JP2003108363A - Random number generation circuit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a random number generation circuit that generates random numbers of high genuineness and permits to convert it into a small integrated circuit. SOLUTION: In an astable vibrator (10A), such an element is introduced that circuit element characteristic determining the vibration period thereof tends to fluctuate temporally based on a physical phenomenon, and the vibration period of the vibrator is made to fluctuate temporally and irregularly. By reading the vibrator signal fluctuating irregularly with a counter on a fixed clock, it becomes possible to acquire a random digital signal train of 0 and 1.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a random number generation circuit, and more particularly, it generates a random number which can be compactly constructed by a digital logic circuit and has a high degree of authenticity, and is suitable for use in a cryptographic algorithm. Regarding the circuit.

[0002]

2. Description of the Related Art Digital random numbers are used for simulation of phenomena involving stochastic processes, generation of cryptographic keys in cryptographic algorithms used for security, and the like. Conventionally, as the digital random number, a "pseudo-random number" created by a CPU has been used. This pseudo random number is typically made by a logic circuit called a “feedback shift register”.

On the other hand, a method of generating random numbers using noise generated in resistors and diodes has been put into practical use. In this case, bias and periodicity are not seen in the random numbers, and the ones close to the “true random numbers” can be obtained. In this type of random number generator, noise generated by passing a constant current through the noise source element is passed through a high-pass filter circuit,
The AC component is taken out, amplified by an analog circuit, then AD-converted and digitized. At this time, a certain value is set as a threshold value, a value exceeding the threshold value is set to “1”, and a value below the threshold value is set to “0”. Further, since the random number sequence that appears is biased, it is often used after being corrected by a digital circuit.

[0004]

A pseudo random number generated by a CPU generates the same random number if it has the same number (seed) at the beginning, and has periodicity based on the number of registers. It is known that it is not suitable as a random number. Especially, when it is used for security, it causes a risk of breaking the "encryption key".

On the other hand, in the case of a type that amplifies noise, thermal noise and shot noise of resistors and diodes are generally analog signals, and since the output is small, the configuration of the analog amplifier circuit becomes large and integrated. , It is difficult to miniaturize. In particular, it is difficult to incorporate it in a small device such as an IC card equipped with a cryptographic security function.

That is, there is a demand for a small integrated circuit which generates high-quality random numbers having no periodicity.

In order to reduce the size, it is desirable to use a digital circuit such as TTL or CMOS. However, since a digital circuit basically gives the same output to a certain input, it can only generate random numbers by algorithmic processing. Therefore, like the feedback shift register, only pseudo random numbers can be generated.

In order to solve this contradiction, it is necessary to make a circuit whose output is uncertain by using a digital circuit.

The present invention has been made based on the recognition of such problems. That is, it is an object of the present invention to provide a random number generation circuit which can generate a highly random number and can be made into a small integrated circuit.

In order to achieve the above object, a random number generation circuit of the present invention comprises an uncertain output circuit for generating an uncertain digital signal sequence, and the uncertain output circuit is "0". The level and the “1” level are alternately output, and the characteristics of at least one of the circuit elements that determine the time for holding the “0” level and the “1” level are changed with time, It is characterized by having a multivibrator in which any one of the time for holding the "0" level and the "1" level varies.

According to the above configuration, an uncertain signal sequence can be obtained according to variations in the characteristics of the elements constituting the multivibrator, and the random number generation circuit can be constructed with a small number of logic gates, so a small scale circuit is sufficient. .

Here, if the uncertain output circuit further includes a counter for reading the signal train of the "0" level and the "1" level output from the multivibrator at a constant cycle, An uncertain digital signal train can be obtained from the signal train from the multivibrator.

Further, the constant period read by the counter is sufficiently longer than the average transition period in the signal train of the "0" level and the "1" level output from the multivibrator. Then, the influence of the periodicity of the signal sequence output from the multivibrator can be eliminated.

Further, assuming that the varying characteristic of the circuit element is the channel resistance of the MOS transistor, by forming a trap in the gate insulating film,
The output from the multivibrator can be indeterminate.

Further, based on the appearance frequency counted by the counting circuit, a counting circuit for counting the appearance frequencies of "0" and "1" in the indeterminate digital signal sequence outputted from the indeterminate output circuit. By further providing a feedback circuit for giving a feedback signal to the circuit element of the multivibrator, it is possible to suppress "bias" in the digital output train from the uncertain output circuit.

Further, there is further provided a logical operation circuit for calculating an exclusive OR of a plurality of digital signals included in the uncertain digital signal sequence outputted from the uncertain output circuit and outputting the operation result as a random number. Assuming that
A random number without "bias" can be obtained.

Alternatively, the exclusive OR of the digital signal train in which the appearance frequency of "0" and "1" is 1: 1 and the uncertain digital signal train output from the uncertain output circuit. If a logical operation circuit that calculates and outputs the operation result as a digital random number sequence is further provided, a random number sequence without “bias” can be obtained.

[0017]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings.

FIG. 1 is a block diagram showing the essential structure of the random number generation circuit of the present invention.

That is, the random number generation circuit of the present invention comprises the uncertain output circuit 10 and the equalization circuit 20 which receives the output thereof.

The uncertain output circuit 10 includes an astable multivibrator 10A composed of a digital circuit and a counter 10.
B and. The astable multivibrator 10A is provided with an element in which the resistance value of the resistor or the capacitance of the capacitor that determines the vibration cycle easily fluctuates with time based on a physical phenomenon, and the vibration cycle of the multivibrator is temporal. It is supposed to fluctuate irregularly.

Then, the counter 10B reads out the vibrator signal thus fluctuating irregularly at a constant clock, whereby a random digital signal sequence of "0" and "1" can be obtained.

Since the arrangement of the digital signal sequences of "0" and "1" obtained by this method depends on the characteristics of the elements constituting the multivibrator, the frequency of appearance of "0" and "1". "Bias" may occur in.

Therefore, in such a case, the homogenization circuit 20 digitally processes them again to eliminate the bias and obtain a digital random number having a high degree of authenticity.

In this way, the random number generation circuit can be constructed with a small number of logic gates, so that a small-scale circuit is sufficient.
The circuit for correcting the frequency of "0" and "1" can also be configured by a relatively small-scale logic circuit.

Further, in the present invention, the equalizing circuit 20
Is not essential, and if the digital random number sequence output from the uncertain output circuit 10 is sufficiently uniform, it is not necessary to provide the uniformizing circuit 20.

The astable multivibrator used in the uncertain output circuit 10 of the present invention will be described below.

FIG. 2 is a schematic diagram showing a digital circuit which is usually called an "astable multivibrator". This astable multivibrator has two NAND circuits 11 and 12 connected in a flip-flop type, a resistor R1,
It has a configuration in which R2 and capacitors C1 and C2 are connected to each other.

This multivibrator starts its operation when the control input on the B side is turned on. That is,
First, assuming that the control input on the B side is "0" (that is, the capacitor C2 is empty), the NAND circuit 12
Output becomes "1" and the capacitor C1 on the A side starts charging. When charging proceeds to a certain point, the input on the A side becomes "0", so the output of the NAND circuit 11 on the A side becomes "1", and this time starts charging the capacitor C2 on the B side. Since this is repeated alternately, the NAND on the A side
The output of the circuit 11 is an alternating repetition of "1" and "0".

The cycle of this repetition is as follows:
Determined by the charging time of C2, the capacity of the capacitor and the resistance R
It is proportional to the product of the size of 1 and R2, that is, (C × R).

In the case of the multivibrator shown in FIG. 2,
The repetition cycle is about 0.7 (C1R1 + C2R
2)

In the present invention, the unique elements are arranged so that the repetition cycle varies.

FIG. 3 is a schematic view illustrating the structure of the main part of the multivibrator used in the random number generation circuit of the present invention.

That is, the astable multivibrator shown in the figure has at least one of the resistors R1 and R2,
It has a structure in which the channel resistance is replaced with a special MOS transistor 14 having temporal fluctuation.

FIG. 4 is a conceptual diagram illustrating the structure of the main part of the MOS transistor 14.

Gate insulating film 1 of this MOS transistor
A plurality of electron traps T are formed in 4G. Electrons passing through the channel 14C tunnel through the insulating film 14G and are frequently trapped by the trap T, and the device parameters are adjusted so that the trapped electrons can tunnel to the channel 14C.

The electron trap T is formed by, for example, dispersing silicon nanocrystals in an insulating film of a silicon oxide film, or using SiON _x (silicon oxynitride) having many electron traps as the insulating film 14G. be able to.

Alternatively, the electron trap T can be formed in the insulating film 14G by interrupting the process of forming the insulating film 14G and exposing it to a different gas atmosphere to introduce defects and impurities. Is.

When the electrons are trapped in the trap T, Coulomb interaction scatters the electrons moving in the channel 14C near the interface with the insulating film 14G to increase the channel resistance.

Therefore, in designing the MOS transistor 14, the channel 14C is narrowed down to capture and desorb electrons from the electron trap T, and
It is desirable to adjust the initial gate voltage so that the channel resistance of the OS transistor fluctuates by several tens of percent with respect to its average value. Further, the narrower the gate width (channel width) is, the larger the fluctuation rate of the channel resistance becomes, and therefore a MOSFET having a narrow gate width is desirable.

Since the cycle of the multivibrator is determined by the capacitances of the capacitors C1 and C2 and the channel resistance of the MOS transistor 14 (more strictly, the parasitic capacitance of the transistor 14 also affects), the channel resistance of the transistor fluctuates by several tens of percent. Also, the cycle of the multivibrator fluctuates by several tens of percent.

FIG. 5 is a schematic diagram showing a state in which the channel resistance of the transistor fluctuates with time. The frequency or pitch of this "fluctuation" is naturally not constant, and its amplitude is not constant either. The frequency of occurrence of “fluctuation” depends on the frequency of trapping electrons in the trap T and the staying time of electrons in the trap T. Therefore, the type of trap T and its forming condition can be adjusted so that the frequency of occurrence of “fluctuation” is in the optimum range.

Besides the MOSFET, a phototransistor or a photodiode can be used. P in FIG.
An example of using an IN photodiode will be shown. The photodiode 21 is an element that senses feeble light and converts it into photocurrent. Based on that principle, when light is applied, the resistance changes significantly depending on the amount of light. Therefore, a small LED type light emitting element 22 is installed near the photodiode so that the light emitting element operates with a control voltage for operating the multivibrator circuit. Since the light quantity of the light emitting element fluctuates due to noise or the like, the photodiode changes the resistance component in response to the fluctuation, so that the cycle of the multivibrator also changes accordingly. Since the light amount of the light emitting element 22 may be weak, a high electric field may be applied to the drain of a MOSFET having a sub-μm-sized gate to generate hot electrons, and light emission may be used in the process of relaxation.

In the present invention, by providing the transistor 14 in which "fluctuation" occurs in this way,
Destabilizes the operation of the astable multivibrator.

FIG. 6 is a conceptual diagram illustrating an output signal obtained from the astable multivibrator according to the present invention. In this way, changes in digital signals that are not in a constant cycle
When read by the counter 10B having a cycle sufficiently longer than the cycle of this change, the value becomes a 1-bit random number sequence.

Here, the reason why the reading cycle of the counter 10B is made sufficiently longer than the cycle of change of the output signal of the multivibrator 10A is to prevent the obtained random number sequence from having periodicity. In order to sufficiently reduce the periodicity, it is desirable that the reading cycle of the counter 10B be 10 times or more than the changing cycle of the output signal of the multivibrator 10A.

If the digital random number sequence thus obtained is sufficiently uniform, it can be used as it is as a random number sequence.

On the other hand, when the occurrence probability of “0” and “1” in the random number sequence thus obtained is “biased”, the homogenization circuit 20 corrects the “bias”.

Therefore, the equalizing circuit 20 will be described next.

FIG. 7 is a conceptual diagram for explaining the operation of the equalizing circuit in this embodiment.

As shown in the figure, the uncertain output circuit 10
, Qn + k, and XOR (exclusive OR) logical operation is performed on these k + 1 pieces of data. Let T be the result. In the output of the uncertain output circuit 1, if the appearance probability of "1" is p and the appearance probability of "0" is 1-p, the probability that T becomes 1 is 0.5 + 0.
5 · (1-2p) ^{k + 1} . The larger k becomes,
The probability approaches 0.5 and the bias is corrected.

In the SR-FF actually prototyped in the above-mentioned first embodiment, the "bias" was large and was approximately p = 0.1. When k = 10, the probability that T becomes 1 is 0.54.
3, it becomes 0.505 when K = 20 and approaches 0.5005 and 0.5 when K = 30, and is almost “biased”
Disappears.

When k becomes large, the random number generation speed becomes slow. However, if the power ON / OFF cycle is set to 30 MHz, for example, even if k = 30, about 1 Mbit /
Since it is possible to generate a digital random number sequence at a speed of seconds, there are many cases where this does not pose a problem in practical use.

The random number sequence data thus obtained may be used as a seed of the feedback shift register.

Further, by using the method described below, the appearance probabilities of "0" and "1" can be easily equalized.

That is, if the probability that the digital signal P is "1" is p and the probability that the digital signal Q is "1" is q, the calculated value T of the exclusive OR (XOR) of P and Q is The difference between the probability of being “1” and the probability of being “0” is represented by the following equation. 4 (0.5-p) (0.5-q) ... (1) Therefore, if "the probability that P becomes" 1 "is 0.5",
Even if the probability that Q becomes "1" is not 1/2, the appearance probabilities of "0" and "1" of the arithmetic value T of the exclusive OR of P and Q become equal.

Here, as shown in FIG. 10, when the input signal to the counter 10B is branched and put into the T-type flip-flop 20B, the period becomes a doubled signal, which is a signal of the uncertain output circuit 10. A signal in which "0" and "1" are alternately arranged at the same timing as the output. This signal naturally has the same appearance rate of "0" and "1". Therefore, when the exclusive OR of this signal and the signal of the uncertain output circuit 10 is taken,
In the calculation output T, the occurrence probabilities of “0” and “1” are naturally equal, and the arithmetic output T can be used as a digital random number sequence having high authenticity.

Further, as shown in FIG. 11, the pseudo-random number R generated by the feedback shift register (FSR) 20C at the same clock as the counter 10B outputs "0" and "1" evenly. If the exclusive OR of this and the output of the uncertain output circuit 10 is taken, the calculated value T can be used as a digital random number sequence having high occurrence rates of "0" and "1" being equal.

On the other hand, in the present invention, the "bias" can also be corrected by monitoring the output of the uncertain output circuit 10 and applying feedback.

FIG. 10 is a schematic diagram showing the configuration of the main part of such a random number generation circuit.

In this example, the homogenizing circuit 20 adds feedback to the gate 14G of the transistor 14 of the astable multivibrator. By such feedback, the appearance probabilities of “0” and “1” of the uncertain flip-flop can be made close to even.

That is, in the figure, the output of the uncertain output circuit 10 is counted by the digital counter 20D, and the feedback circuit 20E outputs a predetermined gate voltage according to the difference between the counts of "0" and "1". It is applied to the gate 14G of the MOS transistor of the multivibrator.

Then, the magnitude of the relative fluctuation of the channel resistance of the MOS transistor 14 is adjusted, and "bias" occurs.
Can be modified.

Also in this case, as described above with reference to FIGS. 7 to 9, by combining the logic circuits for eliminating the “bias”, the “bias” of the random numbers can be further reduced. in this case,
Since the number of data k for which the above-mentioned XOR is taken is small, the random number generation speed can be increased.

The embodiments of the present invention have been described with reference to specific examples. However, the present invention is not limited to the above specific examples.

For example, the specific configurations of the uncertain output circuit and the equalizing circuit used in the present invention are not limited to the above-mentioned specific examples, and may be replaced with all circuits having similar functions or actions. Within the scope of the present invention.

In the specific example described above, only one of the NAND circuits of the multivibrator 10A has a MOS circuit.
Although the case where the transistors are arranged is shown as an example, they may be provided on both the A side and the B side.

Further, the capacitances C1 and C of the multivibrator
Either of the two may change with time.

Further, in the present invention, not only the astable multivibrator but also the "monostable multivibrator" or the "bistable multivibrator" can be used to form the same unstable output. Within the scope of the present invention.

Further, among the above-mentioned plurality of embodiments, a partial combination of a digital circuit of uncertain output and a circuit for correcting the frequency of digital output can be used as the random number generation circuit. It is included in the scope of the invention.

Although the digital random number generated by the random number generation circuit of the present invention can be used as it is, a new random number can be generated by using it as a seed of the feedback shift register.

[0071]

As described in detail above, according to the present invention,
In the astable multivibrator, a random number generation circuit can be configured with a small number of logic gates by introducing an element that makes its output unstable, so that a small circuit is sufficient.

At the same time, the equalizing circuit for correcting the frequency of "0" and "1" can be configured by a relatively small-scale logic circuit.

Since the phenomenon that is the basis of the random number is based on the physical phenomenon of the elements that constitute the astable multivibrator 10A, an uncertain output can be obtained for the same input. It is possible to obtain a high-quality random number that is different from a pseudo-random number that can estimate a random number without generating periodicity.

That is, according to the present invention, it is possible to realize a random number having a high degree of authenticity in a compact size and at a low price.
For example, the industrial advantage is great in that an inexpensive card system with reliable security can be realized by applying it to an IC card or the like.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a main part of a random number generation circuit of the present invention.

FIG. 2 is a schematic diagram showing a digital circuit usually called an “astabilized multivibrator”.

FIG. 3 is a schematic diagram showing a main part structure of a multivibrator used in the random number generation circuit of the present invention.

FIG. 4 is a conceptual diagram exemplifying a main structure of a MOS transistor 14.

FIG. 5 is a schematic diagram showing a state in which the channel resistance of a transistor fluctuates with time.

FIG. 6 is a conceptual diagram illustrating an output signal obtained from the astable multivibrator according to the present invention.

FIG. 7 is a conceptual diagram for explaining the operation of the equalizing circuit according to the present invention.

FIG. 8 is a schematic diagram showing another specific example of the equalizing circuit.

FIG. 9 is a schematic diagram showing another specific example of the equalizing circuit.

FIG. 10 is a schematic diagram illustrating a configuration of a main part of a random number generation circuit according to a specific example of the present invention.

FIG. 11 is a schematic view showing a multivibrator using a photodiode.

[Explanation of symbols]

10 Uncertain output circuit 10A astable multivibrator 10B counter 11, 12 NAND circuit 14 transistors 12C channel 12G gate insulation film 20 Uniformizer 20A XOR circuit 20B flip flop 20C FSR 20D digital counter 20E feedback circuit T trap 21 photodiode 22 Light emitting element

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Junji Koga             8th Shinsugita Town, Isogo Ward, Yokohama City, Kanagawa Prefecture             Ceremony company Toshiba Yokohama office (72) Inventor Ryuji Oba             8th Shinsugita Town, Isogo Ward, Yokohama City, Kanagawa Prefecture             Ceremony company Toshiba Yokohama office F term (reference) 5J049 AA01 AA17 CA03 CA10                 5J104 FA10

Claims (7)

[Claims] 1. An uncertain output circuit for generating an uncertain digital signal sequence, wherein the uncertain output circuit alternately outputs a "0" level and a "1" level, and outputs the "0" level. At least one of the circuit elements that determine the time for holding the “1” level changes with time, so that either the “0” level or the time for holding the “1” level is changed. A random number generation circuit having a varying multivibrator. 2. The uncertain output circuit further comprises a counter for reading a signal sequence of the "0" level and the "1" level output from the multivibrator at a constant cycle. A random number generation circuit according to item 1. 3. The constant cycle read by the counter is the "0" output from the multivibrator.
3. The cycle is sufficiently longer than the average transition period in the signal sequence of the level and the "1" level.
The described random number generation circuit. 4. The characteristic of the varying circuit element is MO
4. The random number generation circuit according to claim 1, wherein the random number generation circuit is a channel resistance of an S transistor. 5. A count circuit for counting the frequency of appearance of "0" and "1" in the uncertain digital signal sequence output from the uncertain output circuit, and based on the frequency of appearance counted by the count circuit. The feedback circuit which gives the said feedback signal to the said circuit element of the said multivibrator, The random number generation circuit as described in any one of Claims 1-4 characterized by the above-mentioned. 6. A logical operation circuit for calculating an exclusive OR of a plurality of digital signals included in the uncertain digital signal sequence output from the uncertain output circuit and outputting the operation result as a random number. The random number generation circuit according to claim 1, wherein the random number generation circuit is a random number generation circuit. 7. An exclusive OR of a digital signal sequence in which appearance frequencies of "0" and "1" are 1: 1 and the indeterminate digital signal sequence output from the indeterminate output circuit. 6. A logical operation circuit for calculating and outputting the operation result as a digital random number sequence is further provided.
The random number generation circuit described in any one of 1.