Zero-knowledge set membership proof method and apparatus

A non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores a computer program, which when executed by a processor causes the processor to:

• receive, from a verifier device, a subset S′ whose size is η in the set S, and determine that the element u is the kth element in the subset S′;
• calculate two public values based on a parameter set disclosed by the third party, the element u, and the evidence σ, and send the two public values to the verifier device, so that the verifier device calculates a third public value based on the sent public values and each element in the subset S′;
• calculate η groups of random statements based on η groups of generated random numbers and the above-mentioned three public values, and send the η groups of random statements to the verifier device;
• receive a random challenge c from the verifier device;
• construct η challenge values based on the η groups of random numbers and the random challenge c, wherein the kth challenge value is calculated in a manner different from that of another challenge value;
• construct η groups of proof values, wherein the kth group of proof values is determined based on the kth group of random numbers, the kth challenge value, and the element u, and another group of proof values is determined based on a corresponding group of random numbers;
• and
• send η groups of data proofs formed by using η groups of proof values and corresponding challenge values to the verifier device, so that the verifier device verifies whether the η groups of random statements, the η challenge values, and the η group of proof values satisfy a preset relationship, to determine whether the element u owned by the user equipment belongs to the subset S′.

A computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the computing device is caused to:

• receive, from a verifier device, a subset S′ whose size is η in the set S, and determine that the element u is the kth element in the subset S′;
• calculate two public values based on a parameter set disclosed by the third party, the element u, and the evidence σ, and send the two public values to the verifier device, so that the verifier device calculates a third public value based on the sent public values and each element in the subset S′;
• calculate η groups of random statements based on η groups of generated random numbers and the above-mentioned three public values, and send the η groups of random statements to the verifier device;
• receive a random challenge c from the verifier device;
• construct η challenge values based on the η groups of random numbers and the random challenge c, wherein the kth challenge value is calculated in a manner different from that of another challenge value;
• construct η groups of proof values, wherein the kth group of proof values is determined based on the kth group of random numbers, the kth challenge value, and the element u, and another group of proof values is determined based on a corresponding group of random numbers;
• and
• send η groups of data proofs formed by using η groups of proof values and corresponding challenge values to the verifier device, so that the verifier device verifies whether the η groups of random statements, the η challenge values, and the η group of proof values satisfy a preset relationship, to determine whether the element u owned by the user equipment belongs to the subset S′.