CN110413257B

CN110413257B - Random number generating circuit

Info

Publication number: CN110413257B
Application number: CN201910693756.1A
Authority: CN
Inventors: 陈会军; 张喆; 李德建; 马岩; 唐晓柯; 胡毅
Original assignee: State Grid Corp of China SGCC; State Grid Information and Telecommunication Co Ltd; Beijing Smartchip Microelectronics Technology Co Ltd
Current assignee: State Grid Corp of China SGCC; State Grid Information and Telecommunication Co Ltd; Beijing Smartchip Microelectronics Technology Co Ltd
Priority date: 2019-07-30
Filing date: 2019-07-30
Publication date: 2021-04-23
Anticipated expiration: 2039-07-30
Also published as: CN110413257A

Abstract

The invention discloses a random number generating circuit, comprising: the true random number generator is used for receiving a first clock signal and generating a one-bit true random number under the control of the first clock signal; the linear feedback shift register is used for receiving a second clock signal, generating an m-bit pseudo random number under the control of the second clock signal and outputting the m-bit pseudo random number as an output result of the random number generating circuit; and the processing circuit is respectively connected with the linear feedback shift register and the true random number generator, and is used for calculating according to the true random number and the m-bit pseudo random number and feeding back a calculation result to the linear feedback shift register. The random number generation circuit provided by the invention leads the output m-bit TRNG random number to have unpredictability by introducing the true random number TRNG _ A, thereby meeting the requirement of high safety of the random number.

Description

Random number generating circuit

Technical Field

The present invention relates to the field of information security, and more particularly, to a random number generating circuit.

Background

Random numbers are the basis for cryptography, and most cryptographic algorithms require random number support for good performance. Random numbers are divided into two categories, pseudo random numbers and true random numbers.

Pseudo-random numbers are generated by numerical algorithms, have a finite periodicity, conform to certain algorithms, and can be described by certain formulas. The advantage of pseudo-random numbers is that they are generated by digital algorithms, the randomness of which is not affected by voltage, temperature, process corners. Pseudo-random numbers have the disadvantage of conforming to some deterministic algorithm and are therefore predictable in nature. Once an attacker can predict the random number sequence, the security of the cryptographic system is not guaranteed. True random numbers are generated from noise or chaos, have infinite periodicity, and do not conform to a determined algorithm. True random numbers have better security than pseudo random numbers. However, the true random number generation method that can be realized by using an integrated circuit is not many, and at present, the true random number generation method mainly includes circuits such as oscillation sampling, thermal noise amplification, chaotic circuit and the like.

Prior art random number generators typically use the data of a true random number generator as a seed, which is then post-processed using digital techniques. For example, with the random number to generate 1048576bits, a true random number of 32bits is collected, and then the data of the true random number of 32bits is used as a seed, and a pseudo-random algorithm is used to obtain the data of the remaining (1048576-32) bits. Or n true random number sources are adopted, each source adopts different pseudo-random algorithms to calculate, and then calculation results are combined.

However, based on the discovery of the inventor of the present application, in the prior art, in which a true random number generator is used as a seed and a pseudo random number operation method is used, if a pseudo random number generation algorithm is known, by collecting a piece of data, a large amount of data later can be predicted by the pseudo random algorithm, and the requirement of high security of the random number cannot be met.

The information disclosed in this background section is only for enhancement of understanding of the general background of the invention and should not be taken as an acknowledgement or any form of suggestion that this information forms the prior art already known to a person skilled in the art.

Disclosure of Invention

The invention aims to provide a random number generation circuit which can meet the requirement of high safety of random numbers.

To achieve the above object, the present invention provides a random number generating circuit comprising: the true random number generator is used for receiving a first clock signal and generating a one-bit true random number under the control of the first clock signal; the linear feedback shift register is used for receiving a second clock signal, generating an m-bit pseudo random number under the control of the second clock signal and outputting the m-bit pseudo random number as an output result of the random number generating circuit; and the processing circuit is respectively connected with the linear feedback shift register and the true random number generator and is used for calculating according to the true random number and the m-bit pseudo random number and feeding back a calculation result to the linear feedback shift register, wherein the linear feedback shift register is used for updating the value of the m-bit pseudo random number generated in the next second clock signal according to the calculation result, the number of bits of the linear feedback shift register comprises n bit shift registers, and m is more than or equal to 1 and less than or equal to n/2.

In a preferred embodiment, the linear feedback shift register is configured to perform m operations consecutively after the rising edge of the second clock signal, so as to generate m TRNGs, where the m TRNGs include TRNG1, TRNG2 … … TRNGm-1, TRNGm.

In a preferred embodiment, the true random number generator generates a 1-bit true random number TRNG _ a upon a rising edge of the first clock signal.

In a preferred embodiment, said calculating based on said true random number and m-bit pseudo random number and feeding back the calculation result to said linear feedback shift register comprises: receiving m-bit TRNG generated by the linear feedback shift register under the control of the current second clock signal and TRNG _ A generated by the true random number generator under the control of the current first clock signal; judging whether the TRNG _ A generated by the true random number generator under the control of the current first clock signal is the same as the TRNG _ A' generated by the true random number generator under the control of the previous first clock signal; if not, judging whether TRNG _ A is equal to the output value TRNGm of the linear feedback shift register; and if the values are not equal, the values of the shift registers in the linear feedback shift registers are sequentially shifted by 1 bit to the left, and the value of the shift register with a preset bit in the linear feedback shift registers is made to be TRNG _ A, wherein the primitive polynomial corresponding to the shift register with the preset bit is 1.

In a preferred embodiment, after the determining whether TRNG _ a is equal to the output value TRNGm of the linear feedback shift register, the method further includes: and if the values are equal, the value of the shift register with the preset bit in the linear feedback shift register is set to be 0 or 1.

In a preferred embodiment, after shifting the values of the shift registers in the linear feedback shift register by 1 bit sequentially to the left and setting the value of the shift register with the preset bit in the linear feedback shift register as TRNG _ a or setting the value of the shift register with the preset bit in the linear feedback shift register as 0, the method further includes: judging whether all values of all shift registers in the linear feedback shift register are zero or not; if all are zero, then let the value of any one of the linear feedback shift registers equal a non-zero value.

In a preferred embodiment, the first clock signal and the second clock signal are the same clock signal.

Compared with the prior art, the random number generation circuit provided by the invention has the advantages that the output m-bit TRNG random number has unpredictability and high randomness by introducing the true random number TRNG _ A, and the requirement of high safety of the random number is met.

Drawings

Fig. 1 is a schematic diagram of a random number generating circuit according to an embodiment of the invention.

FIG. 2 is a schematic diagram of a working flow of a random number generating circuit according to an embodiment of the invention.

Fig. 3 is a schematic structural diagram of a linear feedback shift register according to an embodiment of the present invention.

FIG. 4 is a schematic flow diagram of the operation of a processing circuit according to an embodiment of the invention.

Fig. 5 is a schematic diagram of an implementation of a processing circuit according to an embodiment of the invention.

Detailed Description

The following detailed description of the present invention is provided in conjunction with the accompanying drawings, but it should be understood that the scope of the present invention is not limited to the specific embodiments.

Throughout the specification and claims, unless explicitly stated otherwise, the word "comprise", or variations such as "comprises" or "comprising", will be understood to imply the inclusion of a stated element or component but not the exclusion of any other element or component.

As shown in fig. 1, which is a schematic structural diagram of a random number generating circuit according to a preferred embodiment of the present invention, and as shown in fig. 2, which is a schematic workflow diagram of a random number generating circuit according to a preferred embodiment of the present invention, the random number generating circuit of the present embodiment includes: a linear feedback shift register 1, a true random number generator 2 and a processing circuit 3.

The true random number generator 2 is arranged to receive a first clock signal and to generate a one-bit true random number under control of said first clock signal.

Specifically, the true random number generator 2 may be an oscillation sampling, thermal noise amplification, chaotic circuit, or the like. The true random number generator 2 is specifically configured to generate a 1-bit true random number TRNG _ a after a rising edge of the first clock signal.

The linear feedback shift register 1 is configured to receive a second clock signal, generate an m-bit pseudo random number under control of the second clock signal, and output the m-bit pseudo random number as an output result of the random number generation circuit.

The linear feedback shift register 1 may be arranged to perform m operations consecutively after the rising edge of the second clock signal, resulting in m bits TRNG, wherein the m bits TRNG include TRNG1, TRNG2 … … TRNGm-1, TRNGm. The first clock signal and the second clock signal may be the same clock signal or different clock signals. The linear feedback shift register 1 may also be configured to perform m operations consecutively after the falling edge of the second clock signal comes.

The processing circuit 3 is connected to the linear feedback shift register 1 and the true random number generator 2, and is configured to perform calculation according to the true random number and the m-bit pseudo random number, and feed back a calculation result to the linear feedback shift register 1, where the linear feedback shift register 1 is configured to update a value of the m-bit pseudo random number generated in a next second clock signal according to the calculation result, a bit number of the linear feedback shift register 1 includes an n-bit shift register, and m is greater than or equal to 1 and less than or equal to n/2.

Specifically, the closer the value of m is to n, the more output data corresponding to each true random number, but the more easily the output data can be predicted; the closer the value of m is to 1, the less output data per true random number is, and the less easily predicted it is. The value of m is determined according to the actual application scenario. According to the principle of the linear shift register, at least m > -n data are needed to successfully predict a group of data, and m < n/2 in the patent can ensure that an attacker cannot successfully predict the random number generated after prediction.

Specifically, the inputs of the processing circuit 3 are m-bit TRNG and 1-bit TRNG _ a, and after operation, the register content of the linear feedback shift register is operated according to the operation result.

Therefore, the random number generating circuit provided by the embodiment introduces the true random number TRNG _ a, so that the output m-bit TRNG random number has unpredictability and high randomness, and meets the requirement of high safety of the random number.

In the method of the embodiment, the data of the true random number generator is uniformly inserted into the pseudo-random algorithm generation process, so that the data of the true random number generator not only serves as a seed and acts at the beginning part of the data, but also acts in the whole random number generation process. Therefore, the method provided by the embodiment generates the random number, and even if the generation algorithm of the pseudo random number is known, there is no way to predict the random number after the random number is acquired. In addition, the random numbers generated by the method provided by the embodiment have good randomness and are not easily influenced by voltage, temperature and process angle.

Further, TRNG _ a has an infinite periodicity and does not conform to the true random characteristics of the deterministic algorithm, so the result of this patent also has an infinite periodicity and does not conform to the deterministic algorithm. The output TRNG has a short period of pseudo random number and a long period of unpredictable true random number. For the oscillation sampling, at least n bits of data need to be collected to be able to perform the prediction. The random numbers generated by the method are unpredictable because the pseudo-random period of the method is short enough that m < ═ n/2, so that the random numbers cannot be predicted by the short period. The value of the linear feedback shift register is changed by introducing the true random number TRNG _ A, so the method overcomes the defects of the linear feedback shift register and can detect through matrix rank and linearity. The random property of the pseudo random number is utilized, so that the true random number TRNG _ A of the detection item which cannot pass the detection item of 01 balance or poker detection can pass the detection item of 01 balance or poker detection after the pseudo random processing.

As shown in fig. 3, which is a schematic structural diagram of a linear feedback shift register according to a preferred embodiment of the present invention, the linear feedback shift register in this embodiment may be a 32-bit linear feedback shift register. Where X1 to X32 are shift registers of n ═ 32bits, n0 to n32 are 33 nodes, p1 to p32 are 32 selection units determined by primitive polynomials, TRNG is an output position, and seed is a seed. If an appropriate primitive polynomial is selected, the output sequence has the longest period, called the M-sequence. Here, the seed is set to a non-zero sixteen-rank number, exemplified by FDEAB 565. The circuit sets registers x 1-x 32 to seed values. Namely, it is

x32＝1，x31＝1，x30＝1，x29＝1

x28＝1，x27＝1，x26＝0，x25＝1

x24＝1，x23＝1，x22＝1，x21＝0

x20＝1，x19＝0，x18＝1，x17＝0

x16＝1，x15＝0，x14＝1，x13＝1

x12＝0，x11＝1，x10＝0，x09＝1

x08＝0，x07＝1，x06＝1，x05＝0

x04＝0，x03＝1，x02＝0，x01＝1

One CLK clock cycle later, the register outputs the values x 1-x 32 to nodes n 1-n 32. n 1-n 32 are respectively subjected to bitwise XOR operation with the primitive polynomial to obtain p 1-p 32. The TRNG output is p32+ p31+ p30+ … + p3+ p2+ p1, and the addition is modulo operation, i.e. exclusive or operation.

The register array is shifted one bit to the left for each calculation. The left hand shift indicates that X32 is X31, X31 is X30, …, X2 is X1, and X1 is n 0. Note that where the original x32 value is discarded, the x1 value is equal to the n0 node value.

Further, as shown in fig. 4, which is a schematic diagram of a work flow of a processing circuit according to a preferred embodiment of the present invention, the processing circuit in this embodiment is specifically configured to perform the following steps.

In step S41, the m-bit TRNG generated by the linear feedback shift register under the control of the current second clock signal and the TRNG _ a generated by the true random number generator under the control of the current first clock signal are received;

in step S42, it is determined whether the TRNG _ a generated by the true random number generator under the control of the current first clock signal is the same as the TRNG _ a' generated by the true random number generator under the control of the previous first clock signal;

wherein the above determination may be achieved by determining whether TRNG _ a is flipped. If TRNG _ A is different from TRNG _ A', the judgment is turning over.

In step S43, if not identical, it is determined whether TRNG _ a is equal to the output value TRNGm of the linear feedback shift register.

In step S44, if they are not equal, the values of the shift registers in the linear feedback shift register are sequentially shifted to the left by 1 bit, and the value of the shift register with the preset bit in the linear feedback shift register is TRNG _ a, where the primitive polynomial corresponding to the shift register with the preset bit is 1.

For example, one of the primitive polynomials Y [32:0] for a 32-bit shift register is 0b 100000000000000000000000010101111. Then it is negligible that Y0 equals 1, and the other positions equal to 1 are Y1, Y2, Y3, Y5, Y7, Y32, according to the shift register principle. According to the shift register principle, the value p [ i ] of p is Y [ i ] and X [ i ], so those positions where Y [ i ] is 0 have a value of p [ i ] of 0. The value of p [ i ] is 0, which is negligible in the following XOR operation. Selecting these location assignments TRNG _ a can result in failure.

The primitive polynomial corresponding to the shift register with the preset bit refers to the value of Y [ i ]. The value of Y [ i ] corresponding to the shift register with preset bits is 1.

If following the example of the primitive polynomial described above, the shift register of the preset bits can select the position where i is 1,2,3,5,7, 32. One of X1, X2, X3, X5, X7, X32 can be made equal to TRNG _ A.

In step S45, if they are equal, the shift register value of the preset bit in the linear feedback shift register is set to 0 or 1.

In step S46, it is determined whether all the values of the shift registers in the linear feedback shift register are zero.

In step S47, if all are zeros, the value of any one of the linear feedback shift registers is made equal to 1. Therefore, after the processing circuit operates on the data of the linear feedback shift register, the values of the linear feedback shift register are not all zero.

The above process is repeated, and each time the rising edge of the clock CLK comes, the m-bit random number TRNG is output.

As shown in fig. 5, which is a schematic structural diagram of an implementation of a processing circuit according to a preferred embodiment of the present invention, the processing circuit may include a finite state machine and a multiplexer MUX. Sequential execution is implemented using a two-bit finite state machine having two binary codes, states S1 and S2. The jump sequence of the finite state machine is S1S 2-00, S1S 2-01, S1S 2-10, and S1S 2-11.

The decision whether TRNG _ a is inverted is implemented by a multiplexer MUX1, MUX1 is configured to receive the output signal of the first exclusive or gate, and output 1 when TRNG _ a 'is not equal to TRNG _ a, and output 0 when TRNG _ a' is equal to TRNG _ a. When TRNG _ A' is exclusive-or TRNG _ A is equal to 1, indicating that TRNG _ A is inverted; when TRNG _ A' exclusive OR TRNG _ A is equal to 0, it indicates that TRNG _ A is not flipped. MUX1 also accepts the output signal of the second exclusive or gate, and outputs a1 when TRNGm is not equal to TRNG _ a and a 0 when TRNGm is equal to TRNG _ a. The determination of whether TRNG _ a is equal to TRNGm is implemented by xoring TRNG _ a with TRNGm.

The above four states are sequentially executed. The processing circuit flow is as follows:

the state of the finite state machine is first determined. When S1S2 is in the 00 state, multiplexer MUX1 selects the data of the different branches to assign to X [32:1 ]. The first step is performed. The judgment of whether TRNG _ a is inverted is first implemented by the TRNGA' xoring TRNG _ a. Second, the determination of whether TRNG _ a is equal to TRNGm is implemented by xoring TRNG _ a with TRNGm. When TRNG _ A' XOR TRNGA equals 1 and TRNG _ A XOR TRNGm equals 1, multiplexer MUX1 selects the result of X [32:1] < <1, which is assigned to X [32:1 ]; in other cases, X [32:1] is chosen to be assigned to X [32:1 ].

When S1S2 is in the 01 state, multiplexer MUX2 is used to select the data assignment for the different branches to X [1 ]. TRNG _ A' XOR TRNG _ A and TRNG _ A XOR TRNGm is coupled to the select terminal of MUX 2. When TRNG _ A' XOR TRNG _ A equals 1 and TRNG _ A XOR TRNGm equals 1, multiplexer MUX2 selects TRNG _ A to be assigned to X [1 ]; when TRNG _ A' XOR TRNG _ A equals 1 and TRNG _ A XOR TRNGm equals 0, multiplexer MUX2 selects to assign 0 to X [1 ]; in other cases, multiplexer MUX2 selects assignment of X [1] to X [1 ].

When S1S2 is in the 10 state, multiplexer MUX3 is used to select the data assignment for the different branches to X [1 ]. TRNG _ A' XOR TRNG _ A and X [32] or X [31] or.. | X [2] or X [1] to the select terminal of MUX 2. Assigning 1 to X [1] when TRNG _ A' exclusive OR TRNG _ A equals 1 and X [32] or X [31] or.. | X [2] or X [1] equals 0; in other cases, X1 is assigned to X1.

When S1S2 is in the 11 state, the calculation is terminated.

Therefore, the random number generation circuit provided in the embodiment can maintain the good random characteristics of the linear feedback shift register; the values of the linear feedback shift registers are not all 0; and introducing a true random number TRNG _ A, wherein the short period of the output TRNG m bit is a predictable pseudo random number, and the long period is an unpredictable true random number. When the true random number TRNG _ a is all 0 or all 1, the output TRNG is a pure linear feedback shift register, which can meet the basic requirement. The analog true random number generator a1 is clocked by CLK, outputting m bits TRNG per CLK clock edge, so the frequency of the output random number TRNG is m times the clock frequency. The circuits related to m times of clock frequency are all digital circuits, and the digital circuits do not have large capacitors and need to be charged and discharged, so the circuit has the characteristic of low power consumption.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

The foregoing descriptions of specific exemplary embodiments of the present invention have been presented for purposes of illustration and description. It is not intended to limit the invention to the precise form disclosed, and obviously many modifications and variations are possible in light of the above teaching. The exemplary embodiments were chosen and described in order to explain certain principles of the invention and its practical application to enable one skilled in the art to make and use various exemplary embodiments of the invention and various alternatives and modifications as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims and their equivalents.

Claims

1. A random number generation circuit, comprising:

the true random number generator is used for receiving a first clock signal and generating a one-bit true random number under the control of the first clock signal;

the linear feedback shift register is used for receiving a second clock signal, generating an m-bit pseudo random number under the control of the second clock signal and outputting the m-bit pseudo random number as an output result of the random number generating circuit;

and the processing circuit is respectively connected with the linear feedback shift register and the true random number generator and is used for calculating according to the true random number and the m-bit pseudo random number and feeding back a calculation result to the linear feedback shift register, wherein the linear feedback shift register is used for updating the value of the m-bit pseudo random number generated in the next second clock signal according to the calculation result, the number of bits of the linear feedback shift register comprises n bit shift registers, and m is more than or equal to 1 and less than or equal to n/2.

2. The random number generating circuit of claim 1, wherein said linear feedback shift register is configured to perform m operations consecutively after a rising edge of said second clock signal, to generate m TRNGs, wherein said m TRNGs include TRNG1, TRNG2 … … TRNGm-1, TRNGm.

3. The random number generating circuit of claim 2, wherein the true random number generator generates a 1-bit true random number TRNG _ a after a rising edge of the first clock signal.

4. The random number generating circuit of claim 3, wherein said calculating from said true random number and an m-bit pseudo random number and feeding back a result of said calculating to said linear feedback shift register comprises:

receiving m-bit TRNG generated by the linear feedback shift register under the control of the current second clock signal and TRNG _ A generated by the true random number generator under the control of the current first clock signal;

judging whether the TRNG _ A generated by the true random number generator under the control of the current first clock signal is the same as the TRNG _ A' generated by the true random number generator under the control of the previous first clock signal;

if not, judging whether TRNG _ A is equal to the output value TRNGm of the linear feedback shift register;

and if the values are not equal, the values of the shift registers in the linear feedback shift registers are sequentially shifted by 1 bit to the left, and the value of the shift register with a preset bit in the linear feedback shift registers is made to be TRNG _ A, wherein the primitive polynomial corresponding to the shift register with the preset bit is 1.

5. The random number generating circuit of claim 4, wherein after determining whether TRNG _ a is equal to the output value TRNGm of the linear feedback shift register, further comprising:

and if the values are equal, the value of the shift register with the preset bit in the linear feedback shift register is set to be 0 or 1.

6. The random number generating circuit of claim 5, wherein after shifting the value of each shift register in the linear feedback shift register to the left by 1 bit in order and setting the value of the shift register with the preset bit in the linear feedback shift register to TRNG _ a or setting the value of the shift register with the preset bit in the linear feedback shift register to 0, further comprising:

judging whether all values of all shift registers in the linear feedback shift register are zero or not;

if all are zero, then let the value of any one of the linear feedback shift registers equal a non-zero value.

7. The random number generating circuit of claim 1, wherein the first clock signal and the second clock signal are the same clock signal.