuit constraints for the first to third code structures by the static analysis subunit 1011 described above, and stored in the database.

Returning now to FIG. 3 , according to an embodiment of the present disclosure, the dynamic analysis subunit 1012 may execute the dynamic code structure of the source code to generate operational circuit constraints on the dynamic code structure, wherein the dynamic code structure dynamically changes based on variables during the execution of the source code. Variety.

FIG. 9 is a schematic diagram illustrating exemplary processing performed by the dynamic analysis subunit 1012 according to an embodiment of the present disclosure.

As shown in FIG. 9, according to an embodiment of the present disclosure, the dynamic analysis subunit 1012 can dynamically execute the source code of the function, and record the size of the dynamic structure in the code, including, for example, the length of the dynamic array, the number of loops, the execution Specific branches, number of recursive function calls, etc.

According to an embodiment of the present disclosure, the dynamic code structure analyzed by the dynamic analysis subunit 1012 may include a fifth code structure containing an array of variables, a sixth code structure with a non-fixed number of loops, a seventh code structure with a non-fixed pointing branch, and At least one of the eighth code structures of the recursive function call.

In addition, according to an embodiment of the present disclosure, the dynamic analysis subunit 1012 may record the assignment of each code variable in the source code through, for example, code instrumentation. Code instrumentation is a basic dynamic testing method, which is used to add some statements to the source code to check the execution of the program, the change of variables, etc., and can obtain the control flow and data flow information of the program. Given that code instrumentation is known to those skilled in the art, its details are not described in more detail herein for the sake of brevity.

In addition, as shown in FIG. 9 , according to other implementations of the present disclosure, the dynamic analysis subunit 1012 can use the values of the variables in the dynamic code structure to assign values to the circuit variables in the operational circuit constraints.

FIG. 10 is a schematic diagram illustrating exemplary processing performed by the dynamic analysis subunit 1012 for fifth to eighth code structures according to an embodiment of the present disclosure.

As shown in FIG. 10 , according to an embodiment of the present disclosure, the dynamic analysis subunit 1012 can, for example, use the static analysis results of the above-described static analysis subunit 1011 when executing the dynamic code structure to generate an operation circuit for the dynamic code structure. constraint.

Specifically, a specific example of the fifth code structure containing an array of variables may be a dynamic array. As shown in FIG. 10 , according to an embodiment of the present disclosure, the dynamic analysis subunit 1012 can determine the size of the array, the length of the array, and the code variables in the array according to the result of dynamic code execution. Then, the dynamic analysis subunit 1012 can select the multiplication circuit constraints related to the array variables from the circuit constraints (static analysis results) obtained by the static analysis subunit 1011 .

For example, according to an embodiment of the present disclosure, the dynamic analysis subunit 1012 may fix the variables of the dynamic array and select the multiplication circuit constraints related to the array variables from the multiplication circuit constraints acquired by the static analysis subunit 1011 .

In addition, as shown in FIG. 10 , according to an embodiment of the present disclosure, for a sixth code structure with a non-fixed number of loops (ie, a dynamic loop structure), the dynamic analysis subunit 1012 can determine the number of loops according to the result of dynamic code execution. Then, the dynamic analysis subunit 1012 may repeat the multiplication circuit constraints inside the loop acquired by the static analysis subunit 1011, and the number of repetitions is the same as the number of loops.

In addition, as shown in FIG. 10 , according to the embodiment of the present disclosure, for the seventh code structure (that is, the dynamic branch structure) that does not fixedly point to the branch, the dynamic analysis subunit 1012 can determine the specific code structure of the dynamic execution according to the result of the dynamic code execution. branch. Then, the dynamic analysis subunit 1012 can select the multiplication circuit constraints of the specific branch from the multiplication circuit constraints (static analysis results) of all branches obtained by the static analysis subunit 1011, and similarly attach the multiplication of the range proof of the specific branch circuit constraints.

In addition, as shown in FIG. 10 , according to an embodiment of the present disclosure, for the eighth code structure called by a recursive function, the dynamic analysis subunit 1012 may determine the number of calls of the recursive function according to the result of dynamic code execution. Then, the dynamic analysis subunit 1012 can obtain the multiplication circuit constraints inside the function according to the static analysis results of the static analysis subunit 1011, and then repeat all the multiplication circuit constraints of the recursive function, and the number of repetitions is the same as the number of recursive calls. In addition, according to the embodiment of the present disclosure, the dynamic analysis subunit 1012 also adds additional relevant constraints to ensure that the calling parameters of the recursive function are the same as the incoming parameters of the recursive function.

According to the configuration and function of the operation circuit constraint generation unit 101 as described above, it can be based on static code analysis, for example, generate multiplication circuit constraints for sequential structures, all branches, loops, API function calls, and can be based on dynamic code execution, for For example, dynamic arrays, dynamic loops, specific execution branches, and recursive functions generate multiplication circuit constraints. Additionally, assignments to code variables are recorded during dynamic execution.

Now returning to FIG. 1 , according to an embodiment of the present disclosure, the zero-knowledge proof generation unit 102 can use the operational circuit constraints generated by the operational circuit constraint generation unit 101 to generate a zero-knowledge proof, wherein the zero-knowledge proof can be constructed based on a polynomial formed by the operational circuit constraints .

FIG. 11 is a schematic diagram illustrating exemplary processing performed by the zero-knowledge proof generation unit 102 according to an embodiment of the present disclosure.

Specifically, as shown in FIG. 11 , according to an embodiment of the present disclosure, for the fourth code structure of the interface function, if there are multiple different interface function calls, the zero-knowledge proof generation unit 102 can generate zero-knowledge proofs concurrently.

In addition, as shown in FIG. 11 , according to an embodiment of the present disclosure, for the sixth code structure with a non-fixed number of loops, the zero-knowledge proof generating unit 102 can generate a zero-knowledge proof for a repeated dynamic loop structure using accumulation proofs.

Similarly, as shown in FIG. 11 , according to an embodiment of the present disclosure, for the eighth code structure of a recursive function call, the zero-knowledge proof generating unit 102 can use cumulative proofs to generate a zero-knowledge proof for repeated recursive function call structures.

The process of generating a zero-knowledge proof by the zero-knowledge proof generation unit 102 using accumulated proofs will be described in more detail below with reference to FIG. 12 and FIG. 13 .

In addition, as shown in FIG. 11 , according to the embodiment of the present disclosure, for the first code structure of sequential execution, the second code structure of fixed pointing branch, the third code structure of fixed number of loops, and the fifth code structure of array containing variables The structure and the seventh code structure of the non-fixed pointing branch, the zero-knowledge proof generation unit 102 can use the existing zero-knowledge protocol to generate the zero-knowledge proof.

Subsequently, the zero-knowledge proof generation unit 102 may combine the above-mentioned zero-knowledge proofs about the first to eighth code structures into one zero-knowledge proof.

As mentioned above, according to the embodiment of the present disclosure, if the multiplication circuit constraints of multiple code structures are different (for example, the fourth code structure), the zero-knowledge proof generation unit 102 can use the existing zero-knowledge protocol to generate Zero-knowledge proofs can be generated concurrently for each code structure, thereby shortening the proof generation time. In addition, if the circuit constraints of multiple code structures are the same (for example, the sixth code structure and the eighth code structure), the zero-knowledge proof generation unit 102 can generate the zero-knowledge proof using the accumulation proof.

Specifically, according to an embodiment of the present disclosure, for the sixth code structure and the eighth code structure, the zero-knowledge proof generation unit 102 may use the accumulation of polynomials based on the constraint of the operation circuit as its zero-knowledge proof.

According to the embodiments of the present disclosure, cumulative proofs can generate a zero-knowledge proof for multiple repeated code structures, thereby reducing the number of operational circuit constraints and shortening the generation time of the zero-knowledge proof. For the sixth code structure of the non-fixed number of loops and the eighth code structure of the recursive function call, the zero-knowledge proof generation unit 102 can use cumulative proofs to accelerate the generation of zero-knowledge proofs.

FIG. 12 is a schematic diagram illustrating an exemplary accumulation proof generation process performed by the zero-knowledge proof generation unit 102 according to an embodiment of the present disclosure.

According to the implementation of the present disclosure, the algorithm of accumulation proof is as follows:

As mentioned above, the operational circuit constraint of the code structure can be expressed as L(x)*R(x)=O(x) by three polynomials.

Therefore, the generated zero-knowledge proof can include three polynomials L(x), R(x), O(x). The polynomial L(x) can be expressed as: where v _i represents the assignment of variables of the arithmetic circuit, l _i (x) represents the coefficient of the variable of the arithmetic circuit, and n represents the number of variables of the arithmetic circuit. The polynomials R(x) and O(x) can be represented in the same way as the polynomial L(x), i.e. and />

As shown in FIG. 12, each of the polynomials L(x), R(x), O(x) represents an arithmetic circuit constraint of one code structure. For example, for the same code structure, the coefficients of the variables of the arithmetic circuits are the same, and the difference is the assignment v _i of the variables of the arithmetic circuits. Therefore, according to an embodiment of the present disclosure, the zero-knowledge proof generation unit 102 can combine the polynomials constrained by the operational circuits of different code structures based on the coefficients of the variables of the same operational circuit, thereby obtaining two polynomials A(X) and B( X), as the final cumulative zero-knowledge proof.

FIG. 13 is a schematic diagram showing an example of accumulative proof processing performed by the zero-knowledge proof generation unit 102 according to the embodiment of the present disclosure.

As shown in FIG. 13 , for two arithmetic circuits constraints (2a+b)*b=a and (4a-b)*b=a, there are variables a and b of the arithmetic circuits. The coefficient of variable a can be represented by a first-order polynomial, and can be determined by solving the equation (ie, finding the coefficients c ₀ and c ₁ of each term of the polynomial) to determine the coefficient polynomial of variable a as l _a (x)=2x. If there are two identical circuit constraint structures, since their zero-knowledge proof information includes the same coefficient polynomial, but the assignment of the variable a of the operational circuit constraint is different (that is, a_value1 and a_value2 in Figure 13), it can be obtained by accumulating Merge them.

According to an embodiment of the present disclosure, the zero-knowledge proof generation unit 102 can concurrently generate zero-knowledge proofs for multiplication circuit constraints without repetitive structures; Shorten proof generation time.

The present disclosure also provides a data processing method for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code. FIG. 14 is a flowchart illustrating a data processing method 1400 according to an embodiment of the present disclosure.

The data processing method 1400 starts at step S1401.

Subsequently, in step S1402, the source code is automatically analyzed to decompose the source code into a code structure, and an operation circuit constraint describing the code structure is generated. The processing in step S1402 can be realized by, for example, the arithmetic circuit constraint generation unit 101 included in the data processing device 100 described above with reference to FIGS. 1 to 13 , and details are not repeated here.

Subsequently, in step S1403, a zero-knowledge proof is generated using the operational circuit constraints, wherein the zero-knowledge proof is constructed based on a polynomial formed by the operational circuit constraints. The processing in step S1403 can be realized by, for example, the zero-knowledge proof generating unit 102 included in the data processing apparatus 100 described above with reference to FIGS. 1 to 13 , and details are not repeated here.

Finally, the data processing method 1400 ends in step S1404.

According to the data processing technology for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code according to the present disclosure, when applied to a data processing process based on a blockchain architecture, for example, it can Transfer complex on-chain business logic to off-chain calculations, and automatically generate zero-knowledge proofs for off-chain calculations and related data, thereby ensuring the correctness of off-chain calculations. In particular, this data processing technique is able to automatically analyze the source code of off-chain computations to convert the computation process into circuit constraints, and generate proofs for them using an optimized zero-knowledge proof protocol that generates concurrent proofs and cumulative proofs as described above. In this way, the computational cost of the blockchain can be reduced while ensuring security.

FIG. 15 is a simplified structural diagram showing a general-purpose machine 1500 that can be used to implement a data processing method 1400 and a data processing device 100 according to an embodiment of the present disclosure. General purpose machine 1500 may be, for example, a computer system. It should be noted that the general-purpose machine 1500 is just an example, and does not imply limitations on the scope of use or functions of the data processing method and data processing apparatus of the present disclosure. Nor should the general-purpose machine 1500 be interpreted as having any dependency or requirement on any one or combination of components shown in the above-mentioned data processing method or data processing apparatus.

In FIG. 15 , a central processing unit (CPU) 1501 executes various processes according to programs stored in a read only memory (ROM) 1502 or loaded from a storage section 1508 to a random access memory (RAM) 1503 . In the RAM 1503, data required when the CPU 1501 executes various processes and the like is also stored as necessary. The CPU 1501 , ROM 1502 , and RAM 1503 are connected to each other via a bus 1504 . The input/output interface 1505 is also connected to the bus 1504 .

The following components are also connected to the input/output interface 1505: an input section 1506 (including a keyboard, a mouse, etc.), an output section 1507 (including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.) , a storage section 1508 (including a hard disk, etc.), a communication section 1509 (including a network interface card such as a LAN card, a modem, etc.). The communication section 1509 performs communication processing via a network such as the Internet. A driver 1510 may also be connected to the input/output interface 1505 as needed. A removable medium 1511 such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc. can be mounted on the drive 1510 as needed, so that a computer program read therefrom can be installed into the storage section 1508 as needed.

In the case where the above-described series of processing is realized by software, the program constituting the software can be installed from a network such as the Internet or from a storage medium such as the removable medium 1511 .

Those skilled in the art should understand that such a storage medium is not limited to the removable medium 1511 shown in FIG. 15 in which the program is stored and distributed separately from the device to provide the program to the user. Examples of the removable medium 1511 include magnetic disks (including floppy disks), optical disks (including compact disk read only memory (CD-ROM) and digital versatile disks (DVD)), magneto-optical disks (including MiniDisc (MD) (registered trademark)), and semiconductor disks. memory. Alternatively, the storage medium may be the ROM 1502, a hard disk contained in the storage section 1508, or the like, in which programs are stored and distributed to users together with devices containing them.

In addition, the present disclosure also proposes a program product storing machine-readable instruction codes. When the instruction code is read and executed by a machine, the above data processing method according to the present disclosure can be executed. Accordingly, the various storage media listed above for carrying such program products are also included in the scope of the present disclosure.

The above has been described in detail through block diagrams, flow charts and/or implementations, illustrating specific implementations of devices and/or methods according to implementations of the present disclosure. When these block diagrams, flowcharts, and/or implementations include one or more functions and/or operations, those skilled in the art will understand that each function and/or operation in these block diagrams, flowcharts, and/or implementations can be achieved by Various hardware, software, firmware, or essentially any combination thereof, individually and/or collectively. In one embodiment, several portions of the subject matter described in this specification may be implemented in application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs), or other integrated formats. However, those skilled in the art will recognize that some aspects of the implementations described in this specification can be fully or partially in the form of one or more computer programs running on one or more computers (for example, in the form of in the form of one or more computer programs running on one or more computer systems), in the form of one or more programs running on one or more processors (e.g., in the form of in the form of one or more programs), in the form of firmware, or in the form of substantially any combination thereof, and, according to the content disclosed in this specification, the circuits and/or Writing the code for the software and/or firmware of the present disclosure is well within the capabilities of those skilled in the art.

Although the present disclosure has been disclosed above through the description of specific embodiments of the present disclosure, it should be understood that those skilled in the art can design various modifications, improvements or equivalents to the present disclosure within the spirit and scope of the appended claims thing. These modifications, improvements or equivalents should also be considered to be included in the protection scope of the present disclosure.

To sum up, in the embodiments according to the present disclosure, the present disclosure provides the following solutions, but is not limited thereto:

Scheme 1. A data processing device for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code, comprising:

an arithmetic circuit constraint generation unit configured to automatically analyze the source code to decompose the source code into a code structure, and generate arithmetic circuit constraints describing the code structure; and

A zero-knowledge proof generation unit configured to generate the zero-knowledge proof using the operational circuit constraints, wherein the zero-knowledge proof is constructed based on a polynomial formed by the operational circuit constraints.

Solution 2. The data processing device according to solution 1, wherein the source code is used to perform off-chain preprocessing on application-related data in a blockchain architecture.

Aspect 3. The data processing device according to Aspect 1, wherein the arithmetic circuit constraint has a form of a multiplicative expression of variables included in the source code.

Scheme 4. The data processing device according to any one of schemes 1 to 3, wherein the operation circuit constraint generating unit includes:

a static analysis subunit configured to analyze a static code structure of the source code to generate operational circuit constraints on the static code structure, wherein the static code structure does not change during execution of the source code; and

A dynamic analysis subunit configured to execute a dynamic code structure of the source code to generate operational circuit constraints on the dynamic code structure, wherein the dynamic code structure changes dynamically based on variables during execution of the source code.

Scheme 5. The data processing device according to scheme 4, wherein the static analysis subunit is configured to analyze the source code to find a code structure with uncertainty, so as to analyze the code structure with uncertainty The structure is modified.

Scheme 6. The data processing device according to scheme 5, wherein the code structure with uncertainty includes a code structure of a recursive function call without a return result, a code structure of an infinite loop, and a code structure pointing to an uncertain branch at least one of the .

Scheme 7. The data processing device according to scheme 4, wherein the static code structure includes a first code structure executed sequentially, a second code structure fixedly pointing to a branch, a third code structure fixed number of cycles and an interface function At least one of the fourth code structures.

Solution 8. The data processing device according to solution 7, wherein the arithmetic circuit constraint of the fourth code structure is predetermined.

Scheme 9. The data processing device according to scheme 4, wherein the dynamic code structure includes a fifth code structure comprising an array of variables, a sixth code structure with a non-fixed number of loops, and a seventh code structure with a non-fixed pointing branch and at least one of the eighth code structure of the recursive function call.

Item 10. The data processing device according to item 4, wherein the dynamic analysis subunit generates an operation circuit on the dynamic code structure by using a static analysis result of the static analysis subunit when executing the dynamic code structure constraint.

Scheme 11. The data processing device according to scheme 9, wherein, for the sixth code structure and the eighth code structure, the zero-knowledge proof generation unit uses the accumulation of its polynomials based on arithmetic circuit constraints as its zero proof of knowledge.

Scheme 12. A data processing method for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code, comprising:

automatically analyzing the source code to decompose the source code into a code structure and generate computational circuit constraints describing the code structure; and

The zero-knowledge proof is generated using the operational circuit constraints, wherein the zero-knowledge proof is constructed based on a polynomial formed by the operational circuit constraints.

Solution 13. The data processing method according to solution 12, wherein the source code is used to perform off-chain preprocessing on application-related data in the blockchain architecture.

Item 14. The data processing method according to item 12, wherein the arithmetic circuit constraint is in the form of a multiplication of variables included in the source code.

Scheme 15. The data processing method according to any one of schemes 12 to 14, wherein the source code is automatically analyzed to decompose the source code into a code structure and generate arithmetic circuit constraints describing the code structure The steps include:

analyzing a static code structure of the source code to generate computational circuit constraints on the static code structure, wherein the static code structure does not change during execution of the source code; and

A dynamic code structure of the source code is executed to generate operational circuit constraints on the dynamic code structure, wherein the dynamic code structure changes dynamically based on variables during execution of the source code.

Scheme 16. The data processing method according to scheme 15, wherein analyzing the static code structure of the source code comprises analyzing the source code to find a code structure with uncertainty, so as to analyze the static code structure with uncertainty The permanent code structure is modified.

Scheme 17. The data processing method according to scheme 16, wherein the uncertain code structure includes a code structure of a recursive function call without a return result, a code structure of an infinite loop, and a code structure pointing to an uncertain branch at least one of the .

Scheme 18. The data processing method according to scheme 15, wherein the static code structure includes a first code structure executed sequentially, a second code structure fixedly pointing to a branch, a third code structure fixed number of cycles, and an interface function At least one of the fourth code structures.

Scheme 19. The data processing method according to scheme 15, wherein the dynamic code structure includes a fifth code structure containing an array of variables, a sixth code structure with a non-fixed number of loops, and a seventh code structure with a non-fixed pointing branch and at least one of the eighth code structure of the recursive function call.

Solution 20. A computer-readable storage medium, on which a program is stored, and when the program is executed by a computer, the computer executes a data processing method, and the data processing method is used to convert executable source code into A zero-knowledge proof for verifying the correctness of the execution process of the source code, including:

automatically analyzing the source code to decompose the source code into a code structure and generate computational circuit constraints describing the code structure; and

The zero-knowledge proof is generated using the operational circuit constraints, wherein the zero-knowledge proof is constructed based on a polynomial formed by the operational circuit constraints.

Claims (10)

1. A data processing device for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code, comprising: an arithmetic circuit constraint generation unit configured to automatically analyze the source code to decompose the source code into a code structure, and generate arithmetic circuit constraints describing the code structure; and A zero-knowledge proof generation unit configured to generate the zero-knowledge proof using the operational circuit constraints, wherein the zero-knowledge proof is constructed based on a polynomial formed by the operational circuit constraints. 2. The data processing device according to claim 1, wherein the source code is used for off-chain preprocessing of application-related data in a blockchain architecture. 3. The data processing apparatus according to claim 1, wherein the arithmetic circuit constraint has a form of a multiplicative expression of variables included in the source code. 4. The data processing device according to any one of claims 1 to 3, wherein the operation circuit constraint generating unit comprises: a static analysis subunit configured to analyze a static code structure of the source code to generate operational circuit constraints on the static code structure, wherein the static code structure does not change during execution of the source code; and A dynamic analysis subunit configured to execute a dynamic code structure of the source code to generate operational circuit constraints on the dynamic code structure, wherein the dynamic code structure changes dynamically based on variables during execution of the source code. 5. The data processing apparatus according to claim 4, wherein the static analysis subunit is configured to analyze the source code to find a code structure with uncertainty, so as to analyze the code structure with uncertainty The structure is modified. 6. The data processing device according to claim 4, wherein said static code structure comprises a first code structure executed sequentially, a second code structure fixedly pointing to a branch, a third code structure of a fixed number of cycles, and an interface function At least one of the fourth code structures. 7. The data processing apparatus according to claim 4, wherein said dynamic code structure comprises a fifth code structure comprising an array of variables, a sixth code structure of a non-fixed number of loops, a seventh code structure of a non-fixed pointing branch and at least one of the eighth code structure of the recursive function call. 8. The data processing apparatus according to claim 4, wherein the dynamic analysis subunit generates an operation circuit on the dynamic code structure by using a static analysis result of the static analysis subunit when executing the dynamic code structure constraint. 9. The data processing apparatus according to claim 7, wherein, for the sixth code structure and the eighth code structure, the zero-knowledge proof generation unit uses as its zero the accumulation of polynomials based on arithmetic circuit constraints proof of knowledge. 10. A data processing method for converting executable source code into a zero-knowledge proof for verifying the correctness of the execution process of the source code, comprising: automatically analyzing the source code to decompose the source code into code structures and generate computational circuit constraints describing the code structures; and The zero-knowledge proof is generated using the operational circuit constraints, wherein the zero-knowledge proof is constructed based on a polynomial formed by the operational circuit constraints.