KR102704646B1 - Method for providing oracle service of blockchain network using zero-knowledge proof and aggregator terminal for using same - Google Patents

Abstract

The present invention relates to a method for providing an oracle service of a blockchain network using a zero-knowledge proof, wherein (a) each of a plurality of feeder terminals transmits, to the aggregator terminal, each of the feeder data including data proof values proving that each of the off-chain data corresponding to each of the commitments and each of the off-chain data corresponding to each of the encrypted data are identical, using each of the commitments generated using a commitment key generated by an aggregator terminal and each of the off-chain data, each of the encrypted data encrypted using a public key generated by the aggregator terminal, and each of the feeder zero-knowledge proof keys generated by referencing the commitment key generated by the aggregator terminal and the public key, the aggregator terminal stores the feeder data transmitted from each of the plurality of feeder terminals in a database, and obtains first to kth feeder data, wherein k is an integer greater than or equal to 1, stored in the database during a specific period according to a preset period. Step; and (b) the aggregator terminal, (i) using the i-th feeder zero-knowledge proof key, where i is an integer greater than or equal to 1 and less than or equal to k, to verify the i-th data proof value in each of the first to k-th feeder data, and decrypting the i-th encrypted data using a secret key corresponding to the public key to generate i-th decrypted data, thereby obtaining the first to k-th decrypted data, (ii) generating on-chain data by calculating the first to k-th decrypted data through a preset calculator, and generating a calculation proof value proving that the on-chain data was generated by calculating the first to k-th decrypted data by the calculator using the aggregator zero-knowledge proof key generated by referencing the commitment key and the preset calculator, and (iii) registering the on-chain data and the calculation proof value in a blockchain network.

Description

Method for providing oracle service of blockchain network using zero-knowledge proof and aggregator terminal using the same {METHOD FOR PROVIDING ORACLE SERVICE OF BLOCKCHAIN NETWORK USING ZERO-KNOWLEDGE PROOF AND AGGREGATOR TERMINAL FOR USING SAME}

The present invention relates to a method for providing an oracle service of a blockchain network using zero-knowledge proof and an aggregator terminal using the same, and more specifically, to a method for providing an oracle service of a blockchain network using zero-knowledge proof and an aggregator terminal using the same, which can improve the reliability of on-chain data by not disclosing off-chain data and proving that on-chain data was generated from off-chain data.

In the blockchain network field, an oracle refers to bringing data outside the blockchain network into the blockchain network or sending data inside the blockchain network to the outside, and plays a role in connecting an isolated blockchain ecosystem to the outside. In this case, data outside the blockchain network is called off-chain data, and off-chain data that enters the blockchain network is called on-chain data.

Blockchain network is a distributed ledger technology that makes data falsification almost impossible by creating a blockchain by linking blocks containing data into a chain, but data must enter the blockchain network to be managed by the blockchain. If data does not enter the blockchain network, or if falsification occurs in the process of entering the blockchain network, it is difficult to trust the data even if it is managed by the blockchain.

The process of data in the real world entering the blockchain network is not as easy as it seems. In order for off-chain data to change into on-chain data, an intermediary is needed to put the off-chain data into the blockchain network. The oracle problem is the question of how to trust this intermediary.

To solve this oracle problem, various methods are being introduced, and various solutions are being proposed to solve the blockchain oracle problem, such as making decisions through voting by digital asset owners, selecting the median of various data, or having a middleware that provides reliable data between the real world and the blockchain.

Examples of intermediaries currently providing oracle services include Oraclize, Chainlink, and iCash.

For example, Chainlink provides oracle services that allow other blockchain network services to use token prices by storing the token prices of centralized exchanges in smart contracts on the blockchain network, allowing many DeFi service providers to provide various services using the registered token prices. In the same way, companies currently providing oracle services provide reliability for on-chain data by storing off-chain data in smart contracts on the blockchain network and providing it as on-chain data.

However, in these conventional oracle services, the off-chain data is provided from a data feeder designated by the company providing the oracle service, and reliability is provided by disclosing the on-chain data for this, but reliability is not guaranteed as to whether the disclosed on-chain data is actually data provided by the data feeder, or whether the final processed on-chain data uses actual off-chain data received from the data feeder.

In order to ensure the reliability of whether the final processed on-chain data uses the actual off-chain data received from the data feeder, the off-chain data itself received from the data feeder can be disclosed. However, if the off-chain data is disclosed, there is a problem in that the reliability of the oracle service itself cannot be guaranteed because a front running attack using the off-chain data in advance is possible.

Therefore, the present applicant proposes a method to protect the off-chain data provided from the feeder while ensuring that the on-chain data providing the oracle service can be trusted to have been generated using the off-chain data.

The present invention aims to solve all of the problems described above.

In addition, another purpose of the present invention is to protect off-chain data provided from a feeder and to ensure the reliability of the off-chain data.

In addition, another purpose of the present invention is to ensure the reliability of on-chain data generated using off-chain data.

In addition, another purpose of the present invention is to protect off-chain data and to enable trustworthiness of on-chain data generated from off-chain data.

According to one embodiment of the present invention for achieving the above object, in a method for providing an oracle service of a blockchain network using a zero-knowledge proof, (a) each of a plurality of feeder terminals transmits, to the aggregator terminal, each of the feeder data including each of the data proof values proving that each of the off-chain data corresponding to each of the commitments and each of the off-chain data corresponding to each of the encrypted data are identical, using each of the commitments generated using the commitment key generated by the aggregator terminal and each of the off-chain data, each of the encrypted data encrypted using the public key generated by the aggregator terminal, and each of the feeder zero-knowledge proof keys generated by referencing the commitment key generated by the aggregator terminal and the public key, to the aggregator terminal, and the aggregator terminal stores the feeder data transmitted from each of the plurality of feeder terminals in a database, and stores first to k-th feeder data stored in the database for a specific period according to a preset period - k is 1 or more. A method is provided, comprising: (a) obtaining feeder data, wherein i is an integer; and (b) the aggregator terminal verifies an i-th data proof value using an i-th feeder zero-knowledge proof key, wherein i is an integer greater than or equal to 1 and less than or equal to k, of each of the first to k-th feeder data, and decrypts the i-th encrypted data using a secret key corresponding to the public key to generate i-th decrypted data, thereby obtaining the first to k-th decrypted data, (ii) generating on-chain data by calculating the first to k-th decrypted data using a preset calculator, and generating a calculation proof value proving that the on-chain data was generated by calculating the first to k-th decrypted data by the calculator using an aggregator zero-knowledge proof key generated by referencing the commitment key and the preset calculator, and (iii) registering the on-chain data and the calculation proof value on a blockchain network.

In the above embodiment, (a0) the step of the aggregator terminal generating the commitment key, the public key, and the aggregator zero-knowledge proof key, and registering the commitment key, the public key, and the aggregator zero-knowledge proof key in the blockchain network may be further included.

In the above embodiment, in the step (a), a specific feeder terminal among the plurality of feeder terminals may obtain the commitment key and the public key from the blockchain network to generate a specific commitment and specific encrypted data for specific off-chain data, generate a specific data proof value using a specific feeder zero-knowledge proof key generated by referencing the commitment key and the public key, and transmit specific feeder data including the specific commitment, the specific encrypted data, and the specific data proof value to the aggregator terminal.

In the above embodiment, the specific feeder zero-knowledge proof key is generated by the specific feeder terminal using the commitment key and the public key obtained from the blockchain network, and can be registered in the blockchain network by the specific feeder terminal.

In the above embodiment, the aggregator terminal may input a first security parameter to a first key generation module to generate the commitment key for key issuance for the calculator, input a second security parameter to a second key generation module to generate the secret key and the public key, and input the commitment key and the calculator to a third key generation module to generate the aggregator zero-knowledge proof key, and then register the commitment key, the public key, and the aggregator zero-knowledge proof key to the blockchain network.

In the above embodiment, in the step (b), the aggregator terminal can obtain the i feeder zero-knowledge proof key registered in the blockchain network by the i feeder terminal that transmitted the i feeder data from the blockchain network and verify the i data proof value.

In addition, according to another embodiment of the present invention, in an aggregator terminal providing an oracle service of a blockchain network using zero-knowledge proof, the aggregator terminal comprises: a memory storing instructions for providing an oracle service of a blockchain network using zero-knowledge proof; and a processor performing an operation for providing an oracle service of a blockchain network using zero-knowledge proof according to the instructions stored in the memory; , wherein the processor comprises: (I) a process for transmitting, to the aggregator terminal, each of the plurality of feeder terminals, each of the commitments generated using the commitment key generated by the aggregator terminal and each of the off-chain data, each of the encrypted data encrypted using the public key generated by the aggregator terminal, and each of the data proof values proving that the respective off-chain data corresponding to the respective commitments and the respective off-chain data corresponding to the respective encrypted data are identical, using each of the feeder zero-knowledge proof keys generated by referencing the commitment key generated by the aggregator terminal and the public key, thereby storing the feeder data transmitted from each of the plurality of feeder terminals in a database, and obtaining the first feeder data to the kth feeder data, wherein k is an integer greater than or equal to 1, stored in the database for a specific period according to a preset period, and (II) (i) a process for transmitting the first feeder data feeder to the kth feeder data, wherein the first feeder data feeder to the kth feeder data, wherein the k is an integer greater than or equal to 1, In each of the kth feeder data, an aggregator terminal is provided that verifies the proof value of the i-th data using the i-th -wherein i is an integer greater than or equal to 1 and less than or equal to k - feeder zero-knowledge proof key, decrypts the i-th encrypted data using a secret key corresponding to the public key to generate i-th decrypted data, thereby obtaining the first decrypted data to the kth decrypted data, (ii) generates on-chain data by calculating the first decrypted data to the k-th decrypted data using a preset calculator, and generates a calculation proof value proving that the on-chain data was generated by calculating the first decrypted data to the k-th decrypted data by the calculator using an aggregator zero-knowledge proof key generated by referencing the commitment key and the preset calculator, and (iii) registers the on-chain data and the calculation proof value to a blockchain network.

In the above embodiment, the processor may further perform a process of generating the commitment key, the public key, and the aggregator zero-knowledge proof key before the (I) process, and registering the commitment key, the public key, and the aggregator zero-knowledge proof key to the blockchain network.

In the above embodiment, the processor may cause a specific feeder terminal, which is one of the plurality of feeder terminals, in the (I) process, to obtain the commitment key and the public key from the blockchain network to generate a specific commitment and specific encrypted data for specific off-chain data, generate a specific data proof value using a specific feeder zero-knowledge proof key generated by referencing the commitment key and the public key, and transmit specific feeder data including the specific commitment, the specific encrypted data, and the specific data proof value to the aggregator terminal.

In the above embodiment, the specific feeder zero-knowledge proof key is generated by the specific feeder terminal using the commitment key and the public key obtained from the blockchain network, and can be registered in the blockchain network by the specific feeder terminal.

In the above embodiment, the processor may input a first security parameter to a first key generation module to generate the commitment key for key issuance for the calculator, input a second security parameter to a second key generation module to generate the secret key and the public key, input the commitment key and the calculator to a third key generation module to generate the aggregator zero-knowledge proof key, and then register the commitment key, the public key, and the aggregator zero-knowledge proof key to the blockchain network.

In the above embodiment, the processor can verify the i data proof value by obtaining the i feeder zero-knowledge proof key registered in the blockchain network by the i feeder terminal that transmitted the i feeder data in the (II) process from the blockchain network.

In addition, a computer-readable recording medium for recording a computer program for executing the method of the present invention is further provided.

According to the present invention, the following effects are achieved.

The present invention protects off-chain data provided from a feeder and ensures the reliability of the off-chain data.

In addition, the present invention can ensure the reliability of on-chain data generated using off-chain data.

Additionally, the present invention protects off-chain data and makes it possible to trust that on-chain data was generated from off-chain data.

Figure 1 schematically illustrates a system that provides an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention.
FIG. 2 schematically illustrates the process of generating and registering a key in a method for providing an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention.
FIG. 3 schematically illustrates a process in which a feeder terminal transmits off-chain data in a method for providing an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention.
FIG. 4 schematically illustrates a process in which an aggregator terminal provides off-chain data provided by a feeder terminal as on-chain data in a method for providing an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention.

The detailed description of the present invention set forth below refers to the accompanying drawings which illustrate specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention, while different from one another, are not necessarily mutually exclusive. For example, specific shapes, structures, and features described herein may be implemented in other embodiments without departing from the spirit and scope of the invention. It should also be understood that the positions or arrangements of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the invention. Accordingly, the following detailed description is not intended to be limiting, and the scope of the present invention is defined only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if appropriately described. Like reference numerals in the drawings designate the same or similar functionality throughout the several aspects.

Hereinafter, in order to enable a person having ordinary skill in the art to easily carry out the present invention, preferred embodiments of the present invention will be described in detail with reference to the attached drawings.

FIG. 1 schematically illustrates a system that provides an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention. Referring to FIG. 1, a system (1000) may include a plurality of feeder terminals (100_1, 100_2, ..., 100_n), an aggregator terminal (200), and a blockchain network (300).

First, each of the plurality of feeder terminals (100_1, 100_2, ..., 100_n) uses the commitment key and public key generated by the aggregator terminal (200) to generate a commitment and encrypted data for the off-chain data, generate a data proof value for zero-knowledge proof, and transmit feeder data including the commitment, encrypted data, and data proof value, and may include all devices that provide various information generated in the real world, such as IoT devices, databases, PCs, mobile computers, PDAs/EDAs, cell phones, smartphones, tablets, information provision servers, data collection bots, artificial intelligence, etc., or analysis/statistical data using these. At this time, the off-chain data may include all information generated in the real world or generated using these, such as analysis information, statistical information, and sensing information analyzed from various types of information, such as voting information, price information, payment information, logistics information, and news. In addition, each of the plurality of feeder terminals (100_1, 100_2, ..., 100_n) may include a memory storing instructions for providing an oracle service of a blockchain network using zero-knowledge proof, and a processor performing an operation for providing an oracle service of a blockchain network using zero-knowledge proof according to the instructions stored in the memory.

Specifically, each of the plurality of feeder terminals (100_1, 100_2, ..., 100_n) may achieve a desired system performance by typically utilizing a combination of a computing device (e.g., a device that may include a computer processor, memory, storage, input devices and output devices, and other components of a conventional computing device; an electronic communication device such as a router, a switch, and the like; an electronic information storage system such as a network attached storage (NAS) and a storage area network (SAN)) and computer software (i.e., instructions that cause the computing device to function in a particular manner).

The communication unit of such a computing device can send and receive requests and responses with other computing devices to which it is connected. As an example, such requests and responses may be made through the same TCP session, but are not limited thereto. For example, they may be sent and received as UDP datagrams.

Additionally, the processor of the computing device may include hardware configurations such as a Micro Processing Unit (MPU) or a Central Processing Unit (CPU), cache memory, and data bus. Additionally, it may further include software configurations of an operating system and an application that performs a specific purpose.

Next, the aggregator terminal (200) decrypts and operates encrypted data transmitted by a plurality of feeder terminals (100_1, 100_2, ..., 100_n) to generate on-chain data, and registers the on-chain data and the operation proof value for zero-knowledge proof in the blockchain network (300), thereby providing an oracle service. The aggregator terminal (200) may include, but is not limited to, a server, a PC, a mobile computer, a PDA/EDA, a mobile phone, a smartphone, a tablet, etc., and may include all devices that perform computing operations. In addition, the aggregator terminal (200) may include a memory in which instructions for providing an oracle service of a blockchain network using zero-knowledge proof are stored, and a processor that performs an operation for providing an oracle service of a blockchain network using zero-knowledge proof according to the instructions stored in the memory.

Specifically, the aggregator terminal (200) may typically use a combination of computing devices (e.g., devices that may include computer processors, memory, storage, input devices and output devices, and other components of conventional computing devices; electronic communication devices such as routers, switches, and the like; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause the computing devices to function in a particular manner) to achieve desired system performance.

The communication unit of such a computing device can send and receive requests and responses with other computing devices to which it is connected. As an example, such requests and responses may be made through the same TCP session, but are not limited thereto. For example, they may be sent and received as UDP datagrams.

Additionally, the processor of the computing device may include hardware configurations such as a Micro Processing Unit (MPU) or a Central Processing Unit (CPU), cache memory, and data bus. Additionally, it may further include software configurations of an operating system and an application that performs a specific purpose.

Next, the blockchain network (300) is implemented by a number of blockchain nodes and may be an entity that performs data distribution processing by recording a blockchain that links blocks of data into a chain in a distributed ledger.

A method for providing an oracle service of a blockchain network using zero-knowledge proof through a system providing an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention configured as described above is described as follows.

First, referring to FIG. 2, the process of generating keys for use in zero-knowledge proof in a method for providing an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention is described as follows.

In order to provide an oracle service of a blockchain network using zero-knowledge proof, an aggregator terminal (200) can generate a commitment key, a private key, a public key, and an aggregator zero-knowledge proof key (S11).

That is, the aggregator terminal (200) can generate a commitment key by inputting a first security parameter into a first key generation module, generate a secret key and a public key by inputting a second security parameter into a second key generation module, and generate an aggregator zero-knowledge proof key by inputting a commitment key and a preset calculator into a third key generation module. At this time, the first security parameter and the second security parameter may be security parameters generated for key generation for the preset calculator, and the first security parameter and the second security parameter may be different security parameters or may be the same security parameters.

For example, the first key generation module may be a key generation algorithm of PVC (Pedersen Vector Commitment), and may input a security parameter (λ) into the PVC key generation algorithm to output a commitment key (CK).

PVC. Keygen(λ) -> (CK)

However, the first key generation module in the present invention is not limited to PVC, and key generation modules in various commitment schemes for zero-knowledge proof can be used.

And, the second key generation module can be a key generation algorithm of Elgamal encryption, and can input a security parameter (λ) into the following Elgamal key generation algorithm to output a public key (PK) and a private key (SK).

Elgamal. Keygen(λ) -> (PK, SK)

However, the second key generation module in the present invention is not limited to Elgamal encryption, and can use a key generation module in various encryption algorithms that encrypt and decrypt data using an asymmetric key of a public key and a private key.

In addition, the third key generation module can be a key generation algorithm of CP-SNARK (simulation-extractable commit and prove succinct non-interactive argument of knowledge), and a commitment key (CK) and a computation unit (R) can be input into the following CP-SNARK key generation algorithm to output an aggregator zero-knowledge proof key (CRSa).

CP-SNARK. Keygen(CK, R) -> CRSa

However, the third key generation module in the present invention is not limited to CP-SNARK, and can use a key generation module in various zero-knowledge proof algorithms that can generate a proof value for zero-knowledge proof and verify it.

At this time, the operator is an operator for processing off-chain data to generate on-chain data, and may include an operation module or operation logic for converting off-chain data into on-chain data.

For example, the calculator may be a function that calculates representative values that numerically represent the characteristics of off-chain data, such as the mean, median, mode, range, interquartile range, variance, and standard deviation of off-chain data. In addition, the calculator may be a function that uses sales information of products by region to statistically analyze inventory information of products by region. In addition, the calculator may be a function that generates prediction information that predicts a specific result using information such as news and Internet sites. However, in the present invention, the calculator is not limited to these functions, and may include various functions that process real-world information to generate a specific type of information.

Thereafter, the aggregator terminal (200) can register the generated commitment key, public key, and aggregator zero-knowledge proof key to the blockchain network (300) (S12).

At this time, the aggregator terminal (200) can broadcast a transaction including a commitment key, a public key, and an aggregator zero-knowledge proof key to the blockchain network (300), or can broadcast transactions including each of the commitment key, the public key, and the aggregator zero-knowledge proof key to the blockchain network (300), and accordingly, a block is generated by a distributed consensus of blockchain nodes constituting the blockchain network (300), and the generated block is added to the blockchain of the distributed ledger, so that the commitment key, the public key, and the aggregator zero-knowledge proof key can be registered in the blockchain network (300).

Meanwhile, a specific feeder terminal (100_1), which is one of a plurality of feeder terminals (100_1, 100_2, ..., 100_n), can obtain a commitment key and a public key from the blockchain network (300) (S13) and generate a specific feeder zero-knowledge proof key (S14) using the obtained commitment key and public key. At this time, the specific feeder terminal (100_1) may be an authorized party agreed to provide off-chain data. In addition, although the specific feeder terminal (100_1) obtains the commitment key and the public key from the blockchain network (300), it may also obtain the commitment key and the public key directly from the aggregator terminal (200).

At this time, a specific feeder terminal (100_1) can generate a specific feeder zero-knowledge proof key by inputting a commitment key and a public key into the third key generation module.

For example, the third key generation module can be a key generation algorithm of CP-SNARK (simulation-extractable commit and prove succinct non-interactive argument of knowledge), and can input a commitment key (CK) and a public key (PK) into the CP-SNARK key generation algorithm to output a specific feeder zero-knowledge proof key (CRSf).

CP-SNARK. Keygen(CK, PK) -> CRSf

However, the third key generation module in the present invention is not limited to CP-SNARK, and can use a key generation module in various zero-knowledge proof algorithms that can generate a proof value for zero-knowledge proof and verify it.

Thereafter, a specific feeder terminal (100_1) can register (S15) a specific feeder zero-knowledge proof key generated by referencing the commitment key (CK) and public key (PK) generated by the aggregator terminal (200) in the blockchain network (300).

At this time, a specific feeder terminal (100_1) can broadcast a transaction including a specific feeder zero-knowledge proof key to the blockchain network (300), and accordingly, a block is generated by a distributed consensus of blockchain nodes constituting the blockchain network (300), and the generated block is added to the blockchain of the distributed ledger, thereby allowing the specific feeder zero-knowledge proof key to be registered in the blockchain network (300).

Through this, a commitment key, a public key, an aggregator zero-knowledge proof key, and feeder zero-knowledge proof keys for each of a plurality of feeder terminals required to provide an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention can be registered in the blockchain network (300).

Next, referring to FIG. 3, the process of a feeder terminal transmitting off-chain data in a method for providing an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention is described as follows.

According to the description with reference to FIG. 2, in a state where a commitment key, a public key, an aggregator zero-knowledge proof key, and a feeder zero-knowledge proof key are registered, each of a plurality of feeder terminals (100_1, 100_2, ..., 100_n) can transmit, to the aggregator terminal (200), each of the commitments generated using the commitment key generated by the aggregator terminal (200) and each of the off-chain data, each of the encrypted data encrypted using the public key generated by the aggregator terminal (200), and each of the feeder zero-knowledge proof keys generated with reference to the commitment key and the public key generated by the aggregator terminal (200), each of the feeder data including the respective data proof values proving that the respective off-chain data corresponding to the respective commitments and the respective off-chain data corresponding to the respective encrypted data are identical.

This is explained with reference to a specific feeder terminal (100_1) among multiple feeder terminals (100_1, 100_2, ..., 100_n) as follows.

A specific feeder terminal (100_1) that wants to provide off-chain data to an aggregator terminal can obtain (S21) a commitment key and a public key generated and registered by an aggregator terminal (200) from a blockchain network (300). At this time, the specific feeder terminal (100_1) obtains the commitment key and the public key from the blockchain network (300), but, alternatively, the commitment key and the public key may be obtained from the aggregator terminal (200), or the commitment key and the public key obtained from the blockchain network (300) may be used as they are to generate a specific feeder zero-knowledge proof key.

And, a specific feeder terminal (100_1) can generate a specific commitment and specific encrypted data for specific off-chain data (S22) using a commitment key and a public key, respectively.

Specifically, a specific feeder terminal (100_1) can input a commitment key and specific off-chain data into a commitment generation module to generate a specific commitment, and can input a public key and specific open-chain data into an encryption module to generate specific encrypted data.

For example, the commitment generation module can be a PVC commitment generation algorithm, and can input a commitment key (CK) and specific off-chain data (M) into the PVC commitment generation algorithm to output a specific commitment (CM).

PVC. Commit(CK, M) -> (CM, O), O is the commitment open value

However, the commitment generation module in the present invention is not limited to PVC, and a commitment generation module in various commitment schemes for zero-knowledge proof can be used.

And, the encryption module can be an encryption algorithm of Elgamal encryption, and can input a public key (PK) and specific off-chain data (M) into the following Elgamal encryption algorithm to output specific encrypted data (CT).

Elgamal. Enc(PK, {M, O}) -> (CT, r), where r is the random value used in the ciphertext.

However, the encryption module in the present invention is not limited to Elgamal encryption, and an encryption module in various encryption algorithms that encrypt and decrypt data using an asymmetric key of a public key and a private key can be used.

Thereafter, a specific feeder terminal (100_1) can generate a specific data proof value using a specific feeder zero-knowledge proof key (S23). That is, a specific feeder terminal (100_1) can generate a specific data proof value proving that specific off-chain data corresponding to a specific commitment and specific encrypted data are the same. To explain this in more detail, a specific feeder terminal (100_1) can generate a specific data proof value proving that specific off-chain data used to generate a specific commitment and specific off-chain data used to generate specific encrypted data are the same.

At this time, a specific feeder terminal (100_1) can input a specific feeder zero-knowledge proof key, a specific commitment, specific off-chain data, and specific encrypted data into the zero-knowledge proof module to generate a specific data proof value.

For example, the zero-knowledge proof module can be a zero-knowledge proof module of CP-SNARK, and a specific feeder zero-knowledge proof key (CRSf), a specific commitment (CM), specific off-chain data (M), and specific encrypted data (CT) can be input into the CP-SNARK zero-knowledge proof module to output a specific data proof value (π1).

CP-SNARK. Prove(CRSf, {CM, M, O}, {CT, M, r}) -> π1

However, the zero-knowledge proof module in the present invention is not limited to CP-SNARK, and a zero-knowledge proof module in various zero-knowledge proof algorithms that can generate a proof value for zero-knowledge proof and verify it can be used.

And, a specific feeder terminal (100_1) can transmit specific feeder data including a specific commitment, specific encrypted data, and specific data authentication value to an aggregator terminal (200) (S24).

Through this, each of the feeder terminals (100_1, 100_2, ..., 100_n) can ensure that each of the off-chain data is not disclosed and that each of the encrypted data is generated from each of the off-chain data.

Then, the aggregator terminal (200) can store specific feeder data transmitted from a specific feeder terminal (100_1), i.e., specific feeder data including a specific commitment, specific encrypted data, and specific data authentication value, in a database.

At this time, the database may be implemented as a data storage corresponding to the aggregator terminal (200), a public distributed file system such as IPFS (InterPlanetary File System), or a blockchain network (300), but the present invention is not limited thereto, and may be implemented as various storages providing a TEE (Trusted Execution Environment).

Meanwhile, in the above, a specific feeder terminal (100_1) transmits specific feeder data to an aggregator terminal (200) and the aggregator terminal (200) stores the specific feeder data in a database. However, in contrast, a specific feeder terminal (100_1) may store specific feeder data in a database and the aggregator terminal (200) may use specific feeder data stored in the database, or a specific feeder terminal (100_1) may register specific feeder data in a blockchain network (300) and the aggregator terminal (200) may use specific feeder data registered in the blockchain network (300). For example, when a specific feeder terminal (100_1) registers specific feeder data to a blockchain network (300), the specific feeder terminal (100_1) can broadcast a transaction, which is specific feeder data including a specific commitment, specific encrypted data, and specific data proof value, to the blockchain network (300), and accordingly, a block is generated by a distributed consensus of blockchain nodes constituting the blockchain network (300), and the generated block is added to the blockchain of the distributed ledger, so that the specific commitment, specific encrypted data, and specific data proof value can be registered in the blockchain network (300).

Next, referring to FIG. 4, a method for providing an oracle service of a blockchain network using zero-knowledge proof according to one embodiment of the present invention, in which an aggregator terminal registers off-chain data registered by a feeder terminal as on-chain data in a blockchain network, will be described as follows.

According to the description of FIG. 3, in a state where each of the plurality of feeder terminals (100_1, 100_2, ..., 100_n) generates each of the commitments using the commitment key and each of the off-chain data, each of the encrypted data that encrypts each of the off-chain data using the public key, and each of the feeder data that includes each of the data proof values that prove that the each of the commitments and the each of the encrypted data are identical using the respective feeder zero-knowledge proof keys, the aggregator terminal (200) can obtain the first to kth feeder data stored in the database for a specific period according to a preset period. k can be an integer greater than or equal to 1.

And, the aggregator terminal (200) can obtain the i-th commitment, the i-th encrypted data, and the i-th data proof value from each of the first to k-th feeder data, i.e., the i-th feeder data (S31). i can be an integer greater than or equal to 1 and less than or equal to k.

Thereafter, the aggregator terminal (200) verifies the i-th data proof value using the i-th feeder zero-knowledge proof key, decrypts the i-th encrypted data using the secret key corresponding to the public key, and generates the i-th decrypted data, thereby performing the process for i being an integer greater than or equal to 1 and less than or equal to k, thereby obtaining the first decrypted data to the k-th decrypted data (S32). However, in FIG. 4, for the sake of convenience of explanation, only “i” is mentioned, but it should be understood that this is explained for each of 1 to k.

That is, when the first feeder zero-knowledge proof key to the kth feeder zero-knowledge proof key corresponding to the first feeder data to the kth feeder data, respectively, are referred to as the i-th feeder zero-knowledge proof key, the aggregator terminal (200) may obtain the i-th feeder zero-knowledge proof key from the blockchain network (300) and input the i-th feeder zero-knowledge proof key, the i-th encrypted data, the i-th commitment, and the i-th data proof value into the zero-knowledge verification module to verify the i-th data proof value.

For example, the zero-knowledge verification module can be a zero-knowledge verification module of CP-SNARK, and the i-th feeder zero-knowledge proof key (CRSf_i), the i-th encrypted data (CT_i), the i-th commitment CM_i), and the i-th data proof value (π1_i) can be input into the following CP-SNARK zero-knowledge verification module to output a data proof value (0/1). At this time, if the data proof value is 1, the data proof value can be determined to be true, and if the data proof value is 0, the data proof value can be determined to be false.

CP-SNARK. Verify(CRSf_i, CT_i, CM_i, π1_i) -> 0/1

However, the zero-knowledge verification module in the present invention is not limited to CP-SNARK, and a zero-knowledge verification module in various zero-knowledge proof algorithms that can generate a proof value for zero-knowledge proof and verify it can be used.

And, the aggregator terminal (200) can input the i-th encrypted data corresponding to the data proof value verified as true to the decryption module to generate the i-th decrypted data.

For example, the decryption module may be a decryption algorithm of Elgamal encryption, and may input a secret key (SK) and the i-th encrypted data (CT_i) into the following Elgamal decryption algorithm to output the i-th decrypted data (m_i).

Elgamal. Dec(SK, CT_i) -> (m_i, O_i)

However, the decryption module in the present invention is not limited to Elgamal encryption, and can use a decryption module in various encryption algorithms that encrypt and decrypt data using an asymmetric key of a public key and a private key.

Thereafter, the aggregator terminal (200) can generate on-chain data (S33) by calculating the i-th decrypted data, i.e., the first decrypted data to the k-th decrypted data, through a preset calculator.

At this time, the aggregator terminal (200) can input the i-th decrypted data (m_i) into a preset calculation unit and perform a preset calculation using the i-th decrypted data (m_i) by the following calculation algorithm (R) to output the on-chain data (OUT).

R({m_i}) -> OUT, W, W is the secret value (witness) used in the operation

In addition, the aggregator terminal (200) can generate an operation proof value (S34) proving that the on-chain data was generated by calculating the first decrypted data to the kth decrypted data by a preset calculation unit using the aggregator zero-knowledge proof key.

At this time, the aggregator terminal (200) can input the aggregator zero-knowledge proof key, the i-th commitment, the i-th decryption data, and the on-chain data into the zero-knowledge proof module to generate an operational proof value.

For example, the zero-knowledge proof module can be a zero-knowledge proof module of CP-SNARK, and the aggregator zero-knowledge proof key (CRSa), the i-th commitment (CM_i), the i-th decrypted data (M_i), and the on-chain data (OUT) can be input into the following CP-SNARK zero-knowledge proof module to output the computational proof value (π2).

CP-SNARK. Prove(CRSa, {CM_i, M_i, O_i}, OUT:W) -> π2

However, the zero-knowledge proof module in the present invention is not limited to CP-SNARK, and a zero-knowledge proof module in various zero-knowledge proof algorithms that can generate a proof value for zero-knowledge proof and verify it can be used.

Additionally, the aggregator terminal (200) can register (S35) on-chain data and computational proof values to the blockchain network (300).

At this time, the aggregator terminal (200) can broadcast a transaction including on-chain data and an operation proof value to the blockchain network (300), and accordingly, a block is generated by a distributed consensus of blockchain nodes constituting the blockchain network (300), and the generated block is added to the blockchain of the distributed ledger, so that the on-chain data and the operation proof value can be registered in the blockchain network (300).

Through this, the aggregator terminal (200) can ensure that on-chain data is trustworthy as being generated from off-chain data without disclosing the off-chain data.

By this method, on-chain data registered in the blockchain network (400) can be trusted and used by users, and, if necessary, the computational proof value can be verified to confirm that the on-chain data was generated from the off-chain data, and the data proof values can be verified to confirm that the encrypted data used to generate the on-chain data corresponds to the off-chain data.

At this time, in order to verify data proof values and computation proof values, the user can obtain an aggregator zero-knowledge proof key (CRSa), an i-th feeder zero-knowledge proof key (CRSf_i), on-chain data (OUT), and an computation proof value (π2) from the blockchain network (300), and obtain an i-th encrypted data (CT_i), an i-th commitment (CM_i), and an i-th data proof value (π1_i) from the aggregator terminal (200).

And, the user can input the i feeder zero-knowledge proof key (CRSf_i), the i encrypted data (CT_i), the i commitment (CM_i), and the i data proof value (π1_i) into the zero-knowledge verification module to verify the i data proof value.

For example, the zero-knowledge verification module can be a zero-knowledge verification module of CP-SNARK, and the i-th feeder zero-knowledge proof key (CRSf_i), the i-th encrypted data (CT_i), the i-th commitment (CM_i), and the i-th data proof value (π1_i) can be input into the CP-SNARK zero-knowledge verification module to output a data proof value (0/1). At this time, if the data proof value is 1, the data proof value can be determined to be true, and if the data proof value is 0, the data proof value can be determined to be false.

CP-SNARK. Verify(CRSf_i, CT_i, CM_i, π1_i) -> 0/1

However, the zero-knowledge verification module in the present invention is not limited to CP-SNARK, and a zero-knowledge verification module in various zero-knowledge proof algorithms that can generate a proof value for zero-knowledge proof and verify it can be used.

Additionally, the user can input the aggregator zero-knowledge proof key, on-chain data, the j-commitment, and the computational proof value into the zero-knowledge verification module to verify the computational proof value.

For example, the zero-knowledge verification module can be a zero-knowledge verification module of CP-SNARK, and the aggregator zero-knowledge proof key (CRSa), on-chain data (OUT), the i commitment (CM_i), and the computational proof value (π2) can be input into the CP-SNARK zero-knowledge verification module to output the computational proof value (0/1). At this time, if the computational proof value is 1, the computational proof value can be determined to be true, and if the computational proof value is 0, the computational proof value can be determined to be false.

CP-SNARK. Verify(CRSa, OUT, {CM_i}, π2) 0/1

However, the zero-knowledge verification module in the present invention is not limited to CP-SNARK, and a zero-knowledge verification module in various zero-knowledge proof algorithms that can generate a proof value for zero-knowledge proof and verify it can be used.

In addition, the embodiments according to the present invention described above may be implemented in the form of program commands that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, etc., alone or in combination. The program commands recorded on the computer-readable recording medium may be those specially designed and configured for the present invention or may be those known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program commands such as ROMs, RAMs, flash memories, etc. Examples of the program commands include not only machine language codes generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter, etc. The hardware devices may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

Although the present invention has been described above with specific details such as specific components and limited examples and drawings, these have been provided only to help a more general understanding of the present invention, and the present invention is not limited to the above examples, and those with common knowledge in the technical field to which the present invention belongs can make various modifications and variations from this description.

Therefore, the idea of the present invention should not be limited to the embodiments described above, and not only the claims described below but also all modifications equivalent to or equivalent to the claims are included in the scope of the idea of the present invention.

100_n: feeder terminal,
200: Aggregator terminal,
300: Blockchain Network

Claims (12)

A method for providing an oracle service for a blockchain network using zero-knowledge proof,
(a) a step for transmitting, to the aggregator terminal, each of the plurality of feeder terminals, each of the commitments generated using the commitment key generated by the aggregator terminal and each of the off-chain data, each of the encrypted data encrypted using the public key generated by the aggregator terminal, and each of the feeder zero-knowledge proof keys generated by referencing the commitment key generated by the aggregator terminal and the public key, each of the feeder data including the respective data proof values proving that the respective off-chain data corresponding to the respective commitments and the respective off-chain data corresponding to the respective encrypted data are identical, the aggregator terminal storing the feeder data transmitted from each of the plurality of feeder terminals in a database, and obtaining the first feeder data to the kth feeder data, wherein k is an integer greater than or equal to 1, stored in the database for a specific period according to a preset period; and
(b) the aggregator terminal, (i) using the i-th feeder zero-knowledge proof key, where i is an integer greater than or equal to 1 and less than or equal to k, to verify the i-th data proof value in each of the first to k-th feeder data, and decrypting the i-th encrypted data using a secret key corresponding to the public key to generate i-th decrypted data, thereby obtaining the first to k-th decrypted data, (ii) generating on-chain data by calculating the first to k-th decrypted data through a preset calculator, and generating a calculation proof value proving that the on-chain data was generated by calculating the first to k-th decrypted data by the calculator using the aggregator zero-knowledge proof key generated by referencing the commitment key and the preset calculator, and (iii) registering the on-chain data and the calculation proof value in a blockchain network;
A method including: In the first paragraph,
(a0) a step of the aggregator terminal generating the commitment key, the public key, and the aggregator zero-knowledge proof key, and registering the commitment key, the public key, and the aggregator zero-knowledge proof key in the blockchain network;
How to include more. In the second paragraph,
In the step (a), a specific feeder terminal among the plurality of feeder terminals obtains the commitment key and the public key from the blockchain network to generate a specific commitment and specific encrypted data for specific off-chain data, and generates a specific data proof value using a specific feeder zero-knowledge proof key generated by referencing the commitment key and the public key, and transmits specific feeder data including the specific commitment, the specific encrypted data, and the specific data proof value to the aggregator terminal. In the third paragraph,
The above specific feeder zero-knowledge proof key is generated by using the commitment key and the public key obtained by the specific feeder terminal from the blockchain network, and is registered in the blockchain network by the specific feeder terminal. In the second paragraph,
The above aggregator terminal, in order to issue a key for the calculator, inputs a first security parameter into a first key generation module to generate the commitment key, inputs a second security parameter into a second key generation module to generate the secret key and the public key, inputs the commitment key and the calculator into a third key generation module to generate the aggregator zero-knowledge proof key, and then registers the commitment key, the public key, and the aggregator zero-knowledge proof key in the blockchain network. In the first paragraph,
In step (b) above,
The above aggregator terminal verifies the i data proof value by obtaining the i feeder zero-knowledge proof key registered in the blockchain network by the i feeder terminal that transmitted the i feeder data from the blockchain network. In an aggregator terminal that provides an oracle service for a blockchain network using zero-knowledge proof,
Memory storing instructions for providing an oracle service for a blockchain network using zero-knowledge proof; and
A processor that performs operations for providing an oracle service of a blockchain network using zero-knowledge proof according to the instructions stored in the memory;
Including,
The processor, (I) transmits to the aggregator terminal, each of the plurality of feeder terminals, each of the commitments generated using the commitment key generated by the aggregator terminal and each of the off-chain data, each of the encrypted data encrypted using the public key generated by the aggregator terminal, and each of the feeder zero-knowledge proof keys generated by referencing the commitment key generated by the aggregator terminal and the public key, each of the feeder data including the respective data proof values proving that the respective off-chain data corresponding to the respective commitments and the respective off-chain data corresponding to the respective encrypted data are identical, the feeder data transmitted from each of the plurality of feeder terminals is stored in a database, and the first feeder data to the kth feeder data, wherein k is an integer greater than or equal to 1, stored in the database for a specific period according to a preset period, and (II) (i) the first feeder data to the kth feeder data In each, the i-th - wherein i is an integer greater than or equal to 1 and less than or equal to k - verifies the i-th data proof value using a feeder zero-knowledge proof key, decrypts the i-th encrypted data using a secret key corresponding to the public key to generate i-th decrypted data, thereby obtaining the first decrypted data to the k-th decrypted data, (ii) generates on-chain data by calculating the first decrypted data to the k-th decrypted data through a preset calculator, and generates a calculation proof value proving that the on-chain data was generated by calculating the first decrypted data to the k-th decrypted data by the calculator using an aggregator zero-knowledge proof key generated by referencing the commitment key and the preset calculator, and (iii) performs a process of registering the on-chain data and the calculation proof value to a blockchain network. In Article 7,
The above processor is an aggregator terminal that, prior to the (I) process, generates the commitment key, the public key, and the aggregator zero-knowledge proof key, and further performs a process of registering the commitment key, the public key, and the aggregator zero-knowledge proof key to the blockchain network. In Article 8,
The processor, in the process (I), causes a specific feeder terminal, which is one of the plurality of feeder terminals, to obtain the commitment key and the public key from the blockchain network to generate a specific commitment and specific encrypted data for specific off-chain data, and to generate a specific data proof value using a specific feeder zero-knowledge proof key generated by referencing the commitment key and the public key, and to transmit specific feeder data including the specific commitment, the specific encrypted data, and the specific data proof value to the aggregator terminal. In Article 9,
The above specific feeder zero-knowledge proof key is generated by using the commitment key and the public key obtained by the above specific feeder terminal from the above blockchain network, and is an aggregator terminal that causes the above specific feeder terminal to be registered in the above blockchain network. In Article 8,
The processor, for issuing a key for the calculator, inputs a first security parameter into a first key generation module to generate the commitment key, inputs a second security parameter into a second key generation module to generate the secret key and the public key, inputs the commitment key and the calculator into a third key generation module to generate the aggregator zero-knowledge proof key, and then registers the commitment key, the public key, and the aggregator zero-knowledge proof key in the blockchain network. In Article 7,
The above processor is an aggregator terminal that verifies the i data proof value by obtaining the i feeder zero-knowledge proof key registered in the blockchain network by the i feeder terminal that transmitted the i feeder data in the above (II) process.