DE102013201687A1 - Method and apparatus for generating random bits - Google Patents

Abstract

A method for generating a random bit is proposed, which comprises: generating (S1) a noise signal (RS); Sampling (S2) the noise signal (RS) as a function of a clock signal (CK) with the aid of a first buffer element (3) to generate a first bit value (B1); Sampling (S2) the noise signal (RS) as a function of the clock signal (CK) with the aid of at least one further intermediate storage element (4) for generating at least one further bit value (B2); and determining at least one random bit (ZS) as a function of the generated bit values (B1, B2). A device (1, 100, 101) for generating a random bit comprises: a noise signal source (2) for generating a noise signal (RS), a first buffer element (3) and at least one further buffer element (4) for simultaneous sampling of the noise signal (RS) depending on a clock signal (CK).

Description

The present invention relates to a method for generating a random bit and to a device for generating one or more random bits. For example, a random bit sequence is generated which is used as a binary random number. The proposed devices and methods for generating random bits serve, for example, the implementation of random number generators.

Random data is needed for security applications, for example. Thus, random bits can be used to derive cryptographic keys or the like. Ideally, random bits generated have the same probability of occurrence and are statistically independent of each other. For this purpose, a random source for generating the random bits with a high entropy is desired.

From the generated random bits further more complex random numbers, such as random bit sequences or random bytes, can be derived.

In the past, among other things, physical processes such as radioactive decays have been used as random events. The difficulty here is to carry out measurements on the physical system at low cost in order to be able to derive the random data. In particular, implementations that do not require mixed signals from analog and digital elements are desirable.

Pseudo-random number generators are known and generate random bits due to an algorithm of so-called seed data. Since the derived pseudo-random bit string is essentially deterministic after seed determination, such random number generators are not suitable for cryptographic applications.

In the past, hardware random number generators have been exploited to exploit variations in period lengths or jitter in ring oscillator circuits. Frequently, however, the achieved entropy and / or random data rate did not meet the desired requirements.

It is therefore an object of the present invention to provide an improved method and / or apparatus for generating random bits.

Accordingly, a method for generating a random bit is proposed which comprises the steps:
Generating a noise signal;
Sampling the noise signal in response to a clock signal using a first latching element to generate a first bit value;
Sampling the noise signal as a function of the clock signal by means of at least one further buffer element for producing at least one further bit value; and
Determining at least one random bit in dependence on the generated bit values.

Furthermore, an apparatus for generating a random bit is proposed, which comprises:
a noise signal source for generating a noise signal;
a first latching element and at least one further latching element for simultaneously sampling the noise signal in response to a clock signal.

The device is in particular configured to perform a corresponding method for generating a random bit.

In embodiments, the device has at least three buffer elements. This achieves good entropy of the bit-pattern-generating bit values.

The noise signal originates, for example, from a noise signal source which generates a signal. For example, irregular vibrations can be generated. The noise signal source can also provide a true random signal which varies between predetermined signal levels. By simultaneously sampling the noise signal in the manner of a sample as a function of a clock signal at a clock time, a respective level is detected in the buffer elements and buffered. The detected level then corresponds to a bit value, for example 0 or 1 or L or H.

The particular analog noise signal is thus scanned simultaneously multiple times, whereby, for example, caused by physical differences of the implemented intermediate storage elements in a semiconductor process deviations. Also, a signal propagation time can lead to different sampling results and thus different bit values. The buffer element is for example a flip-flop. Particularly in the case of a D flip-flop, the sampling of the input signal, in the present case the noise signal, requires a clock edge. Since the noise signal has an irregular temporal signal curve, inaccuracies or randomness result from the different physical implementation of the buffer elements. For example, there may be violations of setup and hold times of the flip-flops, so that different Measurement results are recorded at different cache elements. Potential metastatic states in the staging elements can also be used as a source of chance.

It will be understood that a clock signal source generates a corresponding clock signal fluctuating regularly between two levels, the clock signal comprising rising and falling clock edges. The generated clock signal is supplied to clock inputs of the latch elements, which due to signal characteristics, for example signal edges, internally perform a sampling of the signal level at a data input and interpret it as a logic level. The logic level is then understood as a bit value and output.

The distance from the clock signal source to the various latch elements may be different, and therefore the clock signal may be differently affected by the signal path, so that the signal shapes may differ slightly.

The clock signal at a respective buffer element is understood to mean that, starting from the clock signal generator, the clock signal is branched as "branch clock signals" to the buffer elements. The respective branch clock signal therefore corresponds essentially to the influences of the signal path or other factors on the generated clock signal.

In the buffer elements can also speak of sample-and-hold or sample and hold members. Essentially, however, flip-flops are used.

In embodiments of the method and / or the device for generating a random bit, the noise signal is fed directly to a respective data input of the buffer elements or the data inputs of the buffer elements are coupled to a common line node, at which the noise signal can be tapped.

In embodiments of the method and apparatus, the noise signal is generated by means of a physical noise source. It is also conceivable that the noise signal is generated by means of a digital ring oscillator. If the noise signal source comprises a digital ring oscillator circuit, an odd number of inverter devices are fed back, resulting in a substantially oscillating signal. In particularly short inverter chains, for example, three or five inverters, results in a quasi-analogue waveform through the short feedback path. Such an oscillation signal can be regarded as a noise signal.

In embodiments, a corresponding digital ring oscillator comprises between three and ten inverters that are directly or indirectly fed back together. In further embodiments, eleven to twenty inverters are fed back.

In further embodiments, the digital ring oscillator circuits include Glois or Fibonacci and / or simple ring oscillators.

The device for generating random bits preferably comprises exclusively digital components. This has the advantage that no mixed signal circuits are necessary, which must process analog and digital signals. In this respect, production with the aid of purely digital circuit components is also cost-effective. A random number generator or device for generating random numbers can then be produced using standard semiconductor processes or else implemented as FPGAs or in FPGA devices.

In variants of the method, the generation of the bit values can take place a plurality of times in succession, and the determination of at least one random bit is then carried out as a function of a plurality of previously generated bit values. As such, the sets of bit values or bit patterns that are generated successively exploit the "contained" randomness to derive essentially random data.

In embodiments of the method or a correspondingly implemented device comprising, for example, a programmable microprocessor, a microcontroller or the like as a control device, the bit values are mapped to bytes with the aid of a hash function. For example, the bit values of a given bit width (number of bit values) generated during a scanning process are mapped onto a word of lesser bit width, for example one byte.

It is also possible to post-process the bit values or bytes. This z. B. a modified Neumann method for generating predetermined random patterns of bit values used. A conceivable method is described in: Ari Juels, Markus Jakobsson, Elizabeth AM Shriver, Bruce Hillyer: "How to turn loaded dice into fair coins" in IEEE Transactions on Information Theory, Vol. 3, Pg. 911-921, Year: 2000 ,

Embodiments of the method provide that the bit values generated during a sampling are assigned to a predetermined random value become. For example, a random pattern is generated each time a scan is performed, and a limited number of different patterns can be generated depending on the bit width or the number of random bits generated during a scan. This depends on the specific electronic or physical design of the device.

In order to reduce or compensate correlations between bit values or bits, suitable methods are known.

Overall, the method enables a circuit-wise easy-to-implement random number generator. Only a small number of electronic components are necessary, which can be manufactured as standard. Due to the generation of multiple bit values in one scan, the data rate can be increased over known randombit generators.

In embodiments, between 48 and 72 bit values are preferably generated, in particular 64 bit values. From this, at least two different random bits are generated or derived.

Further possible implementations of the invention also include not explicitly mentioned combinations of method steps, features or embodiments of the method or the random bit generator described above or below with regard to the exemplary embodiments. The skilled person will also add or modify individual aspects as improvements or additions to the respective basic form of the invention.

The above-described characteristics, features, and advantages of this invention, as well as the manner in which they will be achieved, will become clearer and more clearly understood in connection with the following description of the embodiments, which will be described in detail in conjunction with the drawings.

Showing:

1 a schematic representation of a first embodiment of an apparatus for generating random bits;

2 a schematic flow diagram for a method for generating random bits;

3 a schematic representation of a second embodiment of an apparatus for generating random bits; and

4 a diagram for explaining correlations between random bit values.

In the figures, identical or functionally identical elements are provided with the same reference numerals, unless stated otherwise.

The 1 shows a schematic representation of a first embodiment of a device 1 for generating random bits. For explaining the operation and generation of random bits, see 2 schematically a flowchart for a method for generating random bits indicated.

The first embodiment of a random bit generator 1 includes a noise signal generator 2 who is at an exit 5 a noise signal RS delivers. The noise signal RS is, for example, an analog or quasi-analogue signal coming from the noise source 2 is produced. The noise signal RS is preferably coupled to each other by digital switching elements in the noise signal generator 2 generated.

The device 1 comprises two latching elements, called D flip-flops 3 . 4 are designed. Every flip-flop 3 . 4 has a data input D, a clock input C and a data output Q. The noise signal RS is directly connected to the data inputs D of the flip-flops 3 . 4 fed. To the clock inputs C of the flip-flops 3 . 4 a common clock signal CK is coupled. At the outputs Q of the flip-flops 3 . 4 are bit values in response to the latched or sampled level of the noise signal RS tapped. For this purpose, the outputs Q are connected to a respective output 6 . 7 the random bit generator device. At the exits 6 . 7 Bit values B1 or B2 can be tapped.

The flip flops 3 . 4 provide substantially well-defined logic levels 0, 1 and L, H as bit values B1, B2, respectively. The noise signal RS, however, fluctuates irregularly between predetermined levels, so that it is unpredictable, which logic level of the flip-flops 3 . 4 is detected or sampled at the respective clock edge time.

For generating little correlated random bit values at the outputs 6 . 7 in a first step S1, the provision of the noise signal RS. Subsequently, in response to the clock signal CK, for example in the case of a rising or falling clock signal edge, sampling or sampling of the noise signal RS conducted to the data inputs D takes place in step S2. For example, due to violations of setup and hold times for the flip-flops 3 . 4 or other operating parameters counteracting the normal operation of flip-flops, randomness or entropy arises, which can be used to generate random bits from the bit values B1, B2. In step S3, therefore, depending on the generated Bit values B1, B2, the determination of a random bit. It is possible for the differently sampled or generated bit values B1, B2 to depend on operating conditions such as temperature voltage or external fields. Also manufacturing variations in the physical implementation of the flip-flops 3 . 4 or the geometry of the circuit and signal propagation time may result in different sampling results despite the same clock signal CK.

By multiple sampling in succession and a statistical evaluation can correlations of the outputs 6 . 7 can be handled or compensated for in order to obtain true random bits or random values. Essentially, in the simple presentation of the 1 four possible bit patterns B1 B2 = 01, 10, 11, 00. For example, a corresponding "random bit pattern" is generated with every rising clock edge.

In the 3 Another embodiment of a random bit generator is shown. The random bit generator 10 includes an (analog) noise source 20 at an exit 5 a random noise signal RS supplies. The device 10 For example, N = 64 D flip-flops 3-1 to 3-N each having data inputs D, clock inputs C and data outputs Q. The data inputs D are common to the output 5 coupled and receive the noise signal RS. The device is equipped with a clock signal generator 9 equipped, which supplies a clock signal CK, which in the clock inputs C of the flip-flops 3-1 to 3-N is guided. A control device 8th For example, a microcontroller or processor that is suitably programmed or configured controls the noise source via control signals CT1 and CT2 20 and the clock generator 9 ,

In the embodiment of the 3 is the source of noise 20 as a ring oscillator with three feedback inverters 12 . 13 . 14 designed. The feedback path is via a controllable switch 15 interruptible. The controllable switch is, for example, by control signals CT1 from the control device 8th taxable. A well-defined signal level, such as H or L, may be at a node 16 be tapped. The desk 15 switches between the well-defined level at an open feedback path and a closed feedback path. Regularly, for example, the path is closed, so that a random oscillation of the ring oscillator begins. Due to the particularly short feedback path with only three inverters results in an analog noise signal RS at the output 5 ,

When operating the random bit generator 10 becomes in response to the clock signal CK, the noise signal RS in parallel and simultaneously from the flip-flops 3-1 to 3-N sampled, whereby a respective bit or a bit value B1-BN is generated, which can be tapped at the respective output Q. The bit pattern from the bit values B1-BN is sent to the input via a suitable data line 17 the control device 8th guided. The control device 8th can evaluate or post-process the detected bit patterns B1-BN. For example, skews or correlations of the bit values can be compensated by suitable calculation methods.

At the exit 8th in the control device 8th Then there is a random bit or number signal ZS, which at the output 11 the random bit generator 10 is issued. The random bit or number generator 10 can be implemented as FPGA, for example.

Investigations by the applicant have shown that, for example, when implementing the in 3 schematically illustrated device as FPGA with N = 64 flip-flops a relatively low correlation of the 64 bits B1-B64 occurs. It follows, for example, that with repeated starting of the ring oscillator 20 and after a predetermined time, by sampling the bit values B1-BN, about 150 different bit patterns occur. This results in an entropy of 5.2 bits per measurement. In this respect, random words of the bit width 5 can be reasonably reliable with the aid of the device 10 produce.

The 4 shows a correlation diagram with gray values, where a black box represents a correlation of 1 and a white box a correlation of -0.81. At the edges, the 64 possible bit values B1-B64 are respectively plotted. It can be seen that each bit correlates with itself to 100%. It can also be seen that groups of bits occur which correlate relatively strongly with each other, while other bits are largely uncorrelated.

The correlation of the sampled noise signal components and the bit values B1-BN generated therefrom may, for example, depend on the topology of the realized digital circuit. In the implementation of the random bit generator as FPGA, the summary as configurable logic blocks of multiplexers, adders, flip-flops, and the like may lead to correlation, as, for example, signal paths are particularly similar for certain flip-flop groups.

The detected bit patterns of 64 bits can, for example, be mapped to bytes by means of hashing and then be post-processed using known methods. A suitable method is for example in Ari Juels, Markus Jakobsson, Elizabeth AM Shriver, Bruce Hillyer: "How to turn loaded dice into fair coins" in IEEE Transactions on Information Theory, Vol. 3, Pg. 911-921, Year: 2000 specified. In this respect, there is potentially an additional expense in the post-processing of the generated bit pattern, which can be accomplished for example by a microprocessor or suitable software. Nevertheless, a particularly high bit rate can be achieved with random bits.

The proposed methods and devices are based essentially exclusively on digital circuit components, so that standard processes can be used for production. Despite the quasi-analog noise signal generation with the help of short ring oscillators, no complex mixed-signal implementation is necessary. Overall, only a few electronic components are needed, so that cost-sensitive applications can be equipped with random bit or number generators.

Although the invention has been further illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• Ari Juels, Markus Jakobsson, Elizabeth AM Shriver, Bruce Hillyer: "How to turn loaded dice into fair coins" in IEEE Transactions on Information Theory, Vol. 3, Pg. 911-921, Year: 2000 [0025]
• Ari Juels, Markus Jakobsson, Elizabeth AM Shriver, Bruce Hillyer: "How to turn loaded dice into fair coins" in IEEE Transactions on Information Theory, Vol. 3, Pg. 911-921, Year: 2000 [0051]

Claims (15)

A method of generating a random bit comprising: generating (S1) a noise signal (RS); Sampling (S2) the noise signal (RS) as a function of a clock signal (CK) by means of a first buffer element ( 3 ) for generating a first bit value (B1); Sampling (S2) the noise signal (RS) as a function of the clock signal (CK) with the aid of at least one further buffer element ( 4 ) for generating at least one further bit value (B2); and determining (S3) at least one random bit (ZS) in dependence on the generated bit values (B1, B2). The method of claim 1, wherein the sampling of the noise signal (RS) at predetermined clock edges simultaneously with the help of the first and the further latch elements ( 3 . 4 ) he follows. Method according to claim 1 or 2, wherein the noise signal (RS) is generated by means of a physical noise source ( 2 ) is produced. Method according to one of claims 1-3, wherein the noise signal (RS) by means of a particular digital ring oscillator ( 20 ) is produced. Method according to one of claims 1-4, wherein the noise signal (RS) directly to a respective data input (D) of the buffer elements ( 3 . 4 ) is supplied. Method according to one of claims 1-5, wherein at least five bit values (B1 ... BN) are generated. The method of any of claims 1-6, further comprising: mapping the bit values (B1 ... BN) to bytes using a hash function. The method of any one of claims 1-7, further comprising: subjecting the bit values (B1 ... BN) or bytes to a method of generating predetermined random patterns of bit values. The method of any of claims 1-8, further comprising: assigning the bit values (B1 ... BN) generated during a sample to a predetermined random value. Method according to one of claims 1-9, wherein the generation of the bit values (B1, B2) takes place a plurality of times in succession, and the determination (S3) of at least one random bit (ZS) is effected as a function of a plurality of previously generated bit values (B1, B2). Contraption ( 1 . 10 ) for generating a random bit comprising: a noise signal source ( 2 ) for generating a noise signal (RS); a first buffer element ( 3 ) and at least one further buffer element ( 4 ) for simultaneously sampling the noise signal (RS) in response to a clock signal (CK). Contraption ( 1 . 10 ) according to claim 11, which is arranged to perform a method according to any one of claims 1-10. Contraption ( 1 . 10 ) according to claim 11 or 12, wherein the buffer elements ( 3 . 4 ) Are flip-flop facilities. Contraption ( 1 . 10 ) according to any one of claims 11-13, wherein the device ( 1 . 10 ) exclusively comprises digital components. Contraption ( 1 . 10 ) according to any one of claims 11-14, wherein the device ( 1 . 10 ) Is part of an FPGA device.

Images