How should I prove this protocol? I'm recently reading Berry Schoenmakers's Lecture Notes Cryptographic Protocols (page. 53) and confused about this following question:


  Let $g$, $h$ denote generators of a group of large prime order $n$
  such that $log_gh$ is unknown to anyone. Design Σ-protocols (and prove
  correctness) for the following relations: 
  
  {($A, B; x, y, z$) : $A = g^xh^y,B = g^{1/x}h^z, x \neq 0$};


My prove intuition is using Okamoto's protocol for $A = g^xh^y$ and $B = g^{1/x}h^z$, then how to prove the relation between $x$ in $A$ and $1/x$ in $B$?
Or is there any other way to prove it?
The two previous answers certainly solve the problem. Soundness of Geoffroy's protocol is fine indeed, but there is the appearance of the witness $x$ in the computation of the announcement $(A',B')$ as $B'=g^{r_x/x} h^r$. This can be avoided, however, and at the same time one can find the protocol maybe in a bit more natural way as follows.

Starting with $A=g^x h^y$ and $B=g^{1/x} h^z$, we see that $B$ is a Pedersen commitment
to the (multiplicative) inverse $1/x$ of the committed value $x$ in the Pedersen commitment $A$. So, $x$ appears both in $A$ and $B$ and these two occurrences need to be connected somehow. EQ-composition is a very effective way to accomplish this, but we cannot directly apply it to exponents of the form $x$ and $1/x$. A simple way out is to move $x$ around a bit in the equation for $B$ by raising both sides to the power of $x$, such that we get:
$$ A=g^x h^y,\qquad g=B^x h^{-zx}.$$
We can now apply EQ-composition to the factors $g^x$ and $B^x$, but one may wonder about the new factor $h^{-zx}$ which also depends on $x$. Fortunately, such a factor causes no problems because we can think of $h^{z'}=h^{-zx}$ as a factor that is independent of $x$; it's like replacing $z$ with $z'=-zx$, which is fine because this is a one-to-one transformation for nonzero $x$.

For the $\Sigma$-protocol we get:


Prover sends announcement $(a,b)=(g^u h^v, B^u h^w)$ with $u,v,w\in_R\mathbb{Z}_n$.
Verifier sends challenge $c\in_R\mathbb{Z}_n$.
Prover sends response $(r,s,t)=(u+c\,x, v+c\,y, w-c\,z\,x) \bmod n$. Verifier accepts if $g^r h^s = a A^c$ and $B^r h^t = b g^c$.


It is instructive to see why special soundness holds. So, let's consider two accepting conversations $(a,b;c;r,s,t)$ and $(a,b;c';r',s',t')$ with $c\neq c'$. Then we find:
$$\begin{array}{cl}
 &amp;  g^r h^s = a A^c,\ g^{r'} h^{s'} = a A^{c'},\quad B^r h^t = b g^c,\ B^{r'} h^{t'} = b g^{c'}\\
 \Rightarrow&amp; g^{r-r'} h^{s-s'} = A^{c-c'} ,\quad B^{r-r'} h^{t-t'} = g^{c-c'} \\
 \Leftrightarrow&amp; A = g^{\frac{r-r'}{c-c'}} h^{\frac{s-s'}{c-c'}},\quad B = g^{\frac{c-c'}{r-r'}} h^{-\frac{t-t'}{r-r'}}.
\end{array}$$
Here, we are using that $r\neq r'$ holds as well: otherwise we see that $B^{r-r'} h^{t-t'} = g^{c-c'}$ is equivalent to $h^{t-t'} = g^{c-c'}$, and we would have $\log_g h = (t-t')/(c-c')$, contradicting the assumption that $\log_g h$ is unknown.
Hence, a witness is obtained as $x=(r-r')/(c-c')$, $y=(s-s')/(c-c')$, and $z=-(t-t')/(r-r')$.
Clearly, $x\neq0$ and $B=g^{1/x} h^z$ holds, as well as $A=g^x h^y$.

The same line of reasoning can be applied to show special soundness for Geoffroy's protocol.