WO2026016124A1 - 一种通用的zk-SNARK零知识证明优化系统和方法 - Google Patents

一种通用的zk-SNARK零知识证明优化系统和方法

Info

Publication number
WO2026016124A1
WO2026016124A1 PCT/CN2024/106195 CN2024106195W WO2026016124A1 WO 2026016124 A1 WO2026016124 A1 WO 2026016124A1 CN 2024106195 W CN2024106195 W CN 2024106195W WO 2026016124 A1 WO2026016124 A1 WO 2026016124A1
Authority
WO
WIPO (PCT)
Prior art keywords
window
bucket
proof
scalar
multiplication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
PCT/CN2024/106195
Other languages
English (en)
French (fr)
Inventor
曲强
张乾强
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Institute of Advanced Technology of CAS
Original Assignee
Shenzhen Institute of Advanced Technology of CAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Institute of Advanced Technology of CAS filed Critical Shenzhen Institute of Advanced Technology of CAS
Priority to PCT/CN2024/106195 priority Critical patent/WO2026016124A1/zh
Publication of WO2026016124A1 publication Critical patent/WO2026016124A1/zh
Pending legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N5/00—Computing arrangements using knowledge-based models
    • G06N5/02—Knowledge representation; Symbolic representation

Definitions

  • This invention relates to the field of computer technology, and more specifically, to a general zk-SNARK zero-knowledge proof optimization system and method.
  • Zero-knowledge proof is a cryptographic protocol based on the agreement of two or more parties. Its main function is to enable the prover to convince the verifier that a certain statement made by the prover is true without revealing any useful information to the verifier.
  • Interactive zero-knowledge proof systems involve the verifier posing questions to the prover. If the prover knows the information, the probability of a correct answer is 1; if the prover does not know the information, the probability of a correct answer is 1/2. The verifier can infer whether the prover knows the information through a sufficient number of questions, while ensuring that these questions and their corresponding answers do not reveal any relevant useful information. This technique allows an NP-hard problem to be verified in polynomial time without revealing any data related to the solution.
  • Non-interactive zero-knowledge proof systems are cryptographic protocols that allow a prover to demonstrate the truth of a statement to a verifier without multiple rounds of interaction. In such systems, the prover can demonstrate their proof to the verifier through a single message transmission, without revealing any other information besides the statement's truth value. Unlike interactive zero-knowledge proof systems, in non-interactive systems, the prover does not need to wait for a challenge from the verifier and only needs to send the proof once to complete the entire proof process. The implementation of non-interactive zero-knowledge proof systems relies on complex cryptographic techniques, such as the construction of zero-knowledge proofs and the application of problems like discrete logarithms.
  • Non-interactive Argument of Knowledge Currently, two widely used implementations of non-interactive zero-knowledge proofs are zk-STARK (Zero-Knowledge Scalable Transparent Arguments of Knowledge) and zk-SNARK (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge). Non-interractive Argument of Knowledge) technology.
  • zk-STARK is a state-of-the-art zero-knowledge proof system designed to efficiently, scalably, and transparently verify the correctness of large-scale computations without revealing specific information. Based on error-correcting codes and low-rank encoding, it provides a robust cryptographic solution for ensuring the reliability of computation processes by constructing verifiable polynomial implementations.
  • zk-SNARK is a recognized reliable choice among current zero-knowledge proof protocols, designed to overcome the limitations of previous interactive proof-based methods. It achieves zero-knowledge proofs in a concise, non-interactive way, avoiding multiple interactions between the prover and verifier, and significantly reducing communication costs, representing a significant technological advancement in information security.
  • the main advantage of zk-SNARK lies in its fixed proof size, which reduces verification and communication complexity; this advantage becomes more pronounced with an increased number of transactions.
  • it requires an additional verification key, and although the key can be pre-generated, this inevitably leads to corresponding storage and computational burdens as the number of transactions increases.
  • provers and verifiers need to engage in multiple challenge-response communications during the proof process. This approach limits the efficiency and applicability of proofs because each round of communication can only transmit a small amount of proof information and increases the overall computational and communication costs. This high-frequency communication often results in significant latency and bandwidth consumption, especially when a large number of proofs are required or under poor network conditions. Furthermore, due to the need for multiple rounds of interaction, provers and verifiers must be online simultaneously and able to communicate in real time. This is a significant limitation for distributed systems or asynchronous environments (such as asynchronous networks or offline devices). The synchronization requirement increases the complexity and inconvenience of protocol implementation.
  • zk-STARK offers significant advantages in security and transparency, it also suffers from several notable drawbacks, including high computational and storage overhead, large generated proofs, and lengthy verification times. These factors can lead to inefficiencies when handling complex computational tasks. Furthermore, zk-STARK places high demands on mathematical foundations, increasing the complexity of its implementation and deployment. Due to these limitations, the application of zk-STARK in large-scale zero-knowledge proof systems faces challenges, particularly in large-scale distributed systems or blockchain networks requiring efficient processing and rapid verification. These shortcomings can become performance bottlenecks, impacting the overall scalability and usability of the system.
  • zk-SNARKs excel in reducing proof size and verification time, but they suffer from limitations such as trusted setup issues, computational complexity, high hardware requirements, and insufficient transparency.
  • the inherent limitations of this technology restrict its application in large-scale zero-knowledge proof systems.
  • the trusted setup phase is vulnerable to attacks, and generating proofs requires significant computational resources and has high hardware requirements, thus posing a challenge to its application in large-scale systems.
  • zk-SNARK remains the mainstream zero-knowledge proof technique. This is primarily due to its significant advantages in proof size and verification time, making it perform excellently and efficiently in many practical applications.
  • zk-STARK offers higher transparency and lower trusted setup requirements, it generally lags behind zk-SNARK in terms of computational complexity and operational efficiency. Continuous optimization of zk-SNARK's computational complexity and operational efficiency can further solidify its position as the dominant technique in the field of zero-knowledge proofs and promote its widespread application and development.
  • the proof generation process of zk-SNARK primarily relies on Number Theoretic Transformation (NTT) and Multi-Scalar Multiplication (MSM).
  • NTT Number Theoretic Transformation
  • MSM Multi-Scalar Multiplication
  • Multiplication of multiple scalars is a mathematical operation that, given a set of points and a set of scalars on an elliptic curve, involves multiplying each point by its corresponding scalar and then adding the results. Mathematically, it is defined as follows:
  • N is the scale of the MSM
  • Gi is a point on the finite field of the elliptic curve
  • ki is a ⁇ -bit scalar
  • ki Gi represents the scalar multiplication (PMULT) of points on the elliptic curve.
  • the main computations in PMULT are point addition (PADD) and point doubling (PDBL).
  • PADD point addition
  • PDBL point doubling
  • the point addition operation on the elliptic curve can be implemented through the following steps: Given two points F and G, first draw the straight line connecting them and find the third intersection point -H of the curve. Then, using -H as the center of symmetry, reflect it about the X-axis to obtain point H, which is the sum of F and Q.
  • a proof will contain millions of scalars and point sets, where the scalar bit width is 256 bits. If the result of scalar multiplication for each point is calculated and then summed using point addition to obtain the total result, it will result in a huge computational latency.
  • zero-knowledge proof technology lies in its ability to prove the authenticity of information to others without disclosing private data.
  • existing zero-knowledge proof technologies face major challenges, including long proof generation times, high computational demands, and high costs. These issues severely restrict the widespread application of zero-knowledge proof technology in fields such as blockchain systems. Especially in scenarios with high real-time requirements, such as finance, delays in the generation and verification of zero-knowledge proofs can adversely affect the security and reliability of transactions, leading to negative consequences. Furthermore, lengthy proof generation times also increase the cost of computing resources, reducing the system's economic efficiency.
  • the purpose of this invention is to overcome the shortcomings of the prior art and provide a general zk-SNARK zero-knowledge proof optimization system and method.
  • a general zk-SNARK zero-knowledge proof optimization system includes: a trusted device, a prover, and a verifier, wherein:
  • Trusted devices are used to generate and manage the security parameters required by the system, and to generate and manage the keys in the system;
  • the prover uses the bucket algorithm to perform multi-scalar multiplication to generate the proof.
  • This multi-scalar multiplication is the process of multiplying a point with its corresponding scalar and then adding them together, given a set of points and a set of scalars on an elliptic curve.
  • the verifier compares the key sent by the trusted device with the proof generated by the verifier to confirm the validity of the proof
  • the prover comprises a split window unit, a bucket-in-point reduction unit, a window-in-reduction unit, and a window aggregation unit.
  • the split window unit is used to split the multi-scalar multiplication operation into multiple subtasks based on a set window, and the size of the window is dynamically set according to the Montgomery modular multiplication computation.
  • the bucket-in-point reduction unit is used to reduce each point on the finite field of the elliptic curve to a bucket to obtain the result of each subtask.
  • the window-in-reduction unit is used to multiply the bucket number by the reduced bucket and accumulate and reduce the buckets in the same window into a single bucket to obtain the window value of each window.
  • the window aggregation unit is used to obtain the calculation result of the multi-scalar multiplication based on the obtained window value of each window.
  • a general zk-SNARK zero-knowledge proof optimization method includes the following steps:
  • the bucket algorithm is used to implement multi-scalar multiplication to generate proof that the multiplication operation is the process of multiplying a point with its corresponding scalar and then adding them together, given a set of points and a set of scalars on an elliptic curve.
  • the validity of the proof is confirmed by comparing the key with the generated proof.
  • the multi-scalar multiplication operation is implemented according to the following steps:
  • the multi-scalar multiplication operation is divided into multiple sub-tasks, and the size of the window is dynamically set according to the Montgomery modular multiplication computation amount.
  • This invention focuses on analyzing the generation process and, without affecting other processes involved in proof generation, designs optimized algorithms and improves computation to enhance the performance of zero-knowledge proofs and shorten the proof generation time. For example, it reduces the number of multi-scalar multiplication operations, improves the computational efficiency of multi-scalar multiplication, and designs a dynamic resource allocation and priority scheduling mechanism. This mechanism rationally allocates GPU cores, memory, and bandwidth resources based on task characteristics and priorities, ensuring each task receives adequate resources and minimizing resource idleness and waste. This invention effectively optimizes the execution efficiency of multi-scalar multiplication and explores other optimization strategies, enabling efficient operation of the zk-SNARK proof generation process.
  • Figure 1 is a schematic diagram of elliptic curve calculation in the prior art
  • Figure 2 is a schematic diagram of the calculation process of scalar multiplication in the prior art
  • Figure 3 is a system architecture diagram of zero-knowledge proof according to an embodiment of the present invention.
  • Figure 4 is a schematic diagram of the execution of the Pippenger algorithm according to an embodiment of the present invention.
  • Figure 5 is a schematic diagram of the dynamic window partitioning execution process according to an embodiment of the present invention.
  • Figure 6 is a schematic diagram of an in-bucket parallel architecture according to an embodiment of the present invention.
  • zero-knowledge proof technology effectively resolves the conflict between transparency and personal privacy. It allows users to conduct transactions and data transfers within the publicly accessible nature of blockchain information without worrying about leaking specific transaction details or personal identification information. By proving that they comply with transaction rules or possess specific assets, zero-knowledge proof technology ensures both data privacy and transaction security. Zero-knowledge proof technology can be applied to areas such as blockchain privacy protection, data privacy protection, identity authentication, and digital copyright protection, providing an efficient solution for protecting personal privacy and ensuring data security.
  • FIG 3 is the overall architecture diagram of a zero-knowledge proof system.
  • This system mainly includes a trusted device, a verifier (or verifier module), and a prover (or prover module).
  • This invention primarily optimizes the functionality of the prover.
  • Trusted devices are responsible for generating and managing the security parameters required by the zero-knowledge proof system, such as elliptic curve parameters, prime numbers, and the order of the group. These parameters must be sufficiently random and secure to ensure the system's security and resistance to attacks. Furthermore, trusted devices are used to generate and manage encryption and signing keys in the system. These keys play a crucial role in the generation and verification of proofs, ensuring their integrity and security. Overall, trusted devices generate circuit constraints for the problem to be computed, which are then transformed into constraint vectors, such as R1CS (Rank-1 Constraint System).
  • R1CS Rank-1 Constraint System
  • the verifier's primary role is to compare the key sent by the trusted device with the proof generated by the prover. First, it receives the zero-knowledge proof generated by the prover. This proof typically contains the prover's claim of the validity of certain statements or operations, such as possessing a certain key or meeting certain conditions. Second, using the system's public parameters and the proof provided by the prover, it executes a verification algorithm to confirm the proof's validity. This process usually involves using the zero-knowledge proof system's security parameters and public key to ensure the proof has not been forged or tampered with. The verifier implements the proof verification process and provides a result indicating whether the verification passed or failed.
  • the role of the prover is to generate a proof that they possess certain information or meet certain conditions without revealing any specific details about that information or condition.
  • This proof can be used by the verifier, who can verify its validity using common parameters and a verification algorithm without needing to know the specifics behind the proof.
  • the prover constructs a polynomial problem by performing multiple rounds of NTT (number-theoretic transformation) computations, and then generates the proof through multiple rounds of MSM (method-based transformation) computations.
  • This invention focuses on optimizing the prover component in zero-knowledge systems. Specifically, it addresses the performance bottleneck of proof generation by improving the most time-consuming multi-scalar multiplication (MSM) operation during proof generation, thereby significantly improving the efficiency and response speed of proof generation.
  • MSM multi-scalar multiplication
  • the Pippenger algorithm (or bucket algorithm) is used to perform multi-scalar multiplication.
  • the core idea of the Pippenger algorithm is to decompose a high-bit-width MSM into multiple low-bit-width MSMs by fine-grained decomposition of scalars, thereby reducing the overall multiplication operations and improving computational efficiency.
  • the improvement proposed in this invention is based on the original Pippenger algorithm and aims to further optimize its performance.
  • the Pippenger algorithm framework is functionally divided into split window units, bucket-in-point reduction units, window-in-reduction units, and window aggregation units, each implementing its corresponding function.
  • Split window units are used to divide a binary scalar into windows of a certain number of bits, such as in Figure 4, where it is divided into 4-bit windows.
  • window splitting is to decompose the original large-scale multi-scalar multiplication operation into multiple subtasks, facilitating parallel computation using GPUs.
  • a fixed window c (c ⁇ ⁇ ) is selected based on the size of the original MSM, dividing the original ⁇ -bit scalar k ⁇ sub> i ⁇ /sub> into...
  • Each part i.e., a MSM of size ⁇ -bit, is decomposed into L MSMs of size c-bit (i.e., L subtasks), and the calculation formula is expressed as:
  • Q represents the result of multi-scalar multiplication
  • Gi is the i-th scalar multiplication term on the finite field of the elliptic curve.
  • Y ⁇ sub>j ⁇ /sub> represents the MSM of the j-th c-bit
  • k ⁇ sub> i ⁇ /sub> j represents the j-th part of the i-th scalar, i ⁇ [1,N],j ⁇ [1,L].
  • the optimal window size can be dynamically selected based on the specific GPU model, its computing power, and the initial scale of multi-scalar multiplications to achieve effective subtask partitioning.
  • Traditional methods typically evaluate the workload based on the number of simple point additions to determine the optimal window size.
  • Montgomery modular multiplication is the main computational step in point addition operations, its computational load directly affects the execution time of subtasks.
  • a more refined mechanism is introduced: dynamically adjusting the window size based on the required Montgomery modular multiplication computation within the window.
  • the dynamic window partitioning process is shown in Figure 5, and generally includes determining the initial window, task partitioning, pre-estimating the computational load, monitoring and feedback, and real-time window adjustment based on monitoring and feedback results.
  • the process of dynamically adjusting the window size mainly includes: estimating the required Montgomery modular multiplication computation before each subtask begins, and selecting the optimal window size based on this estimate to optimize execution efficiency.
  • the window size By monitoring the actual computational load of each subtask in real time and analyzing the data collected during actual execution, it is assessed whether the window size for the next subtask needs adjustment. For example, if the actual computational load is lower than the estimated value, the window size can be increased to improve execution efficiency and reduce resource idleness.
  • the system can dynamically adapt to different workloads and hardware environment changes, ensuring effective allocation of computing resources under various conditions, improving the efficiency of point addition operations and overall system performance.
  • Preprocessing tests and verifications can be performed before application to ensure that the selected window size selection strategy exhibits optimal performance and efficiency in real-world scenarios.
  • This method optimizes the execution efficiency of point addition operations and overall system performance, providing a more accurate and efficient processing method, particularly suitable for complex computational tasks.
  • the window size can be dynamically adjusted based on statistical analysis and machine learning models to further improve computational efficiency.
  • a trained machine learning model reflects the correspondence between one or more of the Montgomery modular multiplication computation, GPU resources, and window size.
  • the window size can be predicted and adjusted more accurately to maximize the utilization of GPU resources, thereby improving the efficiency of computational operations to adapt to different workloads and hardware environments.
  • the workload can be allocated more precisely, avoiding performance loss or resource waste caused by excessively large or small windows.
  • the window size is selected based on specific computing needs, it can be flexibly adjusted according to different application scenarios and hardware configurations, thereby achieving optimal operation under various conditions.
  • the in-bucket reduction unit is used to classify points on each elliptic curve finite field into buckets. For example, with a window size of c (i.e., each c bits represents a window), each window corresponds to an array of size 2c - 1, which is a bucket. For example, referring to Figure 4, after decomposing the scalar into 4-bit windows, points on each elliptic curve finite field can be classified into buckets covering the range 1-15. It should be noted that since the product of the bucket number 0 and the reduced bucket is zero, bucket number 0 can be considered as not being calculated.
  • in-bucket point reduction After selecting an appropriate window size, 2 ⁇ sup>c ⁇ /sup> - 1 buckets are initialized. Then, Gi is sequentially accumulated into the bucket corresponding to its coefficient k ⁇ sub>i,j ⁇ /sub>, and the result of each sub-MSM is calculated.
  • In-bucket point reduction enables parallel execution within the bucket.
  • the traditional Pippenger algorithm often fails to make reasonable use of GPU threads, resulting in some in-bucket threads being idle for a long time while others are overworked, leading to a decrease in the overall throughput and efficiency of the system.
  • a load balancing scheduling mechanism and a parallelization structure are designed according to the number of bucket points to ensure reasonable resource scheduling during the execution of the algorithm.
  • the number of points in each bucket is first counted. After all points have been placed, the thread allocation is dynamically adjusted based on the proportion of points in each bucket. Furthermore, during computation, the system monitors the number of points and computation progress in each bucket in real time. Once the computation task in a bucket is completed, the system collects data on the current state of all buckets. Based on the collected data, the system re-evaluates the dynamic thread allocation.
  • FIG. 6 which shows the intra-bucket parallel architecture
  • a tree structure is used for pairing operations to support reduction-parallel computation of nodes within the bucket. This structure not only effectively handles large-scale datasets but also enables efficient data communication and collaboration between different buckets, thereby further improving the algorithm's parallelization performance.
  • the parallelized architecture design enables more efficient computation during the bucket-based point reduction phase.
  • the dependencies between computational tasks can be effectively reduced, lowering the overall computational latency. This optimization is particularly important for the requirement of rapid proof generation in zero-knowledge proof generation, significantly shortening the time needed to generate proofs.
  • the bucket number (u) is multiplied by the bucket to be reduced ( Bj ), and then the buckets within the same window are accumulated and reduced into one bucket.
  • this invention uses the prefix sum concept for optimization. After a bucket is reduced, the reduction result can be incrementally updated to the accumulated sum of the previous window. This avoids recalculating the accumulated sum of the previous window from scratch for each calculation, instead achieving more efficient computation through incremental updates.
  • This method reduces the computational cost of reduction within a window to the original computational cost.
  • the specific algorithm is as follows: By starting the recording from the last bucket, when processing the reduction within the window, we only need to add the sum of the previous window to obtain the sum of the current window, which significantly improves the computational efficiency and reduces the complexity.
  • u represents the bucket number
  • [ Bj ] indicates that it is a bucket in Yj
  • Yj represents the MSM of the j-th c-bit that has been split.
  • Window aggregation units (or window reduction units) are used when the window size of each window is calculated. After taking the values, you can add them all together to get the final output of MSM.
  • the algorithm flow is optimized by the multiplication distribution rate.
  • the last window Y ⁇ sub> L ⁇ /sub> is multiplied by 2 ⁇ sup> c ⁇ /sup>, then accumulated to the second-to-last window, and then multiplied by 2 ⁇ sup>c ⁇ /sup> again, and so on, until the final window Y ⁇ sub>0 ⁇ /sub> is merged.
  • the window reduction is expressed as:
  • a trusted setup phase is essential. It defines the common parameters of the entire zero-knowledge system framework, including the choice of elliptic curves, generators, and other problem parameters. These parameters ensure network consistency and security.
  • the primary responsibility of the trusted device is to transform the circuit constraints of a specific problem, that is, to convert smart contracts or business logic into an R1CS format suitable for zero-knowledge proofs.
  • R1CS is a linear algebraic model expressing constraints, which allows complex computational logic to be transformed into a set of linear constraints. Optimizing this transformation process, such as reducing the number of unnecessary constraints, can significantly reduce the complexity of the proof, thereby reducing the time and resource consumption required to generate the proof.
  • the prover In the proof generation section, the prover first transforms the R1CS constraints into polynomial form using number-theoretic transformations (NTT), and then performs the calculations, i.e., multiple rounds of multi-scalar multiplication. This part is also the most computationally intensive for the prover, often accounting for about 75% of the entire proof generation process.
  • NTT number-theoretic transformations
  • this invention specifically optimizes it.
  • the optimization strategy involves decomposing the MSM to utilize the parallel processing capabilities of the GPU and improve computational efficiency.
  • the optimization scheme first subdivides the large-width MSM into multiple small-width MSMs in the split window unit, facilitating parallel processing by the GPU; and by dynamically adjusting the window size based on the estimated computational cost of Montgomery modular multiplication, it ensures the optimal partitioning of subtasks. Simultaneously, it utilizes real-time monitoring and feedback mechanisms to dynamically adjust the window size to adapt to different workloads and hardware environments.
  • a load-balanced scheduling mechanism is implemented, dynamically adjusting GPU threads according to the number of bucket points.
  • the algorithm optimizes GPU utilization and overall computational efficiency by using a tree structure to support parallel reduction operations for points within buckets.
  • the window-based reduction unit is optimized using prefix sums, reducing computational load and complexity through incremental updates, thus improving the computational efficiency of window-based reduction.
  • the window aggregation unit utilizes the multiplicative distributive law to optimize the algorithm flow, recursively merging window values until the final MSM output is obtained, significantly accelerating the proof generation process.
  • provers can significantly improve the speed of proof generation, especially when dealing with large-scale datasets and complex computational tasks, ensuring that the zero-knowledge proof system is more stable, real-time, and efficient in practical applications.
  • the final generated proof is submitted to the blockchain network, containing encrypted information confirming the validity of the transaction, but without revealing any substantial personal or financial details.
  • the present invention has the following advantages:
  • This invention can be a system, method, and/or computer program product.
  • a computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of the invention.
  • Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device.
  • Computer-readable storage media can be, for example, but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof.
  • RAM random access memory
  • ROM read-only memory
  • EPROM or flash memory erasable programmable read-only memory
  • SRAM static random access memory
  • CD-ROM compact disc read-only memory
  • DVD digital multifunction disc
  • the computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.
  • the computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing/processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and/or wireless network, to an external computer or external storage device.
  • the network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and/or edge servers.
  • a network adapter card or network interface in each computing/processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing/processing device.
  • the computer program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages such as Smalltalk, C++, Python, etc., and conventional procedural programming languages such as the "C" language or similar programming languages.
  • the computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server.
  • the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., using a network).
  • Internet service providers connect via the Internet.
  • electronic circuits such as programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), are personalized by utilizing state information from computer-readable program instructions. These electronic circuits can execute computer-readable program instructions to implement various aspects of the invention.
  • Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions/actions specified in one or more boxes of a flowchart and/or block diagram.
  • each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function.
  • the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Physics & Mathematics (AREA)
  • Computational Linguistics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Artificial Intelligence (AREA)
  • Complex Calculations (AREA)

Abstract

本发明公开一种通用的zk-SNARK零知识证明优化系统和方法。该系统包括：可信设备、证明者和验证者，其中证明者利用桶算法实现多标量乘法运算，证明者包含拆分窗口单元、桶内点规约单元、窗口内规约单元和窗口聚合单元，拆分窗口单元基于设定窗口将多标量乘法运算拆分为多个子任务，所述窗口根据蒙哥马利模乘计算量动态设定；桶内点规约单元将每个椭圆曲线有限域上的点规约到桶，获得每一个子任务的结果；窗口内规约单元用于将桶号点乘被规约的桶，并将同一窗口内的桶累加归约成一个桶，获得各窗口的窗口值；窗口聚合单元基于每个窗口的窗口值，得到多标量乘法的计算结果。本发明有效优化了多标量乘法的执行效率，有利于实现zk-SNARK证明生成过程的高效运行。

Description

一种通用的zk-SNARK零知识证明优化系统和方法 技术领域
本发明涉及计算机技术领域，更具体地，涉及一种通用的zk-SNARK零知识证明优化系统和方法。
背景技术
零知识证明(Zero Knowledge Proof，ZKP)是一种建立在双方或者多方认同上的密码学协议，主要作用是使证明者(Prover)在不向验证者(Verifier)暴露任何有用信息的情况下，使验证者相信证明者所提出来的某个陈述是正确的。
交互式零知识证明系统，即验证者向证明者提问，如果证明者知道该信息，答对的概率为1；若证明者不知道该信息，答对的概率为1/2。验证者通过足够多的提问可推定证明者是否知道该信息，同时需要保证这些提问及其相应的回答不会泄露相关的有用信息。这种技术使得一个NP问题能够在多项式时间内通过验证，而无需揭示任何与解的详细信息相关的数据。
非交互式零知识证明系统是一种密码学协议，允许证明者向验证者证明某个陈述为真，而无需进行多轮交互。在这种系统中，证明者可以通过一次性的信息传递向验证者展示证明，同时不泄露除了该陈述为真以外的其他信息。与交互式零知识证明系统不同，非交互式零知识证明系统中的证明者不需要等待验证者的挑战，并且只需发送一次证明即可完成整个证明过程。非交互式零知识证明系统的实现依赖于一些复杂的密码学技术，例如零知识证明的构造和离散对数等难题的应用。目前应用较广的两种非交互零知识证明实现方式为zk-STARK(零知识可扩展透明知识论证，Zero-Knowledge Scalable Transparent ARguments of Knowledge)以及zk-SNARK(零知识简洁非交互式知识论证，Zero-Knowledge Succinct  Non-interractive Argument of Knowledge)技术。
zk-STARK是一种最新的零知识证明系统，旨在高效、可扩展且透明地验证大规模计算的正确性，同时不泄露具体信息。它基于错误校正码和低秩编码，通过构建可验证的多项式实现，为确保计算过程的可靠性提供了强大的密码学解决方案。
zk-SNARK是现行的零知识证明协议中公认的可靠选择，旨在优化之前基于交互式证明的限制。它通过简洁的非交互式方式实现零知识性，避免了证明方与验证方之间的多次交互通信，并显著减少了通信成本，为信息安全领域提供了重要的技术进步。zk-SNARK主要的优势在于固定的证明大小减少了验证复杂度和通信复杂度，在交易数量增多时，这个优势表现得更加明显。但它需要额外设置验证密钥，尽管密钥可以预先生成，但当交易数量增多时，不可避免地会带来相应的存储和计算压力。
在现有的交互式零知识证明系统中，证明者和验证者在证明过程中需要进行多次挑战－响应通信，这种方式限制了证明的效率和适用性，因为每一轮通信只能传递少量的证明信息，且增加了整体的计算和通信成本。这种高频次的通信往往会产生显著的延迟和带宽消耗，特别是在需要进行大量证明或在网络条件较差的情况下。此外，由于需要多轮次的交互，证明者和验证者必须实现同时间在线并且能够完成实时通信。这对分布式系统或异步环境(如不同步的网络或离线设备)来说，是一个显著的限制。同步要求增加了协议实施的复杂性和不便。
zk-STARK尽管在安全性和透明性方面具有显著优势，但也存在一些显著缺点，包括计算和存储开销较大、生成的证明比较大以及验证时间较长等。这些因素导致zk-STARK在处理复杂计算任务时可能效率较低。此外，zk-STARK对数学基础有较高要求，增加了实现和部署的复杂性。由于这些限制，zk-STARK在大规模零知识证明系统中的应用面临挑战，尤其是在需要高效处理和快速验证的大规模分布式系统或区块链网络中，这些缺点可能会成为性能瓶颈，影响系统的整体可扩展性和实用性。
zk-SNARK在减少证明大小和验证时间方面表现突出，但存在可信设置问题、计算复杂性、硬件要求高以及透明性不足等多方面限制，这些因 素限制了其在大规模零知识证明系统中的应用。特别是可信设置阶段容易成为攻击目标，生成证明需要大量计算资源，硬件要求高昂，使得其在大规模系统中应用受到挑战。
尽管zk-SNARK存在一些不足，但它仍然是当前主流的零知识证明技术。这主要得益于其在证明大小和验证时间方面具有显著优势，使其在许多实际应用中表现出色且高效。相比之下，虽然zk-STARK有着更高的透明性和更低的可信设置要求，但其通常在计算复杂性和运行效率方面不如zk-SNARK。通过持续优化zk-SNARK的计算复杂性和运行效率，可以进一步巩固它作为零知识证明领域主导技术的地位，并推动该技术的广泛应用和发展。
zk-SNARK的证明生成过程主要依赖于数论变换(Number Theoretic Transformation,NTT)和多标量乘法(Multi-Scalar Multiplication,MSM)。根据现有研究表明，多标量乘法运算是zk-SNARK证明生成过程中的主要计算瓶颈，在zk-SNARK开源库Bellman中，MSM的执行时间通常占据了整个证明生成总时间的70％以上。因此，如何有效缩短以MSM为主的zk-SNARK证明生成过程是至关重要的提升方向。
多标量乘法是一种数学运算，是指对于给定的椭圆曲线上的点集合和标量集合，计算这些点与对应标量相乘再相加的运算过程，数学定义为：
其中，N是MSM的规模，Gi是椭圆曲线有限域上的点，ki是一个λ-bit的标量，kiGi表示椭圆曲线上点的标量乘法(PMULT)，PMULT中主要的计算是点加法(PADD)和点加倍(PDBL)。参见图1所示，椭圆曲线上的点加法操作可通过以下步骤实现：给定两点F和G，首先画出连接它们的直线，并找到曲线的第三个交点-H。然后，以-H为轴对称中心，将其关于X轴反射得到点H，这个H点即为F和Q的和。而对于点加倍操作，是将点G加到自身(即2G)时，需找到椭圆曲线在点G处的切线，确定切线与曲线的第三个交点，再以此点为轴对称中心进行X轴反射，反射得到的点即为2G。这种方法可以有效地计算椭圆曲线上点之间的加法。因此， 可以看出椭圆曲线上的点加法操作涉及椭圆曲线方程中的椭圆曲线斜率计算和交点求解等复杂运算，这会消耗大量的计算资源。所以为了提升零知识证明的生成效率，需要从减少椭圆曲线的计算量，提高运算效率入手。
在实际的标量乘法运算中，将从低位开始逐位扫描标量值，每次将当前结果翻倍，如果遇到的位是1，则加上对应的点值；如果遇到的位是0，则忽略。持续迭代直至处理完最高位。这种逐位运算方法可以高效地计算椭圆曲线上的标量乘法。图2是计算标量为23的椭圆曲线加法。可以看出，标量的位宽越大，点加倍和点加法的计算次数越多，点的标量乘法运算的计算量也越大。以区块链项目Filecoin为例，一个证明将包含数百万个标量和点集，其中标量位宽为256位。如果计算出每一个点的标量乘法的结果，然后再通过点加法相加来得到总的结果，将会产生巨大的计算时延。
此外，现有的零知识证明系统存在资源管理和调度困难以及负载不平衡等问题，在多任务环境中，高效地管理和调度GPU资源是一个具有挑战性的任务。在零知识证明生成过程中，任务分配和资源调度需要精细控制，以避免资源浪费和性能下降。并且，在资源管理方面，需要考虑如何平衡不同任务对GPU资源的需求。
综上，零知识证明技术的核心优势在于能够在不泄露私密数据的情况下，向他人证明信息的真实性。然而，现有的零知识证明技术面临的主要问题包括证明生成时间长、计算量大、成本高等问题。这些问题严重制约了零知识证明技术在区块链系统等领域的普及应用。尤其是在金融领域等对实时性要求较高的场景中，零知识证明的生成和验证时间的延迟可能会对交易的安全性和可靠性产生不利影响，从而导致负面后果。并且，长时间的证明生成也会增加计算资源的使用成本，降低系统的经济效益。
发明内容
本发明的目的是克服上述现有技术的缺陷，提供一种通用的zk-SNARK零知识证明优化系统和方法。
根据本发明的第一方面，提供一种通用的zk-SNARK零知识证明优化系统。该系统包括：可信设备、证明者和验证者，其中：
可信设备用于生成和管理该系统所需的安全参数，并生成和管理该系统中的密钥；
证明者利用桶算法实现多标量乘法运算，以生成证明，该多标量乘法运算是对于给定的椭圆曲线上的点集合和标量集合，计算点与对应标量相乘再相加的运算过程；
验证者用于将可信设备发送的密钥与证明者所生成的证明进行对比，以确认所述证明的有效性；
其中，所述证明者包含拆分窗口单元、桶内点规约单元、窗口内规约单元和窗口聚合单元，所述拆分窗口单元用于基于设定窗口将多标量乘法运算拆分为多个子任务，所述窗口的大小根据蒙哥马利模乘计算量动态设定；所述桶内点规约单元用于将每个椭圆曲线有限域上的点规约到桶，获得每一个子任务的结果；所述窗口内规约单元用于将桶号点乘被规约的桶，并将同一窗口内的桶累加归约成一个桶，获得各窗口的窗口值；所述窗口聚合单元用于基于获得的每个窗口的窗口值，得到多标量乘法的计算结果。
根据本发明的第二方面，提供一种通用的zk-SNARK零知识证明优化方法。该方法包括以下步骤：
生成和管理用于零知识证明的安全参数以及密钥；
利用桶算法实现多标量乘法运算，以生成证明，该多标量乘法运算是对于给定的椭圆曲线上的点集合和标量集合，计算点与对应标量相乘再相加的运算过程；
基于所述密钥与所生成的证明进行对比，以确认所述证明的有效性；
其中，根据以下步骤实现所述多标量乘法运算：
基于设定窗口将多标量乘法运算拆分为多个子任务，所述窗口的大小根据蒙哥马利模乘计算量动态设定；
将每个椭圆曲线有限域上的点规约到桶，获得每一个子任务的结果；
将桶号点乘被规约的桶，并将同一窗口内的桶累加归约成一个桶，获得各窗口的窗口值；
基于获得的每个窗口的窗口值，得到多标量乘法的计算结果。
与现有技术相比，本发明的优点在于，通过对零知识证明的发展以及 生成流程进行聚焦分析，在保证不影响证明生成的其他流程的基础上，设计优化算法和改进计算等来提升零知识证明的性能，缩短了证明生成的时间。例如，降低了多标量乘法的计算次数，提高了计算多标量乘法的计算效率，并设计一个动态分配资源和优先级调度的机制，可根据任务的特性和优先级，合理分配GPU核心、内存和带宽等资源，确保每个任务获得适量的资源，并尽量减少资源的闲置和浪费。利用本发明可有效优化多标量乘法的执行效率，以及探索其他尽可能地优化策略，能够实现zk-SNARK证明生成过程的高效运行。
通过以下参照附图对本发明的示例性实施例的详细描述，本发明的其它特征及其优点将会变得清楚。
附图说明
被结合在说明书中并构成说明书的一部分的附图示出了本发明的实施例，并且连同其说明一起用于解释本发明的原理。
图1是现有技术中椭圆曲线的运算示意图；
图2是现有技术中标量乘法的计算过程示意图；
图3是根据本发明一个实施例的零知识证明系统架构图；
图4是根据本发明一个实施例的Pippenger算法执行示意图；
图5是根据本发明一个实施例的动态窗口划分执行过程示意图；
图6是根据本发明一个实施例的桶内并行架构示意图。
具体实施方式
现在将参照附图来详细描述本发明的各种示例性实施例。应注意到：除非另外具体说明，否则在这些实施例中阐述的部件和步骤的相对布置、数字表达式和数值不限制本发明的范围。
以下对至少一个示例性实施例的描述实际上仅仅是说明性的，决不作为对本发明及其应用或使用的任何限制。
对于相关领域普通技术人员已知的技术、方法和设备可能不作详细讨论，但在适当情况下，所述技术、方法和设备应当被视为说明书的一部分。
在这里示出和讨论的所有例子中，任何具体值应被解释为仅仅是示例性的，而不是作为限制。因此，示例性实施例的其它例子可以具有不同的值。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步讨论。
以应用在区块链领域为例，零知识证明技术有效地解决了公开透明与个人隐私之间的矛盾，使得用户可以在区块链信息公开的特性下进行交易和数据传输，且无需担心泄露具体的交易详情或个人身份信息。通过证明自己符合交易规则或拥有特定资产，零知识证明技术确保了数据的隐私性和交易的安全性。零知识证明技术可应用于区块链隐私保护、数据隐私保护、身份认证以及数字版权保护等领域，为保护个人隐私、确保数据安全性提供了高效的解决方案。
图3是零知识证明系统的总体架构图。该系统中主要包含可信设备，验证者(或称验证者模块)以及证明者(或称证明者模块)。本发明主要针对证明者的功能进行优化。
可信设备负责生成和管理零知识证明系统所需的安全参数，例如椭圆曲线参数、素数、群的阶等。这些参数需足够随机和安全，以保证系统的安全性和抵抗攻击。此外，可信设备还用于生成和管理系统中的加密和签名密钥。这些密钥在证明的生成和验证过程中扮演着重要角色，确保证明的完整性和安全性。总体而言，可信设备针对待计算问题，生成电路约束，进而转换为约束向量，如R1CS(Rank-1 Constraint System)。
验证者的主要作用是将可信设备发送的密钥与证明者生成的证明进行对比。首先接收到由证明者生成的零知识证明。这个证明通常包含了证明者声称某些陈述或操作的有效性，如拥有某个密钥或满足某些条件。其次，使用系统的公共参数和证明者提供的证明，执行验证算法来确认证明的有效性。这个过程通常涉及使用零知识证明系统的安全参数和公钥，确保证明没有被伪造或篡改。验证者实现验证证明的过程，并给出验证通过或验证失败的结果。
证明者的作用是生成一个证明，证明自己掌握了某些信息或者满足了某些条件，同时又不泄露任何关于这些信息或条件的具体细节。这个证明可以被验证者使用，验证者可以通过使用公共参数和验证算法来确认证明的有效性，而不需要了解证明背后的具体内容。总体而言，证明者通过执行多轮NTT(数论变换)计算，构建多项式问题，进而通过多轮MSM计算，生成证明。
在零知识证明系统的发展中，主要影响其应用的问题之一是证明者生成证明的时间过长，导致证明存在一定的滞后性，影响了系统的稳定性和实时性。因此，本发明专注于优化零知识系统中的证明者部分。具体来说，通过提升证明生成过程中耗时最长的多标量乘法运算(MSM)，来解决证明生成的性能瓶颈，从而显著提高证明生成的效率和响应速度。
在一个实施例中，采用Pippenger算法(或称桶算法)执行多标量乘法运算。Pippenger算法的核心思想是通过对标量进行细粒度的拆解，将一个高位宽的MSM分解为多个低位宽的MSM，以减少总体的乘法运算，从而提高计算效率。本发明提出的改进基于原始Pippenger算法，旨在进一步优化其性能。具体而言，参见图4所示，针对证明者涉及的多标量乘法运算，将Pippenger算法框架根据功能划分为拆分窗口单元、桶内点规约单元、窗口内规约单元和窗口聚合单元等，分别实现对应的功能。
1、拆分窗口单元
拆分窗口单元用于将二进制标量分割成一定位数的窗口，例如在图4中，分割成4比特的窗口。
拆分窗口的目的是将原始的大规模多标量乘法运算拆解成多个子任务，方便使用GPU进行并行运算。首先，根据原始MSM的规模选定一个固定窗口c(c<λ)，将原始大小为λ-bit的标量ki划分成个部分，即一个规模为λ-bit的MSM被分解成L个规模为c-bit的MSM(即L个子任务)，计算公式表示为：
其中，Q表示多标量乘法的计算结果，Gi是椭圆曲线有限域上的第i 个标量点，Yj表示第j个c-bit的MSM，ki，j表示第i个标量的第j个部分，i∈[1,N]，j∈[1,L]。
在实际应用中，可根据具体GPU型号以及其算力和初始多标量乘法的规模来动态选择最优的窗口大小，以实现子任务的有效划分。传统方法通常基于简单的点加数量来评估工作负载，以此确定最佳窗口大小。考虑到蒙哥马利模乘作为点加运算中的主要计算步骤，其运算量直接影响到子任务的执行时间，在本发明一个实施例中，引入了更精细的机制，即根据窗口内所需的蒙哥马利模乘计算量来动态调整窗口大小，动态窗口划分过程如图5所示，总体包括确定初始化窗口、任务分割、预估计算量、监控和反馈、根据监控和反馈结果实时调整窗口等。
具体地，动态调整窗口大小的过程主要包括：在每个子任务开始前预估所需的蒙哥马利模乘计算量，并根据这一估算选择最优的窗口大小来优化执行效率。通过实时监控每个子任务的实际计算量，分析实际执行过程中收集的数据，评估是否需要调整下一个子任务的窗口大小。例如，如果实际计算量低于预估值，可以尝试增大窗口大小来提高执行效率，减少资源闲置。通过优化策略和实时调整，系统可以动态地适应不同的工作负载和硬件环境变化，确保在各种情况下都能有效地分配计算资源，提升点加运算的效率和整体系统性能。在应用之前可进行一定的预处理测试和验证，以确保所选的窗口大小选择策略能够在实际场景中表现出最佳的性能和效率。通过这种方法，能够优化点加运算的执行效率和整体系统性能，提供更精准和高效的处理方式，特别适用于复杂计算任务的应用场景。
在另一实施例中，可基于统计分析和机器学习模型，实现动态调整窗口大小，以进一步提升计算效率。例如，经训练的机器学习模型反映蒙哥马利模乘计算量、GPU资源中的一项或多项与窗口大小之间的对应关系。通过这种方式，可以实现更精确地预测和调整窗口大小，最大限度地利用GPU资源，从而提升计算运行的效率，以适应不同的工作负载和硬件环境。
综上，相比原Pippenger算法的固定窗口大小，通过在拆分窗口阶段采用更细粒度的机制，根据实际计算需求来调整窗口大小，可以更加精确地分配工作负载，避免过大或过小的窗口导致的性能损失或资源浪费。并 且，由于窗口大小的选择基于具体的计算需求，能够根据不同的应用场景和硬件配置进行灵活调整，从而在各种条件下都能实现最佳的运行状态。
2、桶内点规约单元
桶内点规约单元用于将每个椭圆曲线有限域上的点分类到桶中。例如，在窗口大小为c的情况下，即每c位为一个窗口，每个窗口对应一个大小为2c-1的数组，也就是桶(bucket)。例如，结合图4所示，将标量分解成4位的窗口后，可以将每个椭圆曲线有限域上的点分类到涵盖1-15范围的桶中。需要说明的是，由于桶号为0的桶点乘被规约的桶后，结果为零，因此可以视为0号桶不进行计算。
对于桶内点规约，在选择完合适的窗口大小后，初始化2c-1个桶，然后依次将Gi累加到与其系数ki,j相对应的桶中，计算出每一个子MSM的结果，通过桶内点规约可实现桶内并行执行。但传统的Pippenger算法往往因为不能合理使用GPU线程的缘故，使得部分桶内线程长时间处于空闲状态，而另一部分桶内线程却过度忙碌，从而导致系统整体的吞吐量和效率降低。
在本发明一个实施例中，针对Pippenger算法中的桶内点规约部分，根据桶内点的数量设计负载均衡的调度机制以及并行化结构，以保证算法在执行过程中资源的合理调度。
在考虑线程分配的情况时，传统算法通常根据固定的窗口大小平均分配GPU线程数，但由于每个桶内的点数量可能差异巨大，这导致了工作任务分布不均的问题。为了解决这一挑战，在本发明一个实施例中，首先通过统计每个桶中的点数量，在所有点放置完毕后，根据每个桶中点的比例动态调整线程的分配。此外，在计算过程中，系统实时监控每个桶中点的数量和计算进度。一旦某个桶中的计算任务完成，系统会收集有关所有桶当前状态的数据。基于收集到的数据，系统进行动态线程分配的重新评估。例如，分配更多线程给仍在处理大量点的桶，或者减少资源分配给已经完成计算的桶。上述过程会周期性重复，直到所有计算任务完成。这种循环迭代可以确保系统在处理复杂数据分布时能够动态地调整资源分配，以提高整体的计算效率和性能利用率。
这种方法能够有效地优化GPU的利用率，提升整体的计算效率。此 外，在实际执行任务时，进一步引入了一种新的并行结构，参见图6所示的桶内并行架构图，采用树形结构进行两两配对，以支持桶内点的规约并行运算。这种结构不仅能够有效地处理大规模的数据集合，而且能够在不同桶之间实现高效的数据通信和协作，从而进一步提升了算法的并行化性能。
综上，并行化结构的设计使得桶内点规约阶段的计算能够更加高效地执行。通过树形结构的两两配对并行运算，可以有效地减少计算任务之间的依赖关系，降低整体的计算延迟。这种优化对于零知识证明生成过程中需要快速生成证明的要求特别重要，能够显著缩短生成证明所需的时间。
3、窗口内规约单元
对于一个给定的窗口，当每个点都被分类到一个桶中后，就可以将所有点加起来，得到每个桶的一个点。对于每个窗口，用所有的桶值乘以它们的桶号，然后相加在一起，得到一个窗口值。
具体地，仍结合图4所示，将桶号(u)点乘被规约的桶(Bj)，然后将同一窗口内的桶累加归约成一个桶。针对窗口内规约的操作，本发明使用前缀和思想进行优化，当一个桶被归约后，可以将这个归约结果以增量方式更新到前一个窗口的累加和中，通过这种方式避免了每次计算都重新从头开始计算前一个窗口的累加和，而是通过增量更新实现更高效的计算。这种方式将窗口内归约的计算量减少为原计算量的具体算法如下：通过从最末尾的桶开始记录，使得在处理窗口内的归约时，只需简单地加上前一个窗口的累加和，即可得到当前窗口内的累加结果，从而显著提高了计算效率并降低了复杂度。
例如，窗口内规约的计算过程表示为：
其中，u表示桶号，[Bj]表示其是Yj中的桶，其中Yj表示被拆分的第j个c-bit的MSM。
4、窗口聚合单元
窗口聚合单元(或称为窗口规约单元)用于：当计算出每个窗口的窗 口值后，可以将它们全部相加，得到MSM的最终输出。
例如，仍结合图4所示，在窗口聚合单元中，通过乘法分配率来优化算法流程，用2c点乘最末窗口YL，之后累加到倒数第二个窗口，之后再用2c点乘合并后的窗口，如此递推，直到合并到最终的窗口Y0结束。具体地，窗口规约表示为：
其中，Q表示窗口规约结果，YL表示第L个窗口值。
为清楚起见，仍结合图3所示，描述本发明对于保证区块链交易安全性和高效性方面的作用。在零知识证明的生成流程中，一个可信设置阶段是必不可少的，它定义了整个零知识系统框架的公共参数，包括椭圆曲线的选择、生成元、以及其他问题参数，这些参数确保了网络一致性和安全性。可信设备的主要职责是对特定问题进行电路约束的转换，即将智能合约或业务逻辑转换为适合于零知识证明的R1CS格式。R1CS是一种表达约束的线性代数模型，它允许将复杂的计算逻辑转换为一组线性约束。优化这一转换过程，如减少不必要的约束数量，可以显著降低证明的复杂度，进而减少生成证明所需的时间和资源消耗。
在证明生成部分，证明者首先将R1CS约束通过数论变换(NTT)转为多项式形式，然后在对其进行求解运算，即进行多轮多标量乘法的计算，这部分也是证明者运算量最大的部分，往往占到了整个证明生成过程中的75％左右。鉴于MSM的重要性，本发明特别针对其进行了优化。优化策略在于将MSM分解，以便利用GPU的并行处理能力，提高计算效率。具体而言，优化方案首先在拆分窗口单元中将大位宽的MSM细分为多个小位宽的MSM，便于GPU并行处理；并通过动态调整窗口大小，依据蒙哥马利模乘的计算量预估，确保子任务的最优划分，同时利用实时监控和反馈机制，动态调整窗口大小以适应不同的工作负载和硬件环境。在桶内点规约单元，实现了负载均衡的调度机制，根据桶内点数量动态调整GPU线程 分配，结合树形结构支持桶内点的规约并行运算，优化GPU利用率和整体计算效率。窗口内规约单元则采用前缀和思想进行优化，通过增量更新的方式减少计算量和复杂度，提高窗口内归约的计算效率。最后，窗口聚合单元运用乘法分配律优化算法流程，递归合并窗口值直至得到最终的MSM输出，显著加速证明生成过程。通过这些综合优化措施，证明者能够大幅度提升证明生成的速度，特别是在处理大规模数据集和复杂计算任务时，确保了零知识证明系统在实际应用中更加稳定、实时且高效。最终生成的证明被提交至区块链网络，其中包含了证实交易有效性的加密信息，但未泄露任何实质性的个人或财务细节。区块链网络中的其他节点作为验证者，使用相同的公共参数密钥和验证算法检查证明的有效性，确认交易的合法性而无需知晓交易的具体数值。一旦证明通过验证，交易便被正式确认并永久记录在区块链上，形成了一个既快速又安全的交易确认过程，极大地提升了区块链技术在实际应用中的可行性和隐私保护水平。
需说明的是，尽管以功能单元形式描述了本发明所提供的系统，在实际应用中，这些单元也可以集成为硬件加速器或加速装置，嵌入带区块链节点以提升生成证明的计算效率。
综上，本发明对Pippenger算法进行了分析以及优化，有利于充分发挥GPU并行计算的优势，特别是在处理大规模多标量乘法运算时。Pippenger算法通过减少乘法运算的数量来降低多标量乘法的复杂度，对于每个桶内点的分配较多的情况尤为有效。首先，通过合理的工作量分配机制，确保GPU上的每个线程都能够得到充分利用，避免线程闲置，从而最大化并行性。其次，算法级别的优化如利用共享内存、减少数据传输等措施，进一步提高计算效率。这些优化措施不仅减少了算法的总体复杂度，还显著缩短了计算时间。通过将计算任务并行化处理，GPU能够同时处理多个乘法操作，与传统的CPU计算相比，显著提高了多标量乘法的执行速度。这种专业化的优化不仅适用于科学计算和数据处理领域，还对需要实时响应和高性能计算的应用场景尤为重要。
综上所述，相对于现有技术，本发明具有以下优势：
1)本发明提供了一套针对零知识证明系统证明生成速度的优化方案， 确保在维持零知识证明的安全性、完整性和保密性的前提下，显著提升了证明生成的速度，适用于当前使用zk-SNARK技术的系统，无需修改现有的证明生成流程和步骤。并且，设计了一种可以与现有zk-SNARK技术系统兼容的优化方案，专门针对多标量乘法计算的效率进行了提升。
2)本发明提供了一套对于Pippenger算法的分析机制，并对其算法流程进行改良，实现了对GPU性能的充分利用，加快了多标量乘法模块的计算。首先，设计了一种动态窗口选择算法，优化了Pippenger算法的拆分窗口阶段，合理分配大规模的多标量乘法运算，实现了显著的性能提升。进一步地，改进了Pippenger算法在桶内点规约阶段的资源分配策略，确保了GPU资源的有效利用，并设计了优化的计算结构，使其能够高效并行执行，从而加快了多标量乘法模块的计算速度。此外，通过重构窗口内桶规约和窗口规约的流程，引入了高效的前缀和算法，显著提升了计算的运行效率。这些改进在保持计算正确性的同时，有效减少了计算所需的时间和资源消耗。
3)本发明基于普遍的Pippenger算法，将多标量乘法定义分为四个部分，进行模块化拆分并分别进行优化。通过标量解耦，并利用GPU的并行化优势，使得多标量乘法能够执行并行化运算，从而减少了运算所需等待时间，提升了证明生成效率。
4)传统的Pippenger算法在桶内点规约阶段往往无法充分利用GPU的并行计算能力，导致大量线程闲置或者负载过高等待的情况。本发明通过设计工作负载的调度机制，根据每个桶中点的数量进行动态的线程分配，可以最大化地利用GPU的线程资源，避免线程的闲置，从而显著提升多标量乘法模块的计算效率。
5)经过多次测试验证，本发明能够满足预期设计指标，并且无需考虑具体的零知识证明方案和形式，可适配当前任意情况下的zk-SNARK零知识证明生成系统。
本发明可以是系统、方法和/或计算机程序产品。计算机程序产品可以包括计算机可读存储介质，其上载有用于使处理器实现本发明的各个方面的计算机可读程序指令。
计算机可读存储介质可以是可以保持和存储由指令执行设备使用的指令的有形设备。计算机可读存储介质例如可以是但不限于电存储设备、磁存储设备、光存储设备、电磁存储设备、半导体存储设备或者上述的任意合适的组合。计算机可读存储介质的更具体的例子(非穷举的列表)包括：便携式计算机盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、静态随机存取存储器(SRAM)、便携式压缩盘只读存储器(CD-ROM)、数字多功能盘(DVD)、记忆棒、软盘、机械编码设备、例如其上存储有指令的打孔卡或凹槽内凸起结构、以及上述的任意合适的组合。这里所使用的计算机可读存储介质不被解释为瞬时信号本身，诸如无线电波或者其他自由传播的电磁波、通过波导或其他传输媒介传播的电磁波(例如，通过光纤电缆的光脉冲)、或者通过电线传输的电信号。
这里所描述的计算机可读程序指令可以从计算机可读存储介质下载到各个计算/处理设备，或者通过网络、例如因特网、局域网、广域网和/或无线网下载到外部计算机或外部存储设备。网络可以包括铜传输电缆、光纤传输、无线传输、路由器、防火墙、交换机、网关计算机和/或边缘服务器。每个计算/处理设备中的网络适配卡或者网络接口从网络接收计算机可读程序指令，并转发该计算机可读程序指令，以供存储在各个计算/处理设备中的计算机可读存储介质中。
用于执行本发明操作的计算机程序指令可以是汇编指令、指令集架构(ISA)指令、机器指令、机器相关指令、微代码、固件指令、状态设置数据、或者以一种或多种编程语言的任意组合编写的源代码或目标代码，所述编程语言包括面向对象的编程语言—诸如Smalltalk、C++、Python等，以及常规的过程式编程语言—诸如“C”语言或类似的编程语言。计算机可读程序指令可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络—包括局域网(LAN)或广域网(WAN)—连接到用户计算机，或者，可以连接到外部计算机(例如利用因 特网服务提供商来通过因特网连接)。在一些实施例中，通过利用计算机可读程序指令的状态信息来个性化定制电子电路，例如可编程逻辑电路、现场可编程门阵列(FPGA)或可编程逻辑阵列(PLA)，该电子电路可以执行计算机可读程序指令，从而实现本发明的各个方面。
这里参照根据本发明实施例的方法、装置(系统)和计算机程序产品的流程图和/或框图描述了本发明的各个方面。应当理解，流程图和/或框图的每个方框以及流程图和/或框图中各方框的组合，都可以由计算机可读程序指令实现。
这些计算机可读程序指令可以提供给通用计算机、专用计算机或其它可编程数据处理装置的处理器，从而生产出一种机器，使得这些指令在通过计算机或其它可编程数据处理装置的处理器执行时，产生了实现流程图和/或框图中的一个或多个方框中规定的功能/动作的装置。也可以把这些计算机可读程序指令存储在计算机可读存储介质中，这些指令使得计算机、可编程数据处理装置和/或其他设备以特定方式工作，从而，存储有指令的计算机可读介质则包括一个制造品，其包括实现流程图和/或框图中的一个或多个方框中规定的功能/动作的各个方面的指令。
也可以把计算机可读程序指令加载到计算机、其它可编程数据处理装置、或其它设备上，使得在计算机、其它可编程数据处理装置或其它设备上执行一系列操作步骤，以产生计算机实现的过程，从而使得在计算机、其它可编程数据处理装置、或其它设备上执行的指令实现流程图和/或框图中的一个或多个方框中规定的功能/动作。
附图中的流程图和框图显示了根据本发明的多个实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或指令的一部分，所述模块、程序段或指令的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的 方框的组合，可以用执行规定的功能或动作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。对于本领域技术人员来说公知的是，通过硬件方式实现、通过软件方式实现以及通过软件和硬件结合的方式实现都是等价的。
以上已经描述了本发明的各实施例，上述说明是示例性的，并非穷尽性的，并且也不限于所披露的各实施例。在不偏离所说明的各实施例的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。本文中所用术语的选择，旨在最好地解释各实施例的原理、实际应用或对市场中的技术改进，或者使本技术领域的其它普通技术人员能理解本文披露的各实施例。本发明的范围由所附权利要求来限定。

Claims (10)

  1. 一种通用的zk-SNARK零知识证明优化系统，包括：可信设备、证明者和验证者，其中：
    可信设备用于生成和管理该系统所需的安全参数，并生成和管理该系统中的密钥；
    证明者利用桶算法实现多标量乘法运算，以生成证明，该多标量乘法运算是对于给定的椭圆曲线上的点集合和标量集合，计算点与对应标量相乘再相加的运算过程；
    验证者用于将可信设备发送的密钥与证明者所生成的证明进行对比，以确认所述证明的有效性；
    其中，所述证明者包含拆分窗口单元、桶内点规约单元、窗口内规约单元和窗口聚合单元，所述拆分窗口单元用于基于设定窗口将多标量乘法运算拆分为多个子任务，所述窗口的大小根据蒙哥马利模乘计算量动态设定；所述桶内点规约单元用于将每个椭圆曲线有限域上的点规约到桶，获得每一个子任务的结果；所述窗口内规约单元用于将桶号点乘被规约的桶，并将同一窗口内的桶累加归约成一个桶，获得各窗口的窗口值；所述窗口聚合单元用于基于获得的每个窗口的窗口值，得到多标量乘法的计算结果。
  2. 根据权利要求1所述的系统，其特征在于，所述拆分窗口单元根据以下公式将规模为λ-bit的多标量乘法运算拆分为多个子任务：
    其中，N表示多标量乘法规模，c是设定窗口，c<λ，Yj表示第j个c-bit的多标量乘法，ki，j表示第i个标量的第j个部分，i∈[1,N]，j∈[1,L]。
  3. 根据权利要求2所述的系统，其特征在于，所述拆分窗口单元根据以下步骤设定窗口：
    在每个子任务开始前预估所需的蒙哥马利模乘计算量，获得预估量；
    根据所述预估量选择对应的窗口大小执行子任务；
    实时监控每个子任务的实际计算量，并比较所述实际计算量与所述预 估量的差值，以决定是否调整下一个子任务的窗口大小。
  4. 根据权利要求2所述的系统，其特征在于，所述窗口内规约单元根据以下公式运算：
    其中，u表示桶号，[Bj]表示其是Yj中的桶。
  5. 根据权利要求4所述的系统，其特征在于，所述窗口聚合单元根据以下公式得到多标量乘法的计算结果：
    其中，YL表示第L个窗口作为最末窗口，Y0表示合并后的最后的窗口，Y1表示第1个窗口。
  6. 根据权利要求2所述的系统，其特征在于，所述拆分窗口单元根据以下步骤设定窗口：
    在每个子任务开始前预估所需的蒙哥马利模乘计算量，获得预估量；
    根据所述预估量选择对应的窗口大小执行子任务；
    实时监控每个子任务的实际计算量，计算所述实际计算量与所述预估量的差值；
    将所述差值输入到经训练的深度学习模型，以决定是否调整下一个子任务的窗口大小。
  7. 根据权利要求1所述的系统，其特征在于，所述桶内点规约单元执行以下过程：
    通过统计每个桶中的点数量，根据每个桶中点的比例动态调整线程的分配；
    在计算过程中，监控每个桶中点的数量和计算进度，并在某个桶中的计算任务完成时，收集所有桶当前状态的数据；
    基于收集到的数据，进行动态线程分配的重新评估。
  8. 根据权利要求7所述的系统，其特征在于，对于所述桶内点规约单元，采用树形结构进行两两配对，以执行桶内点的规约并行运算。
  9. 一种基于权利要求1至8任一项所述系统的通用的zk-SNARK零知识证明优化方法，包括以下步骤：
    生成和管理用于零知识证明的安全参数以及密钥；
    利用桶算法实现多标量乘法运算，以生成证明，该多标量乘法运算是对于给定的椭圆曲线上的点集合和标量集合，计算点与对应标量相乘再相加的运算过程；
    基于所述密钥与所生成的证明进行对比，以确认所述证明的有效性；
    其中，根据以下步骤实现所述多标量乘法运算：
    基于设定窗口将多标量乘法运算拆分为多个子任务，所述窗口的大小根据蒙哥马利模乘计算量动态设定；
    将每个椭圆曲线有限域上的点规约到桶，获得每一个子任务的结果；
    将桶号点乘被规约的桶，并将同一窗口内的桶累加归约成一个桶，获得各窗口的窗口值；
    基于获得的每个窗口的窗口值，得到多标量乘法的计算结果。
  10. 一种计算机可读存储介质，其上存储有计算机程序，其中，该计算机程序被处理器执行时实现根据权利要求9所述的方法的步骤。
PCT/CN2024/106195 2024-07-18 2024-07-18 一种通用的zk-SNARK零知识证明优化系统和方法 Pending WO2026016124A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2024/106195 WO2026016124A1 (zh) 2024-07-18 2024-07-18 一种通用的zk-SNARK零知识证明优化系统和方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2024/106195 WO2026016124A1 (zh) 2024-07-18 2024-07-18 一种通用的zk-SNARK零知识证明优化系统和方法

Publications (1)

Publication Number Publication Date
WO2026016124A1 true WO2026016124A1 (zh) 2026-01-22

Family

ID=98436680

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2024/106195 Pending WO2026016124A1 (zh) 2024-07-18 2024-07-18 一种通用的zk-SNARK零知识证明优化系统和方法

Country Status (1)

Country Link
WO (1) WO2026016124A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210266168A1 (en) * 2020-02-21 2021-08-26 Hong Kong Applied Science and Technology Research Institute Company Limited Zero knowledge proof hardware accelerator and the method thereof
CN116932991A (zh) * 2023-06-13 2023-10-24 北京航空航天大学 一种形式化的多标量乘法分析与计算加速方法
CN118157872A (zh) * 2024-03-12 2024-06-07 山东大学 一种基于gpu集群的零知识证明加速方法及系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210266168A1 (en) * 2020-02-21 2021-08-26 Hong Kong Applied Science and Technology Research Institute Company Limited Zero knowledge proof hardware accelerator and the method thereof
CN116932991A (zh) * 2023-06-13 2023-10-24 北京航空航天大学 一种形式化的多标量乘法分析与计算加速方法
CN118157872A (zh) * 2024-03-12 2024-06-07 山东大学 一种基于gpu集群的零知识证明加速方法及系统

Similar Documents

Publication Publication Date Title
Tchernykh et al. Towards understanding uncertainty in cloud computing with risks of confidentiality, integrity, and availability
US12200103B2 (en) System for simplifying executable instructions for optimised verifiable computation
Liu et al. Pianist: Scalable zkrollups via fully distributed zero-knowledge proofs
CN116034382B (zh) 垂直分区数据的隐私保护异步联邦学习
US10911219B2 (en) Hierarchical blockchain consensus optimization scheme
JP7811064B2 (ja) 方法、連合学習システム、およびコンピュータプログラム（圧縮埋め込みを用いた垂直連合学習）
JP2019512779A (ja) 離散的最適化を伴う問題を複数のより小さな下位問題に分解する方法及びシステム並びに問題を解くためのそれらの使用
CN111352609B (zh) 一种基于边缘计算的分布式外包模幂运算方法
Zhang et al. Understand waiting time in transaction fee mechanism: An interdisciplinary perspective
US11487736B2 (en) Blockchain transaction processing systems and methods
JP2025100540A (ja) プルーフオブワークブロックチェーンネットワークにおける非並列化マイニングのためのシステムおよび方法
Luo et al. Cross-cloud data privacy protection: Optimizing collaborative mechanisms of ai systems by integrating federated learning and llms
US12113896B1 (en) End-to-end hardware acceleration for ZKP from witness generation to proof generation
CN119070995B (zh) 一种通用的zk-SNARK零知识证明优化系统和方法
Bhatt et al. Coalesce: Economic and security dynamics of skill-based task outsourcing among team of autonomous llm agents
Zeng et al. Flbooster: A unified and efficient platform for federated learning acceleration
WO2026016124A1 (zh) 一种通用的zk-SNARK零知识证明优化系统和方法
JP7767707B2 (ja) 機械学習ベースの暗号解読
WO2025102696A1 (zh) 零知识证明生成方法、装置、设备及存储介质
JP6791820B2 (ja) ペアリング等式一括検証装置、ペアリング等式一括検証生成方法、プログラム
US12511424B2 (en) System and method for implementing a multi-attestation framework
CA3228793C (en) Machine learning based cryptanalysis
Das et al. Distributed-Prover Interactive Proofs
Nourmohammadi et al. SoK: The role of zero-knowledge proofs in building confidential and trustworthy AI
Tang et al. MIDAS: Load-balanced Metadata-outsourcing ID-embedded Data Auditing Scheme for Mobile Devices

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24947523

Country of ref document: EP

Kind code of ref document: A1