DE102014224423A1 - Method and apparatus for measuring a jitter - Google Patents

Abstract

Providing a ring oscillator circuit (1) having a plurality of gate circuits (21-2n) for generating an oscillation signal (OS) propagated through the gate circuits (21-2n); simultaneously sampling the respective oscillation signal (OS) at outputs of a plurality of gate circuits (21-2n) at a plurality of sample times (tti) to generate a respective sample bit pattern (BMi), wherein a sample bit pattern (BMi) is associated with a ring oscillator state; Storing the sample bit patterns (BMi); Assigning a respective sample bit pattern (BMi) to a state number modulo twice the number of gate circuits (21-2n), successive state numbers corresponding to ring oscillator states occurring in temporal succession; Determining a state distance as a difference between state numbers of successive sampling bit patterns (BMi) or as a difference between the state number of the first sampling pattern after starting and the state number of the starting state, or as a state number of the respective sampling bit pattern (BMi) after starting the ring oscillator circuit; Determining a distribution of the state distances over the number of sampling times (tti); and determining a standard deviation and / or variance of the state distances from the distribution of the state distances as standard deviation and / or variance of the jitter. An apparatus for generating random bits (ZB) has a ring oscillator circuit (1) which comprises a plurality of gate circuits (21-2n), a sampling device (4) and a control device (3) for carrying out the method.

Description

The present invention relates to a method and a device for measuring a jitter, in particular in a ring oscillator device. Further disclosed is a method and apparatus for generating one or more random bits. For example, a random bit sequence is generated which is used as a binary random number. The proposed devices and methods for measuring jitters and for generating random bits serve, for example, the implementation of random number generators. For example, the invention allows for the generation of true random bits as opposed to pseudorandom bits.

The proposed methods and devices are used in particular to generate random bits or random bit sequences which have good random properties, that is to say have the highest possible entropy. Random data is needed, for example, in security applications, where, for example, cryptographic keys or the like are derived from random bits generated.

In security-relevant applications, for example in asymmetric authentication methods, random bit sequences are necessary as binary random numbers. It is desired, in particular for mobile applications to operate as little hardware as possible. Known measures for generating random numbers are, for example, pseudo-random number generators, analog random sources, ring oscillators and their modifications.

For pseudo-random number generators, seeds are used, from which deterministic pseudorandom numbers are calculated. To create the seed, a physical random number generator is usually used. As analog random sources, noise sources such as e.g. the noise of zener diodes, amplified and digitized. At the same time, the connection between digital and analog circuit technology is usually difficult to realize.

In ring oscillators, which are constructed of series-connected inverters, random jitter resulting from fluctuating throughput times of the signals through the inverter. These jitter, that is, an irregular variation with time in state changes of the signals sent by the inverters, can be accumulated in the case of multiple passes through the ring oscillator circuit, so that ultimately a random analog signal is produced. A disadvantage of ring oscillators is often the necessary long time from the start of the oscillation until a usable random signal due to the Jitterakkumulierung arises. Therefore, low data generation rates usually occur with ring oscillators. Furthermore, it is possible that the adding jitter contributions cancel each other out, so that on average random short gate delays are compensated by random longer gate delays.

Most jitter in a circuit is unknown and needs to be measured or estimated. In particular, with ring oscillators used for random bit generation, since jitter is a determinant of the quality of the random bits and the possible rate of generation, it is desirable to detect the jitter during operation or "on-board". Measures are known, a high-resolution ring oscillator signal, for example, with an oscilloscope to scan and determine the jitter therefrom.

In this respect, it is an object of the present invention to provide an improved method and / or apparatus for jitter determination.

Accordingly, a method is proposed for measuring a jitter in a ring oscillator circuit, the method comprising the steps:
Providing a ring oscillator circuit having a number of gate circuits for generating an oscillation signal which propagates through the gate circuits;
simultaneously sampling the respective oscillation signal at outputs of a plurality of gate circuits at a plurality of sample times to produce a respective sample bit pattern, a sample bit pattern associated with a ring oscillator state;
Storing the sample bit patterns;
Assigning a respective sample bit pattern to a state number modulo twice the number of gate circuits, successive state numbers corresponding to ring oscillator states occurring in temporal succession;
Determining a state distance as the difference between state numbers of successive sampling bit patterns or as a difference between the state number of the first sampling pattern after starting and the state number of the starting state, or as the state number of the respective sampling bit pattern after starting the ring oscillator circuit;
Determining a distribution of the state distances over the number of sampling times; and
Determining a standard deviation and / or variance of the state distances from the distribution of the state distances as standard deviation and / or variance of the jitter.

In the number of concatenated gate circuits, one can also speak of a "length of the ring oscillator circuit". The state numbers are in particular integers. And preferably, the ring oscillator circuit does not include branches of chained gate circuits. In particular, it is a classical ring oscillator comprising an odd number of inverter circuits coupled in series.

In variants of the method, the starting state of the ring oscillator is provided with the state number, for example 0, so that a difference of 0 is made to determine the state spacing of the first scanning pattern to the starting state. In this respect, this difference can also be omitted.

In the proposed method can be exploited in variants that with a simultaneous sampling of the output signals of the respective gates or inverters in ring oscillators an improved temporal sampling resolution over the single scan takes place. The sampling of the oscillation signal is effectively separated in time by the respective gate running time spaced. It is now possible to derive the jitter from the occurrence of the sample bit pattern with multiple simultaneous sampling. If, for example, there is no jitter-loaded ring oscillator signal, the same state spacing would always have to be used for repeated sampling at the same time intervals. Due to the jitter, the state distances are unevenly distributed at the respective sampling times. From the standard deviation of this distribution, the variance or the standard deviation of the jitter is recorded, for example, with the measure of the mean gate running time.

In variants of the method, a new start signal is coupled in before each simultaneous sampling. That is, mutually independent oscillation signals are generated.

A corresponding variant of the method for measuring a jitter in a ring-oscillator circuit with a plurality of gate circuits then comprises in particular the steps:
Injecting a start signal at a start time for generating an oscillation signal propagated through the gate circuits;
simultaneously sampling the respective oscillation signal at outputs of a plurality of gate circuits at a plurality of sample times to produce a respective sample bit pattern, a sample bit pattern associated with a ring oscillator state;
Storing the sample bit patterns;
Determining a distribution of the sample bit patterns over the number of sample times; and
Determining a standard deviation and / or variance of the distribution as standard deviation and / or variance of the jitter.

For example, a delay time between sampling instants and / or between a start time and a subsequent sampling time is constant. Thus, a sample bit pattern is regularly generated so that a time shift of the sample bit pattern or the detected ring oscillator state from its expected value is almost exclusively due to the present jitter.

For example, successive state numbers are determined by scanning. As a state distance one can use the difference of the state numbers of directly consecutive samples. If the ring oscillator is restarted before each sampling, the state distance itself corresponds to the state number itself when providing the start state with the state number 0. It can be said that the state distance to a previously known ring oscillator state is detected.

For example, you start at ring oscillator state 0 and then let the circuit run permanently. After e.g. 20 ns is sampled and detects the state 3, after another 20 ns the state 6, after another 20 ns the state 9, after another 20ns the state 13, after another 20 ns the state 16, then 19. There is thus little jitter , and the state is always up to 3 numbers with one exception at the next sampling. The state distance is therefore usually 3, and only once 4.

In embodiments of the method, the oscillation signal has a mean period, and a number of period cycles are measured during the delay time. By considering the number of periods, it can be prevented that due to the cyclic sequence of resulting Ringoszillatorzuständen and the possible reduction of the Ringoszillatorzuständen assigned state numbers modulo the number of Ringoszillatorzustände over time a wrong standard deviation is determined. This embodiment is particularly relevant if an accumulated jitter that reaches or exceeds the magnitude of a ring oscillator period occurs with non-negligible probability.

In embodiments, counting the level changes or counting the level changes in a predetermined direction at an output of at least one gate circuit during the delay time is further performed. For example, one can count positive or negative signal edges. As a result, it can be taken into account that jitter accumulates during the passage of a signal edge through the ring oscillator circuit.

In particular, each gate circuit has a gate delay, the ring oscillator states are time cyclically ordered, and adjacent ring oscillator states are time shifted by an average gate term.

By detecting and measuring the jitter in particular a low-cost generation of random bits is possible. In extensions of the method, the method steps are also provided, in particular for generating random bits:
Generating a further oscillation signal which propagates through the gate circuits and has a nominal period T, the further oscillation signal being supplied with at least one jitter contribution and an entropy of the ring oscillator circuit being dependent on the standard deviation or the variance of the jitter;
Sampling the respective further oscillation signal at outputs in a plurality of gate circuits at a sampling instant as random signals, wherein the sampling instant is selected and regulated in dependence on the standard deviation or variance of the jitter; and
Assigning respective logic levels to the sampled oscillation signal to generate a plurality of random bits.

Preferably, the selection or regulation of the sampling time is such that the desired value of the jitter has a predetermined fixed value.

The sampling of the respective other oscillation signal at outputs in a plurality of gate circuits may be performed at a sampling time as random signals, wherein the sampling time is selected at a predetermined time interval by a preferred time, and wherein the preferred time is selected such that the standard deviation of the jitter has a value the entropy has a maximum per time. In this respect, a control of the sampling time in dependence on the measured jitter, as described above takes place. This gives an optimal operating point for the random number generation even with manufacturing variations of the circuits used.

In the proposed method, a favorable time interval between the start time and the sampling time is selected. While in known methods for generating random bits with ring oscillators the sampling does not take place until the jitter has such a high standard deviation, which corresponds more or less to the nominal period of the ring oscillator, the proposed method provides for selecting the preferred time such that one entropy per Time-maximization occurs. Since the standard deviation of the jitter can be measured on-board and stored, the sampling time can be chosen earlier than conventional. This allows ring oscillator circuits to operate at a higher random bit rate. This leads to faster random number generation, lower power consumption and a more efficient overall approach.

Basically, a ring oscillator circuit, for example, with an odd number of inverters at the inverter outputs provides random signals which have rising and falling signal edge portions due to the jitter fluctuations and the feedbacks. This random or chaotic waveform can not be resolved in time with a sufficiently large jitter, if at the given sampling time a single bit value is derived from the level of the respective random signal. The plurality of simultaneously sampled random signals then provide random bit patterns. In order for these chaotic or random waveforms to occur, a first sample is usually waited until a standard deviation of the jitter is greater than the nominal period of the ring oscillator used.

The proposed method scans earlier and accepts a potential unequal distribution of the determined H and L or logical one and zero states. However, one obtains a higher entropy per time, since an entropy maximum due to Gaussian or thermal jitter generation at sampling instants for which the standard deviation of the jitter is less than a nominal period of the ring oscillator.

The oscillation signal fluctuates as a level between voltages that can be assigned to a high or low state. For example, a level of +1.5V may be assigned to an H or 1 state and a -1.5V level to a logical L or 0 state.

With a jitter contribution, one can speak of a time deviation of a feature of the respective oscillation signal, for example a rising or falling signal edge, from the nominal period. Due to runtime fluctuations arise, for example, at an output of the gates of the ring oscillator circuit is not necessarily strictly regular rising signal edges, which can be used as a measure of a period of the oscillator. A nominal period is, for example, the mean value or the expected value of the period of the oscillation signal.

A cumulative jitter is understood as meaning, for example, the time deviation of a signal edge at a gate of the oscillator from its temporal expected value after multiple propagation through the entire ring oscillator circuit. In the past, many thousands of passes of the oscillation signal have been waited by the ring oscillator circuit until a bit value has been sampled as a random bit.

In embodiments of the method, the preferential time is determined as a function of the resulting standard deviation σ of the jitter. For example, the standard deviation σ is proportional to the square root of a plurality m of nominal periods from the start time t _s . Especially with jitter contributions that are statistically independent, it can be assumed that the standard deviation increases by m ^1/2 times. In any case, thermal jitter contributions can be based on Gaussian independent distributions. In this respect, in embodiments of the proposed approach, at least one of the corresponding jitter contributions will be an independent thermal jitter contribution.

In a variant of the method for measuring the jitter and generating random bits by means of ring oscillator circuits, each gate circuit has a gate transit time G, and the preferential time is t _p = 0.113846 G ² / σ ² gate transit times after the start of the ring oscillator last sampling, where σ is the standard deviation of the gate transit time. This standard deviation can be calculated from the standard deviation of the jitter accumulated over several ring oscillator periods.

For example, one can estimate the entropy of the ring oscillator circuit, which arises due to thermal jitter contributions, numerically or with the aid of a heuristic model. From a corresponding entropy curve H (σ), a curve A (σ) of the entropy production per time is determined as a function of the determined standard deviation of the jitter σ, which in turn depends on the number m of passes through the ring oscillator. The curve A (σ) has a maximum that is determined. The achieved standard deviation σ therefore essentially corresponds to a time which has elapsed since the start time t _s in which the jitter is accumulated. A preferred time point t _p is the time at which the accumulated jitter σ is a standard deviation, the entropy per-time curve leads to a (local) maximum. As a measure, the expression A (σ) = H (σ) / σ ² can be used. It is now low, within a time range .DELTA.t to this, a maximum in the entropy per time causing time t _p to carry out the scanning of the oscillating signal because this having random resulting in relation to the required time and energy, a particularly high entropy.

In embodiments, the predetermined time interval Δt is selected so that the standard deviation of the jitter accumulated in the interval is less than one-third, preferably one-fourth, and more preferably one-tenth of the nominal period T. In embodiments, the sampling of the respective oscillation signal is periodic with one sample period Δs = t _p - t _s . The start signal is then not coupled between the samples.

In a variant of the method, the sampling of the oscillation signal takes place several times in succession, and in each case before a start signal is coupled. When restarting for each random bit to be generated, a substantially steady state probability distribution is achieved. In the case of the permanently oscillating ring oscillation signal sampled without a restart, the distribution is generally not stationary. Depending on the application, the probability distribution can thus be selected. The jitter measurement does not have to be done every time in random bit generation. The jitter value can be stored.

In embodiments of the method, furthermore, the nominal period T or the gate transit time G of the oscillation signal is measured at one of the gate circuits. By measuring the nominal period or the gate transit time, for example by means of oscillation signal characteristics, such as rising or falling edges, and storing, for example, in a memory, the favorable timing for the ring oscillator circuit t _{p can be} determined.

In embodiments of the method, the random bits of the generated bit patterns, ie random levels, in particular for eliminating skewness or a correlation of generated random bits, are subjected to an algorithmic aftertreatment. The random bits generated by the proposed method need not be equally distributed. Rather, the entropy production is optimized per time. As a result, it may be favorable to carry out an algorithmic post-processing of the raw bit data obtained. In particular, in the case of non-stationary distributions cryptographic post-processing methods can be used, such as block ciphers or cryptographic hash functions. Post-processing procedures are usually known.

A device is also proposed, which is equipped to generate random bits with a ring oscillator circuit, which comprises a plurality of gate circuits, a scanning device and a control device. The control device is in particular configured to perform a method as described above or below. For this purpose, the control device can generate control or evaluation signals at suitable times in order to scan random signals, to generate start signals or to coordinate the execution of the method described above. The device may for example comprise a memory device for storing the jitter standard deviation, the nominal period and / or the gate transit time.

In embodiments, the device is part of an FPGA device or an ASIC device.

Furthermore, a computer program product is proposed, which causes the execution of a corresponding method on a program-controlled device.

A computer program product such as a computer program means can be provided or supplied, for example, as a storage medium, such as a memory card, USB stick, CD-ROM, DVD, or even in the form of a downloadable file from a server in a network. This can be done, for example, in a wireless communication network by the transmission of a corresponding file with the computer program product or the computer program means. As a program-controlled device is in particular a control device, such as a microprocessor for a smart card or the like, in question. The method or device may also be hardwired or implemented in configurable FPGAs or ASICSs.

Furthermore, a data carrier with a stored computer program with commands is suggested, which cause the implementation of a corresponding method on a program-controlled device.

Further possible implementations of the invention also include not explicitly mentioned combinations of devices or method variants described above or below with regard to the exemplary embodiments. The skilled person will also add or modify individual aspects as improvements or additions to the respective basic form of the invention.

The above-described characteristics, features, and advantages of this invention, as well as the manner in which they will be achieved, will become clearer and more clearly understood in connection with the following description of the embodiments, which will be described in detail in conjunction with the drawings.

Showing:

1 a schematic representation of an embodiment of an apparatus for generating random bits.

2 Representations of jitter component waveforms in embodiments of random bit generator devices.

3 a representation of an entropy curve as a function of the standard deviation of the jitter for an embodiment of a device for generating random bits.

4 a representation of a ring oscillator circuit for explaining Ringoszillatorzuständen.

5 a table of possible Abtastbitmustern, the Ringoszillatorzuständen the ring oscillator circuit according to 4 correspond.

6 a representation of a distribution of measured Ringoszillatorzuständen according to investigations by the applicant.

In the figures, functionally identical elements are provided with the same reference numerals, unless stated otherwise.

The 1 shows an apparatus for generating random bits, which can be operated to carry out the method described above and hereinafter indicated. The device 1 comprises a ring oscillator circuit with an odd number n of inverters 2 ₁ - 2 _n . The feedback loop from the output of the nth inverter 2 _n to the input of the first inverter 2 ₁ can be controlled by a switch 8th to be interrupted. The ring oscillator 1 thus has the length n. When connecting, so closing the feedback loop through the switch 8th , an oscillation signal OS, which is generated by the inverters 2 ₁ - 2 _n propagated. Every inverter 2 ₁ - 2 _{In this case, n} has a gate transit time G, which corresponds to the time that elapses until, when a state change takes place at an input, the latter is applied to an output of the same inverter.

The device 1 has a control device 3 , which can open or close with control signals CT1, for example, the controllable switch and thus the oscillations in the ring oscillator circuit 2 ₁ - 2 _n starts or stops. One can denote the signal CT2 as a start signal the start time t _s sets. At outputs of the inverters 2 ₁ - 2 _n are sample and hold members 4 ₁ - 4 _n coupled, controlled by the controller 3 for example, with the aid of the sampling signal C2 a respective signal level at the output of the inverter 2 ₁ - 2 _n at the sampling time t _s tap off and buffer. This signal level is assigned to a respective logic level, for example 0 or 1 or L or H, and as a random bit ZB ₁ -ZB _{n of} a memory device 7 fed. The storage device 7 as well as the sample and hold members 4 ₁ - 4 _n can control signals CT1, CT2, CT3 from the control device 3 be controlled. In embodiments, not all outputs are the inverters 2 ₁ - 2 _n simultaneously sampled but only a selection.

Further, a counter 10 to the output of the inverter 2 _n coupled. The counter is used to count the number of oscillations in a given period of time. This is done, for example, by counting the level changes at the output of the inverter 2 _n .

There is also a storage device 9 to the store 7 coupled to store the detected bit patterns according to the random bits ZB ₁ -ZB ₃ and provide the controller for evaluation. For random bit generation, the determination or knowledge of the jitter in the signal is useful.

Due to the physical properties of the inverters and the logic gates 2 ₁ - 2 _n , the oscillation signal OS is jittered. The random signals ZS ₁ -ZS _n are sampled simultaneously, for example, so that random bit patterns result from the individual random bits ZB ₁ -ZB _n . Will all outputs of the inverter 2 ₁ - 2 _n , which is not necessary, all the binary state patterns of the corresponding ring oscillator circuit result. For the sake of simplicity, it is assumed that all outputs are sampled, so that an n-bit-wide random bit pattern ZB ₁ -ZB _{n is produced} by the sampling. At the output of the respective scanner 4 _i then applies a random voltage representing H or L.

Usually, the sampling is waited until a standard deviation of a normally distributed jitter component has at least the nominal period T of the ring oscillator circuit. Investigations of the applicant have shown that a much earlier sampling and thus a significantly increased generation rate of random bits or random bit patterns is possible.

The control device 3 is for example with a microprocessor 6 equipped and leads in the memory depending on a programming or a readable program 5 the method of generating random bits and a prior measurement of that of the ring oscillator 2 ₁ - 2 _n produced jitters.

In the past, circuits similar to those used in the 1 is shown schematically, used to generate random bits. However, especially when implemented as ASICs, recent studies suggest that only after passing many periods T of the ring oscillator with the inverters 2 ₁ - 2 _n a sufficient accumulation of the jitter has occurred, so that an equal distribution of the sampled bits in dependence on the random signal ZS is present, and only then should be scanned meaningful. For example, in P. Haddad, Y. Teglia, F. Bernard and V. Fischer: "On the assumption of mutual independence of jitter realizations in P-TRNG stochastic models", DATE Conference 2014 , Dresden suggested that, for example, in a ring oscillator of length n = 9 only after about 390,000 periods a random bit can be sampled.

To explain possible waveforms are in the 2 possible signal curves with jitter rates for the random signal ZS _i shown. In the 2 is shown horizontally the time course in units of the nominal period T of the ring oscillator. The solid line shows that nominally rising and falling signal edges occur periodically between the logical H and L levels. Due to physical influences, such as thermal influences by in the inverters 2 ₁ - 2 _n present components, arise in real waveforms deviations from the nominal periods. This is indicated by the vertical bars marked S.

After many passes through the signal edges, their timing differs significantly by the expected value of the period of the ring oscillator. This condition arises in particular when the accumulated jitter, ie a random deviation of the period of the ring oscillator from its mean value or expected value (nominal period T), fluctuates so strongly that, for example, a standard deviation is as large as the nominal period T itself.

σ² kann als Varianz bezeichnet werden. Nach dem bisherigen Stand der Technik würde nach einem Startzeitpunkt t_s so lange gewartet werden müssen, bis die Standardabweichung gemäß der Normalverteilung für die Jitterkomponente so groß ist wie die nominelle Periode T. Durch das Akkumulieren des Jitters steigt mit der Anzahl der Durchläufe des Oszillationssignals durch den Ringoszillator mit den Invertern 2 ₁–2 _n der Jitter und damit die Standardabweichung. Allerdings ist dieser Zusammenhang nicht linear, denn die Standardabweichung σ steigt nach dem zentralen Grenzwertsatz bei statistisch unabhängigen Jitterbeiträgen mit dem m^1/2-fachen, wobei m die Anzahl der Durchläufe einer Signalflanke durch den Ringoszillator ab dem Startzeitpunkt ist. D.h., die Wartezeit ist nach klassischem Verständnis, beispielsweise wie es in dem vorgenannten Artikel dargestellt ist, besonders lang. Untersuchungen und Überlegungen der Anmelderin haben nun ergeben, dass bereits bei deutlich früheren Abtastzeitpunkten eine hohe Entropie pro Zeit des Signals erwartet werden kann. Es ist insbesondere möglich, die Entropie für einen Ringoszillatorschaltkreis mit n Invertern in Abhängigkeit von der Standardabweichung σ des Jitters J anzugeben. Definiert man für relles x und ganzzahliges z die Funktionen r_z(x) mit:

stimmt die Funktion r_z(x) fast überall mit dem Ausdruck Θ(x – z + 1 / 2) – Θ(x – z – 1 / 2) (Gleichung 3) überein, wobei Θ die Heaviside-Funktion ist. Man kann die Größe p_n,i (für ungerades n und natürliche Zahlen i mit 0 < i < 2n) als Wahrscheinlichkeit definieren, dass beim Abtasten der n Inverter der i-te Ringoszillatorzustand angenommen wird, wobei der 0-te Ringoszillatorzustand dadurch definiert ist, dass der Erwartungswert der Sample-Zeitpunkte in der Mitte des 0-ten Ringoszillatorzustandes liegt. Die Variable i kann als Zustandsnummer verstanden werden. Der Zustand eines Ringoszillators ergibt sich durch die möglichen logischen Pegel an den Ein- und Ausgängen der Inverter. p_n,i wird definiert durch:

so dass schließlich die Entropie H(σ) bestimmt werden kann durch:

Aufgrund des Zusammenhangs zwischen der Standardabweichung des thermischen Jitterbeitrags und der Entropie kann nun ein bevorzugter Abtastzeitpunkt t_p bestimmt werden, der eine maximale Entropie pro Zeit mit sich bringt. Applicant has made investigations in which Gaussian thermal noise, in particular, is considered a jitter component. Therefore, it is also assumed that the jitter corresponds to a Gaussian normal distribution whose density function has the following form at an expected value 0 and a standard deviation σ:

σ ² can be called variance. According to the prior art, it would have to wait after a start time t _s until the standard deviation according to the normal distribution for the jitter component is as large as the nominal period T. By accumulating the jitter increases with the number of passes of the oscillation signal the ring oscillator with the inverters 2 ₁ - 2 _n the jitter and thus the standard deviation. However, this relationship is not linear, because the standard deviation σ increases according to the central limit theorem with statistically independent jitter contributions with the m ^1/2 times, where m is the number of passes of a signal edge by the ring oscillator from the start time. That is, the waiting time is according to classical understanding, for example, as shown in the aforementioned article, particularly long. Investigations and considerations of the Applicant have now shown that even at much earlier sampling times a high entropy per time of the signal can be expected. In particular, it is possible to specify the entropy for a ring oscillator circuit with n inverters as a function of the standard deviation σ of the jitter J. For relles x and integer z, define the functions r _z (x) with:

the function r _z (x) is almost everywhere with the expression Θ (x - z + 1/2) - Θ (x - z - 1/2) (Equation 3) where Θ is the Heaviside function. One can define the quantity p _{n, i} (for odd n and natural numbers i with 0 <i <2n) as a probability that when sampling the n inverter the i-th Ring oscillator state is assumed, wherein the 0-th ring oscillator state is defined by the fact that the expected value of the sample times in the middle of the 0-th ring oscillator state. The variable i can be understood as a status number. The state of a ring oscillator results from the possible logic levels at the inputs and outputs of the inverters. p _{n, i} is defined by:

so that finally the entropy H (σ) can be determined by:

Due to the relationship between the standard deviation of the thermal jitter contribution and the entropy, a preferred sampling instant t _p can be determined which entails a maximum entropy per time.

The 3 shows the dependence of the expression A (σ) = H (σ) / σ ² on the standard deviation of the Gaussian jitter in units of the gate transit time G. It can be seen that the entropy or the expression A (σ) is a maximum at about 0 Has 3 gate run times. Converted to a sampling time or a preferred time t _p for sampling, approximately t _p = 0.113846 (G / σ) results in ² gate cycle times.

An even distribution of the bits between 0 and 1, however, is rather unexpected in the early sampling in a suitable interval Δt around the preferential time t _p (corresponding to σ _max ). Rather, a skewed random distribution between 0 and 1 or not uniformly distributed random bit pattern ZB ₁ -ZB _n results, which can be reworked. By reworking an existing skew of the bits or a non-uniform distribution of the resulting bit pattern can be compensated. Possible methods for postprocessing are, for example, in A. Juels, M. Jakobsson, EAM Shriver and B. Hillyer: "How to Turn Loaded into Fair Coins", IEEE Transactions on Information Theory, Vol. 3, pages 911-921 (2000) mentioned. The control device 3 can perform a corresponding algorithmic post-processing.

Applicant's investigations have revealed that a favorable standard deviation σ for the accumulated Gaussian jitter is about 0.33747138 gate transit times. This results in a much earlier sample than in conventional samples, which occur when the standard deviation σ of the jitter is greater than the nominal period T of the ring oscillator with the inverters 2 ₁ - 2 _n is. The expression A (σ) can be determined numerically and a corresponding favorable preferred sample at the sampling time t _p can be stored in a memory 5 the control device 3 be enrolled.

The Applicant has also carried out numerical and experimental investigations on ring oscillators of length n = 31. The evaluation of a corresponding curve, as described in the 3 is shown schematically, that an optimum sampling time, ie a preferred time for sampling t _p is 2.516.36 G. This corresponds to 40.59 ring oscillator periods T. According to the conventional reading, as described, for example, in the article by Haddad et al. is suggested, the optimum sampling time t _{p would have} to be 1.366 million ring oscillator periods. In this respect, the proposed approach leads to a significantly improved efficiency for the generation of random bits. This gives a more efficient, for example, power-saving generation of random bits or random levels.

The random bits ZB ₁ -ZB _n recorded as bit patterns are, for example, transmitted by the control device 3 subjected to a suitable post-processing procedure to ensure an even distribution. For example, one can use a series of raw data bits generated in memory 5 or 7 caching and subjecting to a cryptographic hash function. The cryptographic hashing is done for example by a processor device 6 in the control device 3 , The control device 3 may also be a computer or other computer that performs or provides appropriate algorithms. Other algorithms for post processing are conceivable for generating equally distributed bits or bit patterns from the sampled bits or bit patterns.

The device according to 1 is now further configured to measure the jitter of the ring oscillator. This can be done in particular in a hardware unit, so that not necessarily a prior programming of the respective sampling rates and times is necessary. Rather, a corresponding random number generator can calibrate itself and adjust to the favorable operating point. For this purpose, the controller uses 3 a distribution of regularly sampled simultaneously random signals ZS ₁ -ZS _n . The resulting jitter distribution and thus the standard deviation of the jitter can be determined in this way.

To explain the procedure is first in the 4 an example of a ring oscillator circuit with five inverters shown. The inverters 2 ₁ - 2 ₅ are cyclically linked together, so that at each inverter output in each case a logic level, which is designated ZS ₁ , ZS ₂ , ZS ₃ , ZS ₄ , ZS ₅ , is present. The ring oscillator of length five can assume ten oscillator conditions. In this case, a ring oscillator state is characterized by the respective bit pattern which results at the outputs of the inverters. For this purpose, the outputs are arranged in order in the order of the signal flow.

The 5 shows a table in the ring oscillator states RZ from 0 to 9 for the in the 4 shown ring oscillator are shown. The states are numbered from zero to nine. In columns ZS ₁ -ZS ₅ , the respective logic levels are at the output of the respective inverter 2 ₁ - 2 ₅ indicated. In the inverters, the logical relationship between the input and output signals is given by a logical inversion. For example, starting from a ring oscillator state 0, the bit pattern BM ₀ = 001010 may be present. One notes that between the inverters 2 ₁ and 2 ₂ the logical relationship is violated. That is, the ring oscillator state will jump to the second state designated by the bit pattern BM ₁ . The inverter 2 ₂ then suddenly provides an output level 1 or H as the output signal ZS ₂ . The logical incongruence has now moved further and lies between the inverters 2 ₂ and 2 ₃ before.

In the operation of the ring oscillator so far always a level change continues with the respective gate running time. The ring oscillator runs consecutively through the states 0 to 9, as it is in the 5 is indicated. State 9 is followed by state 0 again. That is, bit pattern BM _{9 is} followed by bit pattern BM ₀ . Transferred to the device according to 1 initiates the control device 3 Simultaneous scanning of the inverters 2 ₁ - 2 _n present output signals, which are initially in the memory 7 are stored and as a bit pattern BM _i in the memory device 9 be filed. The sampling takes place regularly at times t _ti . In this respect, a distribution of the bit pattern BM _i results over time.

From the resulting distribution, the standard deviation or variance of the jitter is determined. The Applicant has carried out investigations on a ring oscillator with 31 inverters. For this purpose, a FPGA Spartan-3 was used. In each case, 1,999 sample bit patterns were detected at sampling instants t _ti after 1 to 1,999 clocks, with one clock lasting 20 ns. In a 31 inverter long ring oscillator 62 Ringoszillatorzustände with bit patterns BM _i (i = 0 - 61) are possible. In a first examination, a delay time between starting and sampling was 20 ns after setting the start signal (see CT ₁ in 1 ) and detects a respective sample bit pattern. It has been found that, after this short delay time of Δd, the same state is sampled each time. That is, there is no detectable jitter with the method. In further investigations with longer delay times, which allow accumulation of the jitter, a substantially Gaussian distribution of the ring oscillator states results.

In the 6 a distribution of the measured ring oscillator states RZ is plotted with their frequency. It was sampled 2,000 times with a delay time Δd of 1,400 ns. It can be seen that the ring oscillator state designated by 51 has occurred most frequently. However, the adjacent ring oscillator states 50, 52, 53 and 54 have also been detected as sample bit patterns. The dashed curve VK indicates a distribution, which may be Gaussian in particular.

One can now from the determined distribution in 6 determine the standard deviation. In terms of time, the ring oscillator states are each shifted by an average gate transit time G. In this respect, according to the applicant's investigations, a standard deviation of 0.717 <G> (average gate transit time) could be determined.

When determining the standard deviation, it is preferably taken into account that the states follow one another cyclically. That is, state 61 is followed by state 0 at the 31-inverter long ring oscillator. In this respect, it may be favorable to select the standard deviation in a representative system which is selected modulo the number of possible oscillator ring states.

If the jitter exceeds half a period of the ring oscillator, a reliable assignment of a ring oscillator state as an expected value is made more difficult. Nevertheless, assuming a Gaussian normal distribution for the jitter, a standard deviation or variance can be meaningfully determined. However, particularly large jitter are not absolutely necessary for a reliable random number generation, because it comes, as regards the 3 explained to the highest possible entropy per time. In this respect, the jitter determination, in particular up to standard deviations that are smaller than T / 2, allows a particularly favorable Zufallsbiterzeugung.

In this respect, a combination of the jitter determination in ring oscillator circuits on the basis of the multiply sampled sampling bit pattern and a sampling time adapted for the random jitter generation as a function of the detected jitter results in a possibility of producing reliable random bits with a high production rate on-chip and without further measures.

Although the invention has been further illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• P. Haddad, Y. Teglia, F. Bernard and V. Fischer: "On the assumption of mutual independence of jitter realizations in P-TRNG stochastic models", DATE Conference 2014 [0058]
• A. Juels, M. Jakobsson, EAM Shriver and B. Hillyer: "How to Turn Loaded into Fair Coins", IEEE Transactions on Information Theory, Vol. 3, pages 911-921 (2000) [0063]

Claims (13)

Method for measuring a jitter in a ring oscillator circuit ( 1 ) comprising: providing a ring oscillator circuit ( 1 ) with a number of gate circuits ( 2 ₁ - 2 _n ) for generating an oscillation signal (OS) generated by the gate circuits ( 2 ₁ - 2 _n ) propagates; simultaneous sampling of the respective oscillation signal (OS) at outputs of several gate circuits ( 2 ₁ - 2 _n ) at a plurality of sampling instants (t _ti ) for generating a respective sample bit pattern (BM _i ), wherein a sample bit pattern (BM _i ) is associated with a ring oscillator state; Storing the sample bit patterns (BM _i ); Assigning a respective sample bit pattern (BM _i ) to a state number modulo twice the number of gate circuits ( 2 ₁ - 2 _n ), wherein successive state numbers correspond to ring oscillator states occurring in temporal succession; Determining a state distance as the difference between state numbers of successive sampling bit patterns (BM _i ) or as the difference between the state number of the first sampling pattern after starting and the state number of the starting state, or as the state number of the respective sampling bit pattern (BM _i ) after starting the ring oscillator circuit; Determining a distribution of the state distances over the number of sampling times (t _ti ); and determining a standard deviation and / or variance of the state distances from the distribution of the state distances as standard deviation and / or variance of the jitter. The method of claim 1, wherein a new start signal (S) is injected prior to each simultaneous sampling. Method according to Claim 1 or 2, wherein a delay time (Δd) between sampling instants (t _ti ) and / or between a starting time (t _s ) and a subsequent sampling instant (t _ti ) is constant. A method according to claim 3, wherein the oscillation signal (OS) has a medium period (T) and a number of period cycles are measured during the delay time (Δd). Method according to claim 3 or 4, further comprising: counting the level changes to an output of at least one gate circuit ( 2 ₁ - 2 _n ) during the delay time (Δd). The method of any one of claims 1-5, further comprising: generating a further oscillation signal (OS) generated by the gate circuits ( 2 ₁ - 2 _n ) and has a nominal period T, the further oscillation signal (OS) being supplied with at least one jitter contribution (J) and an entropy (H (σ)) of the ring oscillator circuit ( 1 ) depends on the standard deviation σ of the jitter; Scanning the respective further oscillation signal (OS) at outputs of a plurality of gate circuits ( 2 ₁ - 2 _n ) at a sampling instant (t _t ) as random signals (ZS ₁ -ZS _n ), the sampling instant (t _t ) being dependent on the determined standard deviation and / or variance of the jitter of the ring oscillator circuit ( 1 ) is determined; and assigning respective logic levels to the sampled oscillation signal (OS) to generate a plurality of random bits (ZB ₁ -ZB _n ). Method according to claim 6, wherein after the sampling instant (t _t ) the ring oscillator circuit ( 1 ) is restarted. The method of claim 6 or 7, wherein the sampling time (t _t ) in a predetermined time interval (At) by a preferred time (t _p ) is selected, and wherein the preferred time (t _p ) is selected such that the standard deviation σ of the jitter Has value at which the entropy has a maximum per time. The method of claim 8, wherein each gate circuit has a gate transit time G, and the preferential time point (t _p ) is 0.113846 G ² / σ _G 2 gate transit times after a start or a directly preceding sample of the further oscillation signal (OS), where σ _{G is} the Standard deviation of the gate transit time is The method of claim 8 or 9, wherein the predetermined time interval is selected such that the standard deviation of the jitter accumulated in the time interval is less than one-tenth of the nominal period T. Method according to one of claims 8-10, wherein the random bits (ZB), in particular for eliminating a skewness or a correlation of successively generated random bits, are subjected to an algorithmic post-processing. Apparatus for generating random bits (ZB) with a ring oscillator circuit ( 1 ), which comprises a plurality of gate circuits ( 2 ₁ - 2 _n ), a scanning device ( 4 ) and a control device ( 3 ), wherein the control device ( 3 ) is arranged to perform a method according to any one of claims 1-11. Device according to claim 12, wherein the control device ( 3 ) a memory device ( 5 ) for storing the standard deviation and / or variance of the jitter, the nominal period and / or the gate transit time.

Images