JP2014075082A - Random number generator and random number generation method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a random number generator capable of assuring a random number with high randomness by a simple method.SOLUTION: A random number generator comprises a physical random number generation unit, a random number testing unit, and a compression unit. The physical random number generation unit generates random numbers due to a physical phenomenon in accordance with a first random number generation instruction. The random number testing unit executes random number testing processing on a first random number sequence with a predetermined length generated by the physical random number generation unit. The compression unit compresses the first random number sequence with the predetermined length generated by the physical random number generation unit into a second random number sequence on the basis of a testing result of the random number testing processing, and outputs it.

Description

  The present invention relates to a random number generator and a random number generation method for generating a random number.

  The random number generator is used for the purpose of generating information that cannot be estimated and reproduced by an attacker trying to decrypt. For example, in the security field, random numbers are used for various cryptographic protocols, such as generating keys such as public keys, secret keys, or common keys including one-time valid keys, and generating secret information that is sent only to the communication partner during cryptographic communication. A generator is used.

  An ideal random number requires a random phenomenon. Here, the random phenomenon means that each event occurs independently of other events in a certain phenomenon.

  Generally, as a random number generator that creates this random phenomenon, a random number generator that uses physical phenomena such as radiation, thermal noise, temperature, voltage, frequency, etc. looks like a true random number generator, but it is actually a cryptographic A pseudo-random number generator (Patent Document 1) generated by deterministic calculation using theory is used.

  In this regard, the pseudo-random number generator generates a value that is uniquely determined for a certain input value. Therefore, there is a problem that it is difficult to use when high security is required. On the other hand, since a true random number generator obtains randomness as a physical phenomenon, it is possible to obtain high randomness in random numbers.

JP 2009-3495 A

  On the other hand, since an intrinsic random number generator generates random numbers at a rate limited to a physical phenomenon, environmental conditions (specified operating range) when using the random number generator are provided. If the random number generator is operated outside the specified operating range by changing environmental conditions such as temperature, voltage, and frequency, the output value may be biased. Guarantee.

  However, providing a sensor circuit for monitoring the environmental conditions increases the cost of the chip.

  An object of the present invention is to provide a random number generator and a random number generation method, which have been made to solve the above problems, and can guarantee a random number with high randomness by a simple method.

  Other problems and novel features will become apparent from the description of the specification and the accompanying drawings.

  According to one embodiment, the random number generator includes a physical random number generation unit, a random number test unit, and a compression unit. The physical random number generation unit generates a random number due to a physical phenomenon in accordance with the first random number generation instruction. The random number test unit performs a random number test process on the first random number sequence having a predetermined length generated by the physical random number generation unit. The compression unit compresses the first random number sequence of the predetermined length generated by the physical random number generation unit based on the test result of the random number test process into a second random number sequence and outputs the second random number sequence.

  According to one embodiment, a random number test process is performed on a first random number sequence of a predetermined length generated by a physical random number generator, and a second random number sequence compressed based on the test result is output. It is possible to guarantee a random number with high randomness.

It is a figure explaining the structure of the random number generation system according to the first embodiment. It is a flowchart explaining the flow of the random number generation of the random number generation system according to the first embodiment. It is a figure explaining the structure of the random number generation system according to this Embodiment 2. It is a flowchart explaining the flow of the random number generation of the random number generation system according to the second embodiment.

  This embodiment will be described in detail with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and description thereof will not be repeated.

(Embodiment 1)
FIG. 1 is a diagram illustrating a configuration of a random number generation system according to the first embodiment.

  Referring to FIG. 1, the random number generation system according to the first embodiment includes a CPU (Central Processing Unit) 10, a random number generation unit 20 that generates and outputs a random number, a memory 15, and a bus 5.

  The CPU 10 is provided so as to be able to exchange data with the random number generation unit 20 and the memory 15 via the bus 5.

  The memory 15 stores a program necessary for the CPU 10 to control the random number generation system, and various processes are executed by reading the program.

  The CPU 10 controls the random number generation unit 20 and outputs a physical random number generation command and a random number verification command to the random number generation unit 20 when generation of a random number is necessary.

  The random number generation unit 20 receives and generates a random number in response to a physical random number generation command and a random number verification command, and outputs a desired random number sequence to the CPU 10.

  The random number generation unit 20 includes a control circuit 22 that controls each part in the random number generation unit 20, a physical random number generator 24, a compression circuit 26, and a random number test circuit 28.

  The control circuit 22 receives a physical random number generation command from the CPU 10 via the bus 5 and outputs a random number generation request to the physical random number generator 24. The control circuit 22 receives a random number test command from the CPU 10 via the bus 5 and outputs a random number test request to the random number test circuit 28. The control circuit 22 has a status register, and the CPU 10 can know the status of the physical random number generator 24 and the random number test circuit 28 through this status register. The status register includes a random number generation completion flag and a random number test completion flag.

  The physical random number generator 24 is a random number generator (intrinsic random number generator) that utilizes physical phenomena such as temperature, voltage, and frequency, and starts random number generation in response to a random number generation request from the control circuit 22. Is completed, the control circuit 22 is notified of this. In this example, a 20,000-bit random number sequence (first random number sequence) is generated as an example.

  The compression circuit 26 has a function of receiving the random number sequence generated by the physical random number generator 24 and compressing the input data to an arbitrary length, and stores the compression result in an internal register.

  The random number test circuit 28 receives the input of the random number sequence generated by the physical random number generator 24, statistically processes the input data, stores it in an internal register, and performs a random number test according to the random number test request from the control circuit 22 It has a function to execute processing, and stores a predetermined test result.

Next, the operation of the random number generation unit 20 according to the first embodiment will be described.
The control circuit 22 outputs a random number generation request and a random number verification request to the physical random number generator 24 and the random number verification circuit 28, respectively, according to the physical random number generation command and the random number verification command from the CPU 10.

  The physical random number generator 24 generates a random number in accordance with the random number generation request, and the generated random number sequence is input to the compression circuit 26 and the random number test circuit 28. The physical random number generator 24 notifies the control circuit 22 of completion of random number generation. As a result, the status register of the control circuit 22 validates the random number generation completion flag.

  The compression circuit 26 performs a predetermined compression process on the entire input first random number sequence to compress it into a second random number sequence having a desired length.

  The random number test circuit 28 receives the random number generated by the physical random number generator 24, stores the statistical processing result necessary for the random number test in an internal register, and also generates a random number based on a predetermined test method according to the random number test request. Execute the test process and save the test result. Then, when the predetermined random number test based on the statistical processing is completed, the control circuit 22 is notified of this.

  The control circuit 22 receives the notification of the end of the random number test from the random number test circuit 28, and validates the random number test completion flag in the status register.

  The CPU 10 confirms that the random number test completion flag in the status register is valid, and outputs a read command for the random number test result. The control circuit 22 outputs a read request to the random number test circuit 28 in accordance with a request for a read command for the random number test result. The random number test circuit 28 outputs a test result to the CPU 10 via the bus 5 in accordance with an instruction from the control circuit 22.

  FIG. 2 is a flowchart illustrating a flow of random number generation in the random number generation system according to the first embodiment. Here, processing in the CPU 10 is shown. For example, the processing is started in accordance with a request from an application that uses random numbers (for example, for key generation for data communication). It is assumed that the program for executing the flow is stored in the memory 15 and realized by reading the program stored in the memory 15.

  Referring to FIG. 2, first, CPU 10 issues a physical random number generation command and a random number test command (step S2). Specifically, the CPU 10 issues a physical random number generation command and a random number test command, and outputs them to the random number generation unit 20 via the bus 5.

  Next, the CPU 10 determines whether or not the random number test has been completed (step S4). Specifically, the CPU 10 reads the random number test completion flag in the status register of the control circuit 22 and determines whether the test is completed.

  When CPU 10 determines that the random number test is completed (YES in step S4), the process proceeds to next step S6.

  Next, the CPU 10 determines whether the random number test result is OK or NG (step S6). Specifically, the CPU 10 outputs a random number test result read command to the control circuit 22 so as to read the random number test result from the random number test circuit 28. The control circuit 22 outputs a read request so as to output the random number test result to the CPU 10 to the random number test circuit 28 in accordance with the request for the read command for the random number test result. The random number test circuit 28 outputs a random number test result to the CPU 10 via the bus 5 in accordance with a read request from the control circuit 22. Thus, the CPU 10 determines the random number test result.

  In step S6, when the random number test result is OK, the CPU 10 executes random number reading (step S8). Then, the process ends (END).

  Specifically, the CPU 10 outputs a read command so as to output a random number to the control circuit 22. The control circuit 22 outputs a read request so as to output a compressed random number sequence (second random number sequence) to the CPU 10 to the compression circuit 26 in accordance with a read command request from the CPU 10.

  The compression circuit 26 outputs a compressed random number sequence (second random number sequence) to the CPU 10 via the bus 5 in accordance with a read request from the control circuit 22.

  The CPU 10 receives the random number sequence output from the compression circuit 26 and uses it in cooperation with the application. Specifically, the random number sequence (second random number sequence) can be used as a key for data communication as an example.

  On the other hand, when the random number test result is NG in step S6, the CPU 10 determines whether or not NG has reached the specified number of times (step S10).

  In step S10, when CPU 10 determines that NG has reached the specified number of times (YES in step S10), CPU 10 determines that operation is not possible (step S12). Then, the process ends (END). In this case, it is determined that random number generation cannot be properly performed, and the process ends.

  In step S10, when CPU 10 determines that NG has not reached the specified number of times (NO in step S10), it returns to step S2 and restarts the random number generation process. The specified number of times is set to a predetermined number in advance.

Further, it may be determined that the operation is impossible without performing the determination in step S10.
In the method according to the first embodiment, when the random number test circuit 28 passes a random number test (OK determination) to the random number sequence (first random number sequence) generated by the physical random number generator 24, the compression circuit 26 The compressed second random number sequence is output to the CPU 10.

  That is, since it is the second random number sequence obtained by compressing the first random number sequence that has passed the random number test, it is possible to guarantee a random number with high randomness, and whether or not the true random number generator is operating normally. It is not necessary to provide a sensor circuit for the determination, and it can be realized with a simple configuration.

  In this example, the CPU 10 outputs a random number generation command and a random number verification command to the control circuit 22 and executes the random number generation in the physical random number generator 24 and the random number verification in the random number verification circuit 28 in parallel. As described above, the random number test in the random number test circuit 28 may be executed after the random number generation in the physical random number generator 24 is completed. In that case, for example, the CPU 10 outputs a random number test command to the control circuit 22, confirms that the random number generation completion flag in the control circuit 22 is valid, and then sends the random number test command to the control circuit 22. May be output. The same applies to the following embodiments.

  In this example, the case where the random number test circuit 28 executes the random number test process has been described. However, for example, the random number test process may be executed in cooperation with the CPU 10. Specifically, a detection circuit for detecting statistical data of random numbers is provided on the random number generation unit 20 side, and the determination part of the random number test process using the statistical data is stored in software (stored in the memory 15) using the CPU 10. The program may be executed using a random number test program that is provided. With this configuration, it is possible to simplify the configuration of the random number generation unit 20 by the CPU 10 executing various test methods. Further, by storing a plurality of random number test programs for executing various tests in the memory 15, it is possible to select a test method according to the security level of the usage of random numbers. The same applies to the following embodiments.

  In this example, the CPU 10 is connected to the outside of the random number generation unit 20 via the bus 5 and the random number is output from the compression circuit 26 via the control circuit 22 according to the instruction of the CPU 10. The function of the CPU 10 and the function of the control circuit 22 may be combined and provided in the random number generation unit 20 as one control circuit. Alternatively, the CPU 10 may execute the function of the control circuit 22 in the random number generation unit 20.

<Randomness test processing>
Various random number test processes executed by the random number test circuit 28 will be described. Note that it is not necessary to execute all random number tests, and an appropriate test may be executed as appropriate according to the intended use.

  Specifically, FIPS PUB140-2 is mentioned among information processing equipment procurement standards FIPS (Federal Information Processing Standards). The standard includes a monobit test that determines the statistic by counting the number of 1 values that appear in a binary sequence 20000 bits. There is also a poker test in which a binary sequence of 20000 bits is divided into 4-bit cells to create a total of 5000 cells, and the statistics are determined by counting the number of appearances of cell patterns 0 to 15 . In addition, there is a lands test in which a statistic is determined by counting the number of consecutive (sequential) numbers that appear in a binary sequence 20000 bits. There are various test methods such as a long-runs test for examining the length of the longest run among the runs appearing in the binary sequence 20000 bits.

  Further, as another random number test process, it is possible to use NIST Special Publication 800-22 published by the National Institute of Standards and Technology (NIST). There are a frequency test for checking whether the ratio of 0 and 1 in the random number sequence is approximately the same, and a binary matrix rank test for checking the bias of the rank of the matrix generated by the random number sequence. Also, a random number sequence consisting of 0 and 1 is regarded as a real value series of ± 1, and discrete Fourier transform is performed to decompose it into frequency components. There is a DFT test in which the randomness of a random number sequence is examined by obtaining a ratio at which the absolute value of each frequency component does not exceed a threshold. Random number sequence is divided into blocks, template fit test to check the number of times the template fits, universal statistic test to check the uniformity of the random number sequence, linear complexity test to check the periodicity of the random number sequence by finding the linear complexity Various test methods based on other standards such as an entropy test for testing whether m-bit patterns appear evenly can be applied.

<Compression processing>
A compression process in the compression circuit 26 will be described.

  Specifically, it is possible to perform compression using Langless coding, Huffman coding, Lempel-Ziv compression method, or the like.

  It is also possible to compress the first random number sequence using an encryption circuit. Specifically, an encryption process according to a cipher block chaining (CBC (Cipher Block Chaining)) mode of the common key cryptosystem is executed to compress the first random number sequence.

  In the cipher block chaining mode, a binary number sequence is divided into blocks, an exclusive OR logical operation is performed on the previous encrypted block and the current plaintext block to be encrypted, and then the encryption key is used. This block is encrypted. The resulting ciphertext is then used for an exclusive OR logic operation with the next block. In this way, encryption data is generated by chaining with the previous block one after another. Since there is no previous block at the beginning of the block, an exclusive vector is executed by giving an initial vector (IV). Further, the block length may be changed according to the compression length.

  It is also possible to compress the first random number sequence using a hash calculation circuit. Specifically, a hash function for outputting a desired bit length may be prepared in advance, and a first random number sequence may be input to the hash function and compressed by hash calculation processing.

(Embodiment 2)
FIG. 3 is a diagram illustrating a configuration of a random number generation system according to the second embodiment.

  Referring to FIG. 3, the random number generation system according to the second embodiment is different in that random number generation unit 20 is replaced with random number generation unit 21.

  The random number generation unit 21 is different from the random number generation unit 20 in that a deterministic random number generator 30 is further included and the control circuit 22 is replaced with a control circuit 23. Since the other configuration is the same as that described in FIG. 1, detailed description thereof will not be repeated.

  The deterministic random number generator 30 agitates the input value using a calculation formula and stores the result in an internal register. The input value is selectable from either the register value of the compression circuit 26 or the register value of the deterministic random number generator.

Next, the operation of the random number generation unit 21 according to the second embodiment will be described.
The control circuit 23 outputs a random number generation request to the physical random number generator 24 in accordance with a physical random number generation command from the CPU 10. Further, the control circuit 23 receives a random number test command from the CPU 10 via the bus 5 and outputs a random number test request to the random number test circuit 28. The control circuit 23 has a status register, and the CPU 10 can know the status of the physical random number generator 24 and the random number test circuit 28 through this status register. The status register includes a random number generation completion flag and a random number test completion flag.

  The physical random number generator 24 generates a random number in accordance with the random number generation request, and the generated random number sequence is input to the compression circuit 26 and the random number test circuit 28. Further, the physical random number generator 24 notifies the control circuit 23 of completion of random number generation.

  The compression circuit 26 performs a predetermined compression process on the entire input first random number sequence to compress it into a second random number sequence having a desired length.

  The random number test circuit 28 receives the random number generated by the physical random number generator 24, stores the statistical processing result required for the random number test in an internal register, and performs a predetermined test according to the random number test request from the control circuit 23. A random number test process based on the method is executed and the test result is saved. Then, when the predetermined random number test based on the statistical processing is completed, the control circuit 22 is notified of this. In response to the notification of the end of the random number test from the random number test circuit 28, the control circuit 23 validates the random number test completion flag in the status register.

  The CPU 10 confirms that the random number test completion flag in the status register is valid, and outputs a read command for the random number test result. The control circuit 23 outputs a read request to the random number test circuit 28 in accordance with a request for a read command for the random number test result. The random number test circuit 28 outputs the test result to the CPU 10 via the bus 5 in accordance with an instruction from the control circuit 23.

  FIG. 4 is a flowchart illustrating a random number generation flow of the random number generation system according to the second embodiment. Here, processing in the CPU 10 is shown. For example, the processing is started in accordance with a request from an application that uses random numbers (for example, for key generation for data communication). It is assumed that the program for executing the flow is stored in the memory 15 and realized by reading the program stored in the memory 15.

  Referring to FIG. 4, first, CPU 10 issues a physical random number generation command and a random number test command (step S2). Specifically, the CPU 10 issues a physical random number generation command and a random number verification command, and outputs them to the random number generation unit 20 via the bus 5.

  Next, the CPU 10 determines whether or not the random number test has been completed (step S4). Specifically, the CPU 10 reads the random number test completion flag in the status register of the control circuit 22 and determines whether the test is completed.

  When CPU 10 determines that the random number test is completed (YES in step S4), the process proceeds to next step S6.

  Next, the CPU 10 determines whether the random number test result is OK or NG (step S6). Specifically, the CPU 10 outputs a random number test result read command to the control circuit 23 so as to read the random number test result from the random number test circuit 28. The control circuit 23 outputs a read request so as to output the random number test result to the CPU 10 to the random number test circuit 28 in accordance with the request for the read command for the random number test result. The random number test circuit 28 outputs a random number test result to the CPU 10 via the bus 5 in accordance with a read request from the control circuit 23. Thus, the CPU 10 determines the random number test result.

  In step S6, if the random number test result is OK, the CPU 10 issues a deterministic random number generation command (step S20). Specifically, the CPU 10 issues a deterministic random number generation command and outputs it to the random number generation unit 21 via the bus 5. The control circuit 23 instructs the compression circuit 26 to output the compressed random number sequence in accordance with the deterministic random number generation command from the CPU 10 and outputs a random number generation request to the deterministic random number generator 30. Thus, the deterministic random number generator 30 receives the input of the random number sequence from the compression circuit 26 and generates a random number.

  Next, the CPU 10 reads out random numbers (step S22). Specifically, the CPU 10 outputs a read command so as to output a random number to the control circuit 23. In response to a read command request from the CPU 10, the control circuit 22 outputs a read request so as to output a compressed random number sequence (third random number sequence) to the CPU 10 to the deterministic random number generator 30.

  The deterministic random number generator 30 outputs a random number sequence (third random number sequence) generated to the CPU 10 in accordance with a read request from the control circuit 23 via the bus 5.

  The CPU 10 receives the random number sequence output from the deterministic random number generator 30 and uses it in cooperation with the application. Specifically, the random number sequence (second random number sequence) can be used as a key for data communication as an example.

  Next, the CPU 10 determines whether there is a request for random number generation (step S24). Specifically, for example, it is determined whether there is a request for random number generation again from an application that uses random numbers (for example, for key generation for data communication).

  If it is determined in step S24 that there is a request for random number generation (YES in step S24), the process returns to step S20. That is, a deterministic random number generation command is issued. Specifically, the CPU 10 issues a deterministic random number generation command and outputs it to the random number generation unit 21 via the bus 5. In accordance with a deterministic random number generation command from the CPU 10, the control circuit 23 instructs a value stored in a register inside the deterministic random number generator 30 as an input value, and requests a random number generation request for deterministic random number generation. To the device 30. As a result, the deterministic random number generator 30 regenerates a random number using the value stored in the internal register as an input value. Subsequent processing is the same as described above.

  That is, the CPU 10 executes reading of random numbers, and the CPU 10 uses the random number sequence output from the deterministic random number generator 30 in cooperation with the application.

  On the other hand, when the random number test result is NG in step S6, the CPU 10 determines whether or not NG has reached the specified number of times (step S10).

  In step S10, when CPU 10 determines that NG has reached the specified number of times (YES in step S10), CPU 10 determines that operation is not possible (step S12). Then, the process ends (END). The process is terminated because the random number cannot be properly generated.

  In step S10, when CPU 10 determines that NG has not reached the specified number of times (NO in step S10), it returns to step S2 and restarts the random number generation process. The specified number of times is set to a predetermined number in advance.

Further, it may be determined that the operation is impossible without performing the determination in step S10.
That is, for the first random number generation, the random number sequence compressed by the compression circuit 26 is input and the deterministic random number generator 30 generates a random number, but the second and subsequent random numbers are generated by the deterministic random number generator 30. Since a new random number is generated using the generated random number sequence as an input value, a high-speed random number sequence can be generated for the second and subsequent random number generation.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiments. However, the present invention is not limited to the embodiments, and various modifications can be made without departing from the scope of the invention. Needless to say.

  5 bus, 10 CPU, 15 memory, 20, 21 random number generation unit, 22, 23 control circuit, 24 physical random number generator, 26 compression circuit, 28 random number test circuit, 30 deterministic random number generator.

Claims (6)

A physical random number generator for generating a random number due to a physical phenomenon according to a first random number generation instruction;
A random number test unit for executing a random number test process on the first random number sequence of a predetermined length generated by the physical random number generation unit;
Random number generation comprising: a compression unit for compressing and outputting the first random number sequence of the predetermined length generated by the physical random number generation unit based on the test result of the random number verification process into a second random number sequence vessel.   The random number generator according to claim 1, further comprising a deterministic random number generator for generating a third random number sequence according to a predetermined algorithm based on the second random number sequence compressed by the compression unit.   3. The random number generator according to claim 2, wherein the deterministic random number generation unit generates a fourth random number sequence based on the generated third random number sequence in accordance with a second random number generation instruction. The compression unit includes an encryption circuit that outputs a second random number sequence encrypted with respect to the first random number sequence of the predetermined length,
The random number generator according to claim 1, wherein the encryption circuit executes an encryption process according to a CBC (Cipher Block Chaining) mode of a common key cryptosystem.   The random number generator according to claim 1, wherein the compression unit includes a hash calculation circuit that outputs a second random number sequence by hash calculation processing on the first random number sequence of the predetermined length. A random number generation method in a random number generator,
Generating a random number due to a physical phenomenon in accordance with a first random number generation instruction;
Performing a random number test process on the generated first random number sequence of a predetermined length;
And a step of compressing and outputting the first random number sequence of the predetermined length generated based on the test result of the random number test process into a second random number sequence.

Images