JP4363273B2 - Random number generator - Google Patents

Description

  The present invention relates to a random number generation circuit using a linear feedback shift register, and more particularly to a random number generation circuit that increases the complexity of a pseudo-random number sequence by using a plurality of asynchronous clocks.

  In the communication technology field and the like, information is usually encrypted in order to ensure protection and confidentiality of information. In this encryption technique, generally random numbers are often used. This random number is used not only for encryption but also for creating highly irregular conditions in, for example, the game field.

As means for obtaining this random number, a random number generating circuit that generates a pseudo random number using a linear feedback shift register (hereinafter abbreviated as LFSR) is known. The LFSR has a structure in which a predetermined register output side among a plurality of cascade-connected registers is fed back to the input side of the first register via an exclusive OR circuit. It is possible to obtain a pseudo-random number sequence having a long period enough to be regarded as a random number by performing a logical OR operation. For example, the pattern period of the pseudo random number sequence obtained from the LFSR composed of a plurality of (n) registers is the n-th order linear maximum period sequence 2 ⁿ −1.

FIG. 6 shows a schematic configuration example of a conventional random number generation circuit using a six-stage LFSR. The LFSR shown in the figure supplies a single common clock to each of the six cascaded registers 61-1 to 61-6, and performs exclusive OR operation on the outputs of the registers 61-2 and 61-6. This is configured to input to the circuit 62 and feed back the logical sum output of the exclusive OR circuit 62 to the input of the first register 61-1. The LFSR according to this configuration example can generate 63 (2 ⁶ -1) 6-bit pseudo random number sequences.

  However, although such a pseudo-random number sequence generated from the n-stage LFSR has a longer pattern periodicity as the n value increases, it is generated from this encryption circuit when it is used as a seed for the encryption circuit. There was a problem that the ciphertext had a high risk of being easily deciphered.

Therefore, as in the invention described in Patent Document 1, a basic clock signal is generated by providing a jitter component of a half cycle or more to the output of the oscillation means that oscillates at a constant frequency, and frequency division is performed based on this basic clock signal. There is known a random number generation circuit that amplifies jitter and supplies the amplified clock signal to sampling means to obtain random number data.
As an application example thereof, two asynchronous means that are asynchronous with each other are provided so that a clock component oscillated from one oscillating means has a jitter component as described above and does not include a jitter component oscillated from the other oscillating means. There is also known a random number generating circuit that supplies random number data together with a clock to obtain random number data.

Further, as in the invention described in Patent Document 2, a redundant register is provided in the previous stage of the LFSR and a selector circuit for selecting one from a plurality of types of clocks is provided, and one selector circuit is selected based on the output value of the redundant register. By selecting a clock and inputting it to the LFSR, the pseudo random number sequence obtained by the LFSR is disturbed in a time series, and the apparent cycle of the random sequence is longer than the cycle determined by the number of bits of the register and the redundant register. There is known a pseudo-random number sequence generation circuit that performs the above.
Japanese Patent Laid-Open No. 9-146761 Japanese Patent Laid-Open No. 10-207695

  However, in the invention described in Patent Document 1, especially when the random number generation circuit according to the first embodiment is incorporated in a semiconductor integrated circuit, the jitter component to be generated is easily distributed within a variation range of the semiconductor process. Therefore, there is a problem that the distribution of the generated random number sequence itself tends to be limited. Therefore, when the random number generation circuit is used in a cryptographic circuit as in the conventional LFSR described above, there remains a problem that the ciphertext generated from this cryptographic circuit has a high risk of being relatively easily deciphered.

  In particular, in the random number generation circuit according to the second embodiment, when the oscillation from the oscillation means that does not include the jitter component is stopped, the generation of the random number sequence itself stops functioning. Therefore, when this random number generation circuit is used as a cipher generation circuit, there is a problem that if this state occurs, the cipher is easily analyzed. Further, when this random number generation circuit is incorporated in a semiconductor integrated circuit, there is a problem that a metastable may occur depending on the phase difference between the clock input and the data input in the sampling means.

  Furthermore, in the pseudo random number generation circuit according to the invention described in Patent Document 2, it is necessary to realize a circuit using a plurality of types of clocks. However, implementation of a plurality of types of clock systems is complicated, for example, a high frequency There is a problem in that the signal quality of the circuit may be deteriorated due to the influence, the arrangement of parts for preventing the deterioration, or the cost of the parts may be affected. Further, when these plural types of clocks are realized as synchronous clocks having different frequencies, the pseudo-random number generation circuit realized using these synchronous clocks has a drawback that it is similar to an LFSR having a large number of stages. .

  Therefore, the present invention does not require a special jitter generation source, and does not require many kinds of complicated clock signals, can be easily mounted in a semiconductor integrated circuit, and can generate a random number sequence generated. An object is to provide a random number generation circuit that is extremely difficult to analyze.

  In order to solve the above-mentioned problem, the invention according to claim 1 cascade-connects m registers (31-1 to 31-m) each capable of inputting a latch enable signal for permitting data latch. The m stages having a configuration in which an output side of a predetermined register among the m registers is fed back to an input side of the cascaded leading register (31-1) via an exclusive OR circuit (32). In the random number generation circuit using the linear feedback shift register (12), asynchronous first and second clock signals (CK1, CK2) having different frequencies are supplied, and the first clock signal is counted. A counter unit that is used as an enable signal and counts with the second clock signal to output an n-bit count value ( 1) and a count decoder unit (21-1, 2) that generates a plurality of types of random number disturbance signals (EN1, EN2) by decoding the n-bit count value obtained by the counter unit based on a predetermined bit pattern. 21-2) and supplying the generated plural types of random number disturbance signals to the plurality of m-stage LFSRs (12-1, 12-2) as the latch enable signals, respectively, A plurality of types of random number sequences (RAN1, RAN2) are generated by supplying second clock signals to the same number of m stages of LFSRs as latch clock signals, respectively, and a predetermined number based on the generated types of random number sequences. It is characterized by having a configuration including a calculation unit (13) that generates a final random number sequence (RAN3) by the calculation of (1).

  According to a second aspect of the present invention, in the random number generation circuit according to the first aspect, the m value of the m-stage LFSR and the n value of the n-bit counter unit are made different. It is characterized by that.

  Furthermore, the invention according to claim 3 is the random number generation circuit according to claim 1 or 2, wherein the arithmetic unit receives a plurality of types of random number sequences obtained from the plurality of types of m-stage LFSRs as address values. It is characterized by comprising as a readable ROM.

  The random number generation circuit according to the present invention generates a plurality of types of random number disturbance signals generated based on two asynchronous clock signals with non-same frequencies from the same number of LFSRs provided in the subsequent stage. The pattern irregularity of the random number sequence can be remarkably enhanced as compared with the conventional method, and the result of calculation based on the random number sequence obtained by each LFSR is used as the final random number sequence, so that the conventional LFSR can be used. Compared to the pseudo-random number sequence, the irregularity can be remarkably improved.

  In addition, the random number generation circuit according to the present invention has an excellent effect that it can be realized particularly easily to be mounted on a semiconductor integrated circuit.

  The best mode for carrying out the random number generation circuit according to the present invention will be described below. First, FIG. 1 shows a schematic basic configuration example of a random number generation circuit according to the present invention. In the figure, a random number generation circuit 1 is supplied with two asynchronous clock signals CK1 and CK2 at different frequencies, and generates two asynchronous random number disturbance signals EN1 and EN2 based on these two clock signals. The random number disturbance signal generator 11, the random number disturbance signal EN1 and the clock signal CK2, and the random number disturbance signal EN2 and the clock signal CK2 are supplied to generate LFSR units 12-1 and 12 that generate two types of random number sequences RAN1 and RAN2, respectively. -2 and random number sequences RAN1 and RAN2 are supplied to each other, and a calculation unit 13 that generates a random number sequence RAN3 by performing predetermined calculation processing described later.

  Next, the detailed configuration and operation of each element of the random number generation circuit 1 shown above will be described. First, FIG. 2 shows a schematic configuration example of the random number disturbance signal generation unit 11. In the figure, the random number disturbance signal generator 11 is supplied with two clock signals CK1 and CK2, respectively, of which the clock signal CK1 is supplied as a count enable signal and the clock signal CK2 is supplied as a count clock signal. Based on the bit determination process of the counter unit 21 and the count output value from the counter unit 21 and a specific bit pattern set in advance, the count decoder units 22-1 and 22 that output the random number disturbance signals EN1 and EN2, respectively. -2. As is apparent from the overall schematic configuration diagram of FIG. 1, the number of random number disturbance signals output from the random number disturbance signal generation unit 11 is configured to be the same as the number of LFSR units.

  Here, the counter unit 21 is, for example, a binary m-bit counter that performs increment processing at the rising edge of the clock signal CK2 when the logic level of the clock signal CK1 is high. The m-bit value is an arbitrary set value, and may be determined by the circuit scale of the system in which the random number generation circuit 1 is mounted. However, the m-bit value is preferably different from the number of bits of the random number sequences RAN1 and RAN2 generated by the LFSRs 12-1 and 12-2 from the viewpoint of guaranteeing the irregularity of the generated random number sequence. .

  The count decoder units 22-1 and 22-2 are, for example, m-bit count output values supplied from the counter unit 21, and specific bit patterns preset in the count decoders 22-1 and 22-2, respectively. The random number disturbance signals EN1 and EN2 are each output as a low level when equal results are obtained. In this case, if the clock signals CK1 and CK2 are asynchronous with each other and the bit patterns set in the count decoder units 22-1 and 22-2 are different from each other, the random number disturbance signals EN1 and EN2 are respectively set to a fixed period. The irregularity of the period is guaranteed.

  The specific bit pattern set inside each of the count decoders 22-1 and 22-2 can be changed from the outside, and the user can freely set the bit pattern value by software control for each random number generation circuit. It may be possible to set to.

  Furthermore, at least one of the two clock signals CK1 and CK2 is used in a system including the random number generation circuit 1, for example, a cryptographic circuit system (not shown), in order to prevent illegal analysis of the generated random number. It is desirable to use an operation clock (system clock). This is because when the random number generation circuit 1 is mounted on a semiconductor integrated circuit, the operation of the entire system is attempted when the random number is analyzed by stopping the oscillation of either one of the two clock signals CK1 and CK2. This is because the analysis is practically impossible.

  Next, FIG. 3 shows a schematic configuration example of the LFSR unit 12-1. In the figure, the LFSR unit 12-1 includes six register units 31-1 to 31-6 with latch enable inputs and a 2-input 1-output exclusive OR unit 32. The LFSR unit 12-1, as shown in the figure, cascades the data input / output of each register unit sequentially with the register unit 31-1 as the first stage (the data input of the register unit 31-1 and the last register unit). 31-6), the clock signal CK2 is supplied to each clock input of these six register sections. Then, the random number disturbance signal EN1 is supplied to each latch enable input of these six register units, and the data output of each register unit of the registers 31-2 and 31-6 is supplied to the exclusive OR unit 32. The logical sum output of the logical OR unit 32 is fed back to the data input of the first register unit 31-1. The 6-bit data obtained from the data outputs of the register units 31-1 to 31-6 is the random number sequence RAN1.

  Here, as described above, each of the register units 31-1 to 31-6 includes the data input D, the data output Q, the clock input CK, and the latch enable input EN, and is supplied to, for example, the latch enable input EN. The data supplied to the data input D is taken in at the rising edge of the clock signal CK2 supplied to the clock input CK2 when the random number disturbance signal EN1 is at the high level and output to the data output Q, and the random number disturbance signal EN1 is at the low level. This is a so-called D flip-flop with a positive logic latch enable, in which data is not taken in at the rising edge of the clock signal signal CK2 and the data of the data output Q is held.

  In the present embodiment, the LFSR unit 12-1 has a six-stage register configuration, but the number of stages is not limited to this and may be a k-stage register configuration. As described above, it is desirable that the k-stage value has a different number of stages from the m-bit value of the counter unit 21. In addition, although the exclusive OR unit 32 has shown an example of a 2-input exclusive OR operation by feedback from the register units 31-2 and 31-6, this is not limited to this embodiment, and is exclusive. It is possible to arbitrarily set the number of inputs of the logical sum section 32 and the data output Q of which register section to supply data.

  Further, although a schematic configuration example of the LFSR unit 12-2 is not illustrated, it is functionally equivalent to the LFSR unit 12-1 shown in FIG. However, the random number disturbance signal EN2 is supplied to the latch enable inputs EN of a plurality of built-in register units, and a random number sequence RAN2 is output from each data output Q of these register units.

  Note that the number of register units in each of the LFSR units 12-1 and 12-2 may be the same or different. Also, the feedback logic of each LFSR unit may be the same or different. In the present embodiment, the following description will be made assuming that the number of register sections in each LFSR section is the same (six stages).

  The LFSR unit 12-1 generates the random number sequence RAN1 only while the random number disturbance signal EN1 is at a high level. Similarly, the LFSR unit 12-2 generates the random number sequence RAN2 only while the random number disturbance signal EN2 is at a high level. However, the random number disturbance signal EN1 or EN2 becomes low level at a completely different period from that of the LFSR 12-1 or 12-2, and the generation of the random number sequence RAN1 or RAN2 is stopped during this low level period. As described above, since the random number disturbance signals EN1 and EN2 have different timings at which they become low levels, the generation of the random number sequence does not stop at the same time even if the number of stages of both LFSR units is the same. That is, since the irregularity of the event is exhibited many times, it is practically impossible to predict when the operation of the LFSR unit is stopped from outside the random number generation circuit 1.

  Next, a schematic configuration example of the calculation unit 13 is shown in FIG. In the figure, the arithmetic unit 13 is supplied with 6 bits each of the random number sequences RAN1 and RAN2, and the exclusive OR operation is executed by the exclusive OR units 41-1 to 41-6 for each corresponding bit. This is an example of generating a final random number sequence RAN3.

  As described above in detail, in the random number generation circuit 1 shown in this embodiment, the two clock signals CK1 and CK2 supplied from the outside are asynchronous with each other at different frequencies, and the random number disturbance signal generation unit. Since the internal state of the 11 counter units 21 is determined by the clock phase at the time of power activation, it is almost impossible to reproduce the random number generation pattern even by turning the system power on and off.

  In particular, when the random number generation circuit 1 is mounted on a semiconductor integrated circuit and the clock signal CK1 or CK2 is used as a system clock of a system on which the semiconductor integrated circuit is mounted, any one of the clock signals is used to artificially analyze the random number sequence. Since the operation of the entire system is significantly affected by stopping the operation of the entire system, for example, an illegal operation analysis of the random number generation circuit 1 can be prevented.

  Further, in the random number generation circuit 1, since the clock signals CK1 and CK2 are asynchronous, depending on their phase relationship, the metastable is performed in the first register unit of the counter unit 21 or the LFSR unit 12-1, or 12-2. May occur. However, even if a metastable occurs in the first-stage register unit, it is unlikely that the metastable will be propagated to the register units in the second and subsequent stages. Since the possibility of the occurrence and the entire operation being stopped is further reduced, the configuration of the random number generation circuit 1 shown in this embodiment is extremely reliable.

  As another form of the random number generation circuit, not only two types of clock signals CK1 and CK2 are used, but also a clock signal CK3 asynchronous with each other at different frequencies is supplied to the random number disturbance signal generation unit 11, respectively. As shown in FIG. 5, the disturbance signal generator 11 is provided with two counter units (21-1 and 21-2) so that the clock signals CK1 and CK3 are supplied to the counter units as count enable signals of the counter units. May be. By doing so, it is possible to further increase the irregularity of the random number disturbance signals EN1 and EN2.

  Also, the number of count decoder units and LFSR units of the random number disturbance signal generation unit 11 is not limited to two, and it is clearly possible to configure with a larger number of units without illustration. This has the effect of further increasing the irregularity of random number generation.

  Further, in the present embodiment, the operation unit 13 performs RAN3 by exclusive OR operation on each 6-bit random number sequence RAN1 and RAN2 obtained from the LFSR units 12-1 and 12-2. However, the present invention is not limited to this. For example, RAN3 is generated by logical sum, logical product, or more complicated logical operation corresponding to the bit width of each LFSR unit, or the same when performing these operations. You may comprise so that it may calculate by shifting intentionally instead of the calculation for every bit. Such a complicated operation has an effect of further increasing the irregularity of the random number sequence RAN.

  Further, the calculation unit 13 itself is configured as a ROM, and for example, ROM data read from the address value corresponding to all or a part of each bit of the random number sequences RAN1 and RAN2 becomes the final random number sequence RAN3. You may do it. In this way, the user can easily perform data operations such as putting the range of the finally obtained random number sequence RAN3 within a desired data range.

  INDUSTRIAL APPLICABILITY The random number generation circuit according to the present invention is useful in a processing apparatus that requires a random number in the field of encryption, communication, multimedia, and the like, and particularly facilitates mounting and use in a semiconductor integrated circuit. .

1 is a diagram illustrating a schematic basic configuration example of a random number generation circuit 1 according to an embodiment of the present invention. It is the figure which showed the example of schematic structure of the random number disturbance signal generation part 11 which concerns on the example of embodiment of this invention. It is the figure which showed the example of schematic structure of the LFSR part 12-1 which concerns on the example of embodiment of this invention. It is the figure which showed the example of schematic structure of the calculating part 13 which concerns on the example of embodiment of this invention. It is the figure which showed the example of schematic structure of the random number disturbance signal generation part 11 at the time of inputting three clock signals. It is the figure which showed the example of schematic structure of the conventional random number generation circuit using 6 steps | paragraphs of LFSR.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Random number generation circuit 11 Random number disturbance signal generation part 12-1, 12-2 LFSR part 13 Operation part CK1, CK2 Clock signal EN1, EN2 Random number disturbance signal RAN1, RAN2, RAN3 Random number sequence

Claims (3)

Cascade connection is made of m registers each capable of inputting a latch enable signal for permitting data latch, and the output side of a predetermined register among the m registers is cascade-connected via an exclusive OR circuit. In the random number generation circuit using the m-stage linear feedback shift register (LFSR) configured to feed back to the input side of the first register,
Asynchronous first and second clock signals having different frequencies are supplied, the first clock signal is used as a count enable signal, and an n-bit count value is counted using the second clock signal. A counter unit for outputting
A counter decoder for decoding the n-bit count value obtained by the counter unit based on a predetermined bit pattern to generate a plurality of types of random number disturbance signals,
The plurality of generated random number disturbance signals are supplied to the plurality of m-stage LFSRs as the latch enable signals, respectively, and the second clock signal is latched to the same number of m-stage LFSRs. To generate the plurality of types of random number sequences,
A random number generation circuit comprising a calculation unit that generates a final random number sequence by a predetermined calculation based on the plurality of types of generated random number sequences.   2. The random number generation circuit according to claim 1, wherein the m value of the m-stage LFSR is configured to be different from the n value of the n-bit counter unit. 3. The random number generation circuit according to claim 1, wherein the arithmetic unit is configured as a ROM capable of reading out a plurality of types of random number sequences obtained from the plurality of types of m-stage LFSRs as address values. 4.

Images