JP5074359B2 - Random number generator - Google Patents

Description

  The present invention relates to a random number generation circuit that generates an unpredictable true random number with little randomness of occurrence of 0 and 1 and having randomness only by a digital logic gate circuit.

  In the security field based on cryptographic technology, random number generation plays an important role. Random numbers used in cryptographic techniques are unpredictable as a basis for security.

  According to the random number generation method, it is divided into a pseudo-random number and a true random number. Pseudorandom numbers are determined by the mathematical algorithm for generation and the initial value of random number generation. The numerical sequence of random values with periodicity is uniquely determined, so if the initial value is exposed for some reason The generated random number sequence can be predicted. For this reason, in application to cryptographic techniques based on the unpredictability of random numbers, it cannot be said that the security is necessarily sufficient.

  True random numbers, on the other hand, do not rely on deterministic generation methods based on mathematical algorithms, but are generated using physical phenomena with randomness such as fluctuations that exist in nature. It has the property that there is no reproducibility and the value cannot be predicted in principle. As a random number generation circuit using a physical phenomenon, for example, a method of using thermal noise as a random number generation source has been proposed. This method uses a configuration in which a minute thermal noise signal is once amplified using an analog circuit amplifier and converted into a digital signal by an A / D (analog / digital) converter as a pre-stage of digital signal processing. . Since analog circuits are used, there is a problem that porting to digital integrated circuits is not easy, and when mounting, separate process steps are required for analog amplifier and A / D converter circuits. There are problems that cause high costs, and there is a problem that the power consumption of the analog amplifier circuit section is large.

  On the other hand, Non-Patent Document 1 proposes a method for generating a true random number using only a digital logic gate circuit. In this method, as shown in FIG. 11, an exclusive OR of the voltage values of intermediate nodes of a plurality of ring oscillator circuits composed of odd-numbered inverters is taken, and this exclusive OR output is converted to a D-FF (D type flip-flop). The sampling is performed by the sampling operation of (1). Since the ring oscillators self-oscillate independently of each other with a fixed amount of jitter in the oscillation period, the exclusive OR output of the intermediate nodes of these independent ring oscillators has unpredictable randomness. . For this exclusive OR output, an unpredictable true random number sequence can be extracted by performing a sampling operation with a fixed period by D-FF.

  By the way, in the configuration of only a single ring oscillator having a relatively long cycle, the amount of jitter with respect to the oscillation cycle is not sufficient, and therefore, when the sampling cycle is short, the sampling values before and after are correlated and the randomness is impaired. On the other hand, in order to prevent the sampling values before and after being correlated, it is necessary to perform sampling operations at relatively long intervals, and high throughput cannot be obtained. For this reason, as shown in FIG. 11 instead of a single ring oscillator, a plurality of (k) ring oscillators independent from each other are used to obtain an exclusive OR of the intermediate nodes, even at a relatively short sampling interval. The sampling value is devised so as not to correlate.

Here, if the number of inverter stages constituting the ring oscillator is large, the oscillation period is long, and conversely, if the number of inverter stages is small, the oscillation period tends to be short. However, for the purpose of increasing the randomness of the sampling values, In many cases, the number of stages is set to a different number of stages at random.
Sunar B., Martin W., Stinson D., "A Provably Secure True Random Number Generator with Built-In Toletance to Active Attacks", IEEE Trans. Computers, vol.56, no.1, pp.109-119, January 2007

  In the method shown in Non-Patent Document 1, since exclusive OR of intermediate nodes of a plurality of ring oscillators is performed, an exclusive OR output, that is, due to the influence of a ring oscillator signal oscillating with a random phase difference, that is, Transition of the input signal to the D-FF occurs frequently. In particular, this tendency becomes more prominent when the number of ring oscillators is increased for the purpose of increasing randomness.

  By the way, when sampling an intermediate voltage value in a transitional state by a D-FF latch operation, bias (bias) between the probability of latching as low and the probability of latching as high due to characteristics such as the threshold voltage of the CMOS circuit. Is likely to occur. This is because the determination potential for recognizing the input voltage to the D-FF constituted by the CMOS circuit as high or low is slightly deviated from the half of the power supply voltage. ing.

  In particular, when the value of the intermediate node of the ring oscillator having a small number of inverter stages and a short oscillation cycle is the subject of exclusive OR, the bias tendency of the high and low latch outputs becomes more prominent. Originally, it is an exclusive OR configuration of a plurality of ring oscillators introduced for the purpose of increasing the randomness of the sampling value, but in the CMOS circuit, this causes the bias of the high and low latch outputs during sampling, That is, a new problem occurs in which the frequency of random numbers 0 and 1 generated by the sampling operation is biased.

  Unpredictability is a necessary condition for a “good random number”, but there is a bias in the generation frequency of 0 and 1, particularly in application to cryptographic techniques, which is not preferable because of a concern about security degradation.

  Here, in order to reduce the number of state transitions of the signal used for sampling, a method using a ring oscillator having a long oscillation period can be considered. In this ring oscillator having a long oscillation period, the jitter ratio of the oscillation period tends to be small. For this reason, unless the sampling time interval is set sufficiently larger than the jitter amount of the oscillation period, the sampling values before and after have a correlation as described above, resulting in a problem that the randomness is impaired. Therefore, in the case of a configuration using only a ring oscillator having a long oscillation cycle, in order to sample a random value with high randomness, it is necessary to use a low-speed clock as the clock frequency of the D-FF used for sampling, and throughput is reduced. Inevitable.

  As described above, in a random number generation circuit using a conventional ring oscillator, it is difficult to achieve both randomness of random numbers and high throughput.

  An object of the present invention is to provide a random number generation circuit capable of generating an unpredictable random number sequence having high randomness with high throughput only by a digital logic gate circuit.

  According to a first aspect of the present invention, there is provided a random number generation circuit for latching an intermediate node output of a ring oscillator including an odd number of stages of inverters with a clock and outputting the result as a random number value. An even number Lb stage inverter is connected in a cascade, a delay generation unit B in which the output of the final stage inverter of the delay generation unit A is connected to the first stage inverter, and the output and delay of the final stage inverter of the delay generation unit A The output of the last stage inverter of the generation unit B is switched to the output of the last stage inverter of the delay generation unit A within the clock cycle with respect to the selector connected to the first stage inverter of the delay generation unit A and the selector. The operation mode A is switched to form a short-cycle ring oscillator with an odd-numbered La-stage inverter, and the output of the final-stage inverter of the delay generation section B And a control unit that outputs a control signal for selecting an operation mode B that forms a long-cycle ring oscillator with an odd (La + Lb) stage inverter, and oscillates by alternately switching between the operation mode A and the operation mode B. While the operation is continued, the intermediate node output of the ring oscillator is latched at the timing of the operation mode B and output as a random value.

  According to a second aspect of the present invention, there is provided a random number generation circuit that latches an intermediate node output of a ring oscillator composed of an odd number of inverters with a clock and outputs a random number value. Delay generator B in which even Lb stage inverters are connected in cascade, and delay generator B in which even Lc stage inverters are connected in cascade, and the output of the last inverter in delay generator A is connected to the first inverter. A first selector that switches between C, the output of the final stage inverter of the delay generation unit A and the output of the final stage inverter of the delay generation unit B, and is connected to the first stage inverter of the delay generation unit A; The output of the last stage inverter of A and the output of the last stage inverter of the delay generation section C are switched and connected to the first stage inverter of the delay generation section B The second selector, the first selector, and the second selector are switched to the output of the final stage inverter of the delay generation unit A within the clock period, and the short period ring oscillator is switched by the odd number La stage inverter. The operation mode A to be formed is switched to the output of the last stage inverter of the delay generation unit B for the first selector, and is switched to the output of the last stage inverter of the delay generation unit A for the second selector. With respect to the operation mode B in which a long-cycle ring oscillator is formed by (La + Lb) stage inverters, and the first and second selectors, the final stage inverters of the delay generation unit B and the delay generation unit C Switch to output and select an operation mode C which forms a ring oscillator having a longer period than the operation mode B with an odd (La + Lb + Lc) stage inverter. A control unit for outputting a signal, and sequentially switching between operation mode A, operation mode B, and operation mode C to continue the oscillation operation, and latch the intermediate node output of the ring oscillator at the timing of operation mode C, As the output.

  According to a third aspect of the present invention, there is provided a random number generation circuit that latches an intermediate node output of a ring oscillator composed of an odd number of stages of an inverter with a clock and outputs it as a random number value. When the above odd number p and p delay generation units A are arranged in a ring shape, the output of the final stage inverter and the output of the final stage inverter of the previous delay generation unit A for each delay generation unit A And the p first selectors connected to the first stage inverter of the delay generation unit A, and the first stage inverter for each delay generation unit A within the clock period with respect to the first selector. Switch to the output of the inverter of the last stage of the delay stage A of the previous stage and the operation mode A in which a short cycle ring oscillator is formed by an odd La stage inverter. A control unit for outputting a control signal for selecting an operation mode B for forming a long-cycle ring oscillator with an odd (La × p) stage inverter, and switching between the operation mode A and the operation mode B alternately to perform an oscillation operation. While continuing, the intermediate node output of the ring oscillator is latched at the timing of the operation mode B and output as a random value.

  According to a fourth aspect of the invention, in the random number generation circuit according to the third aspect of the invention, the delay generation units D each including p delay generation units A and the first selector are divided into three or more odd q and q delay generations. When the section D is arranged in a ring shape, the output of the last stage inverter and the output of the last stage inverter of the previous delay generation section D are switched for each delay generation section D, and the first stage inverter of the delay generation section D is switched Q second selectors connected to each other, and the control unit switches to the output of the inverter at the last stage for each delay generation unit D within the clock period and outputs an odd number to the second selector. Switch to the output of the last stage inverter of the previous stage delay generator D by switching to the operation mode B in which a long-period ring oscillator is formed with (La * p) stage inverters, and with an odd (La * p * q) stage inverter Long-period ring oscillating The control signal for selecting the operation mode C forming the oscillator is output, and the intermediate node output of the ring oscillator is output at the timing of the operation mode C while continuing the oscillation operation by sequentially switching the operation mode A, the operation mode B, and the operation mode C. Is latched and output as a random value.

  In the random number generation circuit according to any one of the first to fourth inventions, the inverter operation is enabled or disabled by a reset signal input from the outside instead of one inverter of the delay generation unit A, and the operation state of the ring oscillator is set to an active state or a pause state A logic gate that switches to a state may be provided.

  In the random number generation circuits of the first and third inventions, the controller switches the selector with a control signal corresponding to the phase difference between the clock and the delayed clock, and the operation time from the operation mode A to the operation mode B The delay time of the delay clock may be set so as to be longer.

  In the random number generation circuits according to the second and fourth inventions, the control unit switches between the first selector and the second selector with a control signal corresponding to the phase difference between the clock and the delayed clock, and the operation mode. The delay time of the delay clock may be set so that the operation time of C becomes the longest.

  In the random number generation circuit according to the first to fourth inventions, a plurality of ring oscillators for switching each operation mode are provided, and the control unit is configured to collectively switch each operation mode of the plurality of ring oscillators. It is also possible to take an exclusive OR of the intermediate node outputs of the ring oscillator, latch the output, and output as a random value.

  In the random number generation circuit according to any one of the first to fourth inventions, a plurality of ring oscillators for switching each operation mode are provided, and the control unit is individually provided for each of the plurality of ring oscillators, and each operation mode of the plurality of ring oscillators is provided. May be individually switched by a control signal, and an exclusive OR of intermediate node outputs of a plurality of ring oscillators may be obtained, and the output may be latched and output as a random number value.

  The random number generation circuit according to any one of the first to fourth aspects of the present invention may include an equalization circuit that inputs a latched random number value and converts a random number sequence that is biased with a frequency of 0 or 1 into a random number sequence that is balanced.

  The random number generation circuit of the present invention can be operated by switching the number of inverter stages used for oscillation stepwise within one clock synchronized with the random number sampling operation. In the switching operation of the number of stages, since the operation mode with high randomness with a small number of inverter stages is set as the initial state and the operation mode is shifted to the operation mode with a large number of inverter stages as it is, the oscillation operation is continued while accumulating the randomness.

  In particular, when a single-stage inverter ring oscillator is formed as the first operation mode, an unstable state with very high randomness can be taken over as the initial state of the next operation mode. And since it starts from an operation mode with a small number of inverter stages and a short oscillation cycle, high randomness can be accumulated in a short time, and high randomness can be realized with a short sampling period required for random number generation. Further, by switching the number of inverter stages step by step, it is possible to take into account a variety of non-uniform randomness in a short time. In particular, a nested multi-structure ring oscillator can generate a random number with extremely high randomness because a large number of randomities are superimposed to reach a final single oscillation.

  In the final operation mode in which the sampling operation is performed, the ring oscillator with the longest oscillation cycle is operating, so that the state transition of the sampling target node can be reduced, and the occurrence frequency balance of 0 and 1 can be realized at a high level. can do.

  Therefore, the random number generation circuit of the present invention can achieve high throughput while maintaining a random number sequence with high randomness that cannot be predicted while maintaining a high balance of the occurrence frequency of 0 and 1.

(First embodiment)
FIG. 1 shows a first embodiment of a random number generation circuit according to the present invention. The feature of the present embodiment is that the number of inverter stages constituting the ring oscillator is switched to two stages, the operation mode A having a short oscillation cycle and the operation mode B having a long cycle are alternately repeated, and the output of the ring oscillator in the operation mode B It is where data is latched.

  In FIG. 1, the ring oscillator 10 of the present embodiment has a configuration in which a delay generation unit A11 and a delay generation unit B12 are connected via a selector 15. The delay generation unit A11 has a configuration in which a 2-input NAND and an inverter are cascade-connected, and the total number of stages of the 2-input NAND and the inverter is an odd number La. The minimum value of La is 1, and in this case, it is composed of only 2-input NAND. The delay generator B12 has a configuration in which inverters are cascade-connected, and the number of inverter stages is an even number Lb. La is set to a relatively small value and La + Lb is set to a relatively large value. For example, values such as La = 1, La + Lb = 5, La = 3, and La + Lb = 7 are set.

  The control unit 30 receives the clock and the reset signal, and outputs a control signal for switching the selector 15 and a synchronous reset signal synchronized with the clock. The synchronous reset signal is connected to one input of the two-input NAND of the delay generation unit A11. The 2-input NAND of the delay generation unit A11 is fixed to high when the synchronous reset signal is low, functions as an inverter when the synchronous reset signal transitions high, and the delay generation unit A11 as a whole becomes an odd-numbered inverter. Become. In this embodiment, a two-input NAND is used, but a two-input NOR may be used if the phase of the synchronous reset signal is inverted. The position of the 2-input NAND is not necessarily the first stage of the delay generation unit A11. Further, the two-input NAND may be replaced with an inverter and a reset signal may not be used. This is equivalent to a state in which the synchronous reset signal is always high. The same applies to the embodiments described below.

  The output of the last stage inverter (two-input NAND in the case of one stage) of the delay generation unit A11 is connected to one input terminal (L) of the selector 15 and the first stage inverter of the delay generation unit B12. The output of the inverter at the final stage of the delay generation unit B12 is connected to the other input terminal (H) of the selector 15. The selector 15 selects one of the two inputs by the control signal output from the control unit 30 and connects it to the other input of the two-input NAND of the delay generation unit A11. Here, when the synchronous reset signal transitions from low to high and the control signal is low (L), the selector 15 outputs the output of the final stage inverter (two-input NAND in the case of one stage) of the delay generation unit A11. When selected, the ring oscillator formed by the closed loop of the delay generation unit A11 becomes the operation mode A in which it independently oscillates in a short cycle. When the control signal is high (H), the selector 15 selects the output of the inverter at the final stage of the delay generation unit B12, and the ring oscillator formed by the closed loop in which the delay generation units A11 and B12 are connected has a long cycle. The operation mode B oscillates at.

  The output of the final stage inverter (two-input NAND in the case of one stage) of the delay generation unit A11 is connected to the D-FF 21 as the output of the ring oscillator 10. The D-FF 21 inputs the clock input to the control unit 30 as a sampling timing, and latches the output of the ring oscillator 10 at the timing of the operation mode B.

FIG. 2 shows a configuration example of the control unit 30. FIG. 3 shows an operation example of the control unit 30.
2 and 3, the control unit 30 uses an even-numbered inverter that generates a delayed clock that gives a predetermined delay to the clock, a NAND that performs a negative OR of the clock and the delayed clock, and a reset signal as a delayed clock. A D-FF that latches and outputs a synchronous reset signal and an AND that generates a control signal by taking the logical sum of the NAND output and the synchronous reset signal. Note that the ratio of the operation time of the operation modes A and B to one clock is a value corresponding to the delay time (number of inverter stages) of the delay clock. In this embodiment, it is preferable to lengthen the delay time to shorten the operation time of the operation mode A, and relatively increase the operation time of the operation mode B.

The operation of the first embodiment of the random number generation circuit of the present invention will be described below with reference to FIGS.
Since the reset signal in the initial state is low and the synchronous reset signal and the control signal are also low regardless of the clock transition, the delay generation unit A11 forms a closed loop, but the output of the 2-input NAND of the delay generation unit A11 is Since it is fixed high, it does not oscillate. In other words, the operating state of the ring oscillator that constitutes the random number generation circuit is a pause state. Next, when the reset signal transitions to high (t1), the synchronous reset signal goes high at the timing when the next delay clock goes high (t2), and the 2-input NAND of the delay generation unit A11 operates as an inverter. The ring oscillator 10 becomes an operation mode A in which the oscillation operation is performed in a closed loop of the delay generation unit A11. That is, the operating state of the ring oscillator that constitutes the random number generation circuit is in the active state. At this time, since the odd number of stages La of the inverter of the delay generation unit A11 is set to a small value, self-oscillation occurs in a short cycle. In a ring oscillator with a short oscillation period, since the ratio of the jitter component of the oscillation period is large, an output value with randomness can be obtained in a short time.

  In the control unit 30, when the control signal transitions to high at the timing when the NAND output becomes high (clock fall) after the synchronous reset signal becomes high (t3), the selector 15 and the delay generation unit B12 and the delay generation Connect part A11. Accordingly, the ring oscillator 10 is switched to the operation mode B in which the delay generation units A11 and B12 are connected to form a closed loop and self-oscillate with an odd (La + Lb) stage inverter. By this time t3, since the output value has changed in a random state in the operation mode A, the operation mode B takes over the random state generated in the operation mode A as an initial state, and oscillates with a relatively long cycle. Continue. Therefore, in the operation mode B, the oscillation operation does not have to be continued for a long time as in the configuration of the conventional long-cycle single ring oscillator. In addition, since the oscillation period is long, the probability of sampling a potential in a transitional transition state is small, and the bias of the generation frequency of 0 and 1 can be reduced.

  As described above, after the ring oscillator 10 is switched to the operation mode B, the D-FF 21 latches the output of the ring oscillator 10 at the clock rising time t4. A high random number value can be generated. Thereafter, the ring oscillator 10 again enters the operation mode A at time t5 when the control signal becomes low, switches to operation mode B at time t6 when the control signal becomes high, and the D-FF 21 latches its output at time t7. .

  By the way, in the control part 30, the control signal is produced | generated by the differentiation circuit using the phase difference of a clock and the delay clock produced | generated via the delay circuit which consists of an even-numbered stage inverter. Such a control signal includes a jitter component at the transition time in every clock unit due to the delay time fluctuation effect caused by the multistage inverter, and the switching time of the operation mode of the ring oscillator 10 also has a jitter component for each clock. The effect is obtained by adding the randomness resulting from the control signal to the randomness inherent to the oscillator.

  In the present embodiment, in order to start from the operation mode A first, a reset signal input asynchronously is latched with a delay clock to generate a synchronous reset signal. However, when it is allowed to start from the operation mode B for the first time, the reset signal may be directly input to the 2-input NAND of the delay generation unit A11. In that case, depending on the input timing of the reset signal, the ring oscillator 10 starts either in the operation mode A or the operation mode B, but the operation in which the output value is latched in the operation mode B is the same. is there.

  Further, in the configuration of the present embodiment, the randomness of the random numbers can be maintained at a high level even if the random values latched and extracted by the D-FF 21 are used as they are. However, since the balance between 0 and 1 cannot be made completely 50%, an equalization circuit 22 is connected to the subsequent stage of the D-FF 21 as shown in FIG. The output may be the final random value. For example, von Neumann corrector used in the equalization circuit 22 is a method of pairing two bits at a time, discarding both when the pair values are the same, and utilizing the first value of the pair when the pair values are different. Although a number sequence having a bias of 0 and 1 is converted into a number sequence that is balanced, the throughput is reduced. Therefore, in the present embodiment, the configuration that does not include the equalization circuit 22 can be said to achieve both the randomness of the generated random numbers and high throughput.

(Second Embodiment)
FIG. 4 shows a second embodiment of the random number generation circuit of the present invention.
A feature of the present embodiment is that a plurality of n ring oscillators 10 in the first embodiment are prepared, and a two-input NAND of the delay generation unit A11 of each ring oscillator 10-1 to 10-n and an odd number La of the total number of inverters. And the even number Lb of the number of inverters of the delay generation unit B12 are set independently, and the outputs of the delay generation units A11 are exclusive ORed by the EXOR 23 and input to the D-FF 21. The high randomness shown in the first embodiment is already ensured at the outputs of the ring oscillators 10-1 to 10-n, and the D-FF 21 obtains the exclusive OR of these outputs. The randomness of the generated random number can be further enhanced.

  Note that the control unit 30 in the present embodiment has the same configuration as that of the first embodiment, and is configured to collectively control each of the ring oscillators 10-1 to 10-n using the generated synchronous reset signal and control signal. . On the other hand, a control unit 30 for controlling each of the ring oscillators 10-1 to 10-n is individually provided, and a synchronous reset signal and a control signal are generated independently from a common clock and a reset signal, respectively. The timing for switching the 10-n operation mode may be random.

(Third embodiment)
FIG. 5 shows a third embodiment of the random number generation circuit of the present invention. The feature of this embodiment is that the number of inverter stages constituting the ring oscillator is switched to three stages, and an operation mode A having a short oscillation period, an operation mode B having a long period, and an operation mode C having a long period are sequentially arranged. Repeatedly, in the operation mode C, the output of the ring oscillator is latched.

  In FIG. 5, the ring oscillator 10 of the present embodiment has a configuration in which a delay generation unit A11 and a delay generation unit B12 are connected via a selector 15, and the delay generation unit B12 and the delay generation unit C13 are connected via a selector 16. is there. The delay generation unit A11 has a configuration in which a 2-input NAND and an inverter are cascade-connected, and the total number of stages of the 2-input NAND and the inverter is an odd number La. The minimum value of La is 1, and in this case, it is composed of only 2-input NAND. The delay generation unit B12 and the delay generation unit C13 are configured by cascading inverters. The number of inverter stages is an even Lb stage and an even Lc stage, respectively. Lb is set so that La is a relatively small value, La + Lb is a slightly large value, and Lc is set so that La + Lb + Lc is a larger value. For example, values are set such that La = 1, La + Lb = 5, La + Lb + Lc = 9, La = 3, La + Lb = 7, La + Lb + Lc = 11.

  The control unit 31 inputs a clock and a reset signal, and outputs a control signal 1 for switching the selector 15, a control signal 2 for switching the selector 16, a synchronous reset signal synchronized with the clock, and a sampling clock. The synchronous reset signal is connected to one input of the two-input NAND of the delay generation unit A11. The 2-input NAND of the delay generation unit A11 is fixed to high when the synchronous reset signal is low, functions as an inverter when the synchronous reset signal transitions high, and the delay generation unit A11 as a whole becomes an odd-numbered inverter. Become.

  The output of the final stage inverter (two-input NAND in the case of one stage) of the delay generation unit A11 is one input terminal (L) of the selector 15, one input terminal (L) of the selector 16, and the delay generation unit C13. Connected to the first stage inverter. The output of the inverter at the final stage of the delay generation unit C13 is connected to the other input terminal (H) of the selector 16. The selector 16 selects one of the two inputs by the control signal 2 output from the control unit 31 and connects it to the first stage inverter of the delay generation unit B12. The output of the inverter at the final stage of the delay generation unit B12 is connected to the other input terminal (H) of the selector 15. The selector 15 selects one of the two inputs by the control signal 1 output from the control unit 31 and connects it to the other input of the two-input NAND of the delay generation unit A11.

  Here, when the synchronous reset signal transitions from low to high and the control signal 1 and the control signal 2 are low (L), the selectors 15 and 16 are the last stage inverter of the delay generation unit A11 (in the case of one stage). The output of the 2-input NAND) is selected, and the ring oscillator formed by the closed loop of the delay generation unit A11 is in the operation mode A in which it independently oscillates in a short cycle. When the control signal 1 is high (H) and the control signal 2 is low (L), the selector 15 selects the output of the inverter at the final stage of the delay generation unit B12, and the selector 16 selects the final output of the delay generation unit A11. The output of the stage inverter (two-input NAND in the case of one stage) is selected, and the ring oscillator formed by the closed loop in which the delay generators A11 and B12 are connected is in the operation mode B in which oscillation is performed with a long period. When the control signals 1 and 2 are high (H), the selector 15 selects the output of the final stage inverter of the delay generation unit B12, and the selector 16 selects the output of the final stage inverter of the delay generation unit C13. Then, the ring oscillator formed by the closed loop in which the delay generation units A11, B12, and C13 are connected becomes the operation mode C that oscillates with a longer period.

  The output of the final stage inverter (two-input NAND in the case of one stage) of the delay generation unit A11 is connected to the D-FF 21 as the output of the ring oscillator 10. The D-FF 21 latches the output of the ring oscillator 10 at the sampling timing output from the control unit 31.

FIG. 6 shows a configuration example of the control unit 31. FIG. 7 shows an operation example of the control unit 31.
6 and 7, the control unit 31 uses an even-numbered inverter that generates a delayed clock that gives a predetermined delay to the clock, a NAND that performs a negative OR of the clock and the delayed clock, and a reset signal using the delayed clock. The D-FF that latches and outputs the synchronous reset signal, the AND that generates the control signal 1 by taking the logical sum of the NAND output and the synchronous reset signal, and the logical sum of the inverted delay clock and the synchronous reset signal. And an inverter that generates the control signal 2 and an AND. Further, the delay clock is output as the sampling clock of the D-FF 21. Note that the ratio of the operation time of the operation modes A, B, and C to one clock is a value corresponding to the delay time (number of inverter stages) of the delay clock. In the present embodiment, it is preferable to lengthen the delay time to shorten the operation time of the operation mode A and to relatively increase the operation time of the operation mode C.

The operation of the third embodiment of the random number generation circuit of the present invention will be described below with reference to FIGS.
Since the reset signal in the initial state is low and the synchronous reset signal, the control signal 1 and the control signal 2 are also low regardless of the clock transition, the delay generation unit A11 forms a closed loop, but the delay generation unit A11 2 Since the output of the input NAND is fixed to high, no oscillation operation is performed. Next, when the reset signal transitions to high (t1), the synchronous reset signal goes high at the timing when the next delay clock goes high (t2), and the 2-input NAND of the delay generation unit A11 operates as an inverter. The ring oscillator 10 becomes an operation mode A in which the oscillation operation is performed in a closed loop of the delay generation unit A11. At this time, since the odd number of stages La of the inverter of the delay generation unit A11 is set to a small value, self-oscillation occurs in a short cycle. In a ring oscillator with a short oscillation period, since the ratio of the jitter component of the oscillation period is large, an output value with randomness can be obtained in a short time.

  In the control unit 31, when the control signal 1 transitions to high at the timing when the NAND output becomes high (clock fall) after the synchronous reset signal becomes high (t3), the selector 15 and the delay generation unit B12 The generation unit A11 is connected. In FIG. 7, the NAND output and the control signal 1 emphasize the delay corresponding to the logic gate with respect to the delay clock, and the control signal 2 shown below is the same. Accordingly, the ring oscillator 10 is switched to the operation mode B in which the delay generation units A11 and B12 are connected to form a closed loop and self-oscillate with an odd (La + Lb) stage inverter. By this time t3, since the output value has changed in a random state in the operation mode A, the operation mode B takes over the random state generated in the operation mode A as an initial state, and oscillates with a relatively long cycle. Continue. Therefore, in the operation mode B, the oscillation operation does not have to be continued for a long time as in the configuration of the conventional long-cycle single ring oscillator.

  When the control signal 2 changes to high at the timing when the delay clock becomes low after the control signal 1 becomes high (t4), the selector 16 connects the delay generation unit C13 and the delay generation unit B12. As a result, the ring oscillator 10 is switched to the operation mode C in which the delay generators A11, B12, and C13 are connected to form a closed loop and self-oscillate with an odd (La + Lb + Lc) stage inverter. In the operation mode C, the random state generated in the operation mode B is inherited as an initial state, and the oscillation operation is continued with a long period. Therefore, in the operation mode C, the oscillation operation does not have to be continued for a long time as in the configuration of the conventional long-cycle single ring oscillator. In addition, since the oscillation period is long, the probability of sampling a potential in a transitional transition state is small, and the bias of the generation frequency of 0 and 1 can be reduced.

  In this way, after the ring oscillator 10 is switched to the operation mode C, the D-FF 21 latches the output of the ring oscillator 10 at the rising time t5 of the sampling clock (delayed clock), thereby balancing the generation frequency of 0 and 1 It is possible to generate a random value with excellent randomness. That is, a random number in which the randomness due to the jitter of each of the three types of ring oscillators is superimposed is generated. Thereafter, the ring oscillator 10 again enters the operation mode A at the time t6 when the control signals 1 and 2 become low, then switches to the operation mode B, further switches to the operation mode C, and the D-FF 21 outputs its output at the time t9. Latch.

  By the way, in the control part 31, the control signal 1 is produced | generated by the differentiation circuit using the phase difference of a clock and the delay clock produced | generated via the delay circuit which consists of an even-numbered stage inverter. Since such a control signal 1 includes a jitter component at the transition time in units of clocks due to the fluctuation effect of the delay time caused by the multistage inverter, the switching time of the operation mode of the ring oscillator 10 also has a jitter component for each clock. The effect of adding the randomness resulting from the control signal to the randomness inherent to the ring oscillator can be obtained.

  In the present embodiment, in order to start from the operation mode A first, a reset signal input asynchronously is latched with a delay clock to generate a synchronous reset signal. However, when it is allowed to start from the operation mode B or the operation mode C for the first time, the reset signal may be directly input to the 2-input NAND of the delay generation unit A11. In that case, depending on the input timing of the reset signal, the ring oscillator 10 starts in one of the operation modes A, B, and C, but the operation in which the random number value is latched out in the operation mode C is the same. It is.

  In the configuration of this embodiment, the randomness of the random number can be kept at a high level even if the random value latched and extracted by the D-FF 21 is used as it is. However, as shown in FIG. 5, an equalization circuit 22 may be connected to the subsequent stage of the D-FF 21 to guarantee the randomness of random numbers at a higher level, but the throughput decreases. Therefore, the configuration that does not include the equalization circuit 22 can be said to achieve both the randomness of the generated random numbers and high throughput.

(Fourth embodiment)
FIG. 8 shows a fourth embodiment of the random number generation circuit of the present invention.
A feature of the present embodiment is that a plurality of n ring oscillators 10 according to the third embodiment are prepared, and a two-input NAND of the delay generation unit A11 of each ring oscillator 10-1 to 10-n and an odd number La of the total number of inverters. And an even number Lb of the number of inverters of the delay generation unit B12 and an even number Lc of the number of inverters of the delay generation unit C13 are set independently, and the output of each delay generation unit A11 is exclusive ORed by the EXOR 23, It is in the place to input to D-FF21. The high randomness shown in the third embodiment is already ensured at the outputs of the ring oscillators 10-1 to 10-n, and the D-FF 21 obtains the exclusive OR of these outputs. The randomness of the generated random number can be further enhanced.

  Note that the control unit 31 in this embodiment has the same configuration as that of the third embodiment, and the ring oscillators 10-1 to 10-n are collectively connected by the generated synchronous reset signal, control signal 1 and control signal 2. It is the structure to control. On the other hand, a control unit 31 for controlling each of the ring oscillators 10-1 to 10-n is individually provided, and a synchronous reset signal, a control signal 1 and a control signal 2 are generated independently from a common clock and a reset signal, respectively. The timing for switching the operation mode of the oscillators 10-1 to 10-n may be random. However, the sampling clock given to the D-FF 21 is configured to be output from any one control unit 31.

(Fifth embodiment)
FIG. 9 shows a fifth embodiment of the random number generation circuit of the present invention. As in the first embodiment, the feature of this embodiment is that the number of inverters constituting the ring oscillator is switched to two stages, and the operation mode A having a short oscillation cycle and the operation mode B having a long cycle are alternately repeated. The output data of the ring oscillator is latched in the operation mode B. However, in the first embodiment, the number of inverter stages is switched between two stages, odd La and odd (La + Lb), whereas in this embodiment, the number of inverter stages is an odd La stage, which is 2 times the odd number. It is a configuration that can be switched in stages.

  In FIG. 9, the ring oscillator 10 of the present embodiment includes p delay generation units A11 that form a closed loop via a selector 15 by cascading two-input NANDs having a total number of odd stages La and inverters (p is Odd number of 3 or more). The minimum value of La is 1, and in this case, it is composed of only 2-input NAND. Each selector 15 forms a closed loop only with its own delay generation unit A11, or connects the output of the previous delay generation unit A11 to the input of the next delay generation unit A11, and p delay generation units A11. To form a closed loop. In this latter closed loop, the total number of stages as an inverter is La × p (odd number).

  Here, the output of the final stage inverter (two-input NAND in the case of one stage) of any one delay generation unit A11 is connected to the D-FF 21 as the output of the ring oscillator 10.

  The control unit 30 inputs a clock and a reset signal, outputs a control signal for switching each selector 15, and gives a synchronous reset signal synchronized with the clock to the two-input NAND of each delay generation unit A11. Operate in the same way.

  That is, when the synchronous reset signal is high and the control signal is low, the 2-input NAND of the delay generation unit A11 operates as an inverter, so that each delay generation unit A11 forms a closed loop and oscillates in a short cycle. It becomes mode A. Next, when the control signal transitions to high, the ring oscillator 10 is switched to an operation mode B in which an odd number of delay generation units A11 are connected to form a closed loop and the long period oscillation is performed by an odd number of La × p stage inverters. After the ring oscillator 10 is switched to the operation mode B, the D-FF 21 latches the output of the ring oscillator 10 at the clock rising time. In this way, since the state of high randomness obtained by oscillating in a short cycle in the operation mode A is switched to the operation mode B while taking over as it is, a random number with high randomness can be obtained.

(Sixth embodiment)
FIG. 10 shows a sixth embodiment of the random number generation circuit of the present invention. As in the third embodiment, the feature of the present embodiment is that the number of inverter stages constituting the ring oscillator is switched to three, the operation mode A having a short oscillation period, the operation mode B having a long period, and The long cycle operation mode C is sequentially repeated, and the output data of the ring oscillator is latched in the operation mode C. However, in the third embodiment, the number of inverter stages is switched in three stages of odd La, odd (La + Lb), and odd (La + Lb + Lc), whereas in this embodiment, the inverter has an odd number of stages. In this configuration, switching is performed in three stages of La stage, an odd multiple thereof, and an odd multiple thereof.

  In FIG. 10, the ring oscillator 10 of the present embodiment has a configuration including p delay generation units A <b> 11 that form a closed loop via the selector 15 of the fifth embodiment as a delay generation unit D <b> 14, and further includes a selector 16. Q delay generation units D14 forming a closed loop (q is an odd number of 3 or more). Each of the selectors 15 and 16 forms a closed loop only with its own delay generation unit A11, or connects the output of the previous delay generation unit A11 to the input of the next delay generation unit A11, and p delay generation units A11. To form a closed loop, or connect the output of the previous delay generation unit D14 to the input of the next delay generation unit D14, and form a closed loop by connecting q delay generation units D14. In this final closed loop, the total number of stages as inverters is La × p × q (odd number).

Here, the output of the final stage inverter (two-input NAND in the case of one stage) of any one delay generation unit D14 is connected to the D-FF 21 as the output of the ring oscillator 10.
The control unit 30 inputs a clock and a reset signal, outputs a control signal 1 for switching each selector 15 and a control signal 2 for switching each selector 16, and outputs a synchronous reset signal synchronized with the clock to 2 of each delay generation unit A11. An input NAND is applied to operate in the same manner as in the third embodiment.

  That is, when the synchronous reset signal is high and the control signals 1 and 2 are low, the two-input NAND of the delay generation unit A11 operates as an inverter, so that each delay generation unit A11 forms a closed loop in a short cycle. The operation mode A oscillates. Next, when the control signal 1 is high and the control signal 2 is low, the delay generation unit D14 is connected to an odd number of delay generation units A11 to form a closed loop, and an odd number of La × p stage inverters have a long period. The operation mode is switched to the oscillation mode B. Next, when the control signals 1 and 2 become high, the ring oscillator 10 is connected to an odd number of delay generators D14 to form a closed loop, and further oscillates with an odd number of La × p × q stage inverters. Switch to mode C. After the ring oscillator 10 is switched to the operation mode C, the D-FF 21 latches the output of the ring oscillator 10 at the clock rising time.

  As described above, the independent randomness obtained individually in the operation mode A is superimposed in the operation mode B, and the randomness of the operation mode B is further superimposed to finally reach the operation mode C. It is possible to obtain a random number with extremely high randomness on which is superimposed.

  In the present embodiment, an example in which the three operation modes are switched has been described. However, by configuring such a nested multiple ring oscillator, a ring oscillator capable of switching in four or more stages can be configured. .

(Seventh embodiment)
A plurality of n ring oscillators 10 according to the fifth and sixth embodiments are prepared, the number of stages of the delay generation unit A11 of each ring oscillator 10-1 to 10-n is set independently, and each ring oscillator 10 is set. An exclusive OR of the outputs of −1 to 10-n may be taken and the output may be latched. The high randomness shown in the fifth embodiment and the sixth embodiment has already been secured in the outputs of the ring oscillators 10-1 to 10-n, and by taking the exclusive OR of those outputs. , Randomness of random numbers obtained by D-FF can be further enhanced.

  Further, as described in the second embodiment and the fourth embodiment, the control unit that switches each operation mode may be configured to collectively control each ring oscillator 10-1 to 10-n. The ring oscillators 10-1 to 10-n may be individually provided with a control unit, and the operation modes may be switched individually.

The figure which shows 1st Embodiment of the random number generation circuit of this invention. The figure which shows the structural example of the control part. 4 is a time chart showing an operation example of the control unit 30. The figure which shows 2nd Embodiment of the random number generation circuit of this invention. The figure which shows 3rd Embodiment of the random number generation circuit of this invention. The figure which shows the structural example of the control part. 4 is a time chart showing an operation example of the control unit 31. The figure which shows 4th Embodiment of the random number generation circuit of this invention. The figure which shows 5th Embodiment of the random number generation circuit of this invention. The figure which shows 6th Embodiment of the random number generation circuit of this invention. The figure which shows the structural example of the conventional random number generation circuit.

Explanation of symbols

10 Ring Oscillator 11 Delay Generator A
12 Delay generator B
13 Delay generator C
15, 16 Selector 21 D-FF
22 equalizing circuit 23 exclusive OR circuit 30, 31 control unit

Claims (10)

In a random number generation circuit that latches an intermediate node output of a ring oscillator composed of an odd number of inverters with a clock and outputs it as a random value,
A delay generation unit A in which inverters of odd La stages are connected in cascade;
An even number Lb stage of inverters connected in cascade, and a delay generation unit B in which the output of the last stage inverter of the delay generation unit A is connected to the first stage inverter;
A selector that switches between the output of the final stage inverter of the delay generation unit A and the output of the final stage inverter of the delay generation unit B, and that is connected to the first stage inverter of the delay generation unit A;
An operation mode A for switching to the output of the final stage inverter of the delay generation unit A within the clock cycle to form a short cycle ring oscillator with an odd number of La stage inverters, and the delay generation unit A control unit that switches to the output of the inverter at the last stage of B and outputs a control signal for selecting an operation mode B that forms a long-cycle ring oscillator with an odd (La + Lb) stage of inverter, Random number generation circuit characterized in that it is configured to latch the intermediate node output of the ring oscillator at the timing of the operation mode B and output it as a random value while continuing the oscillation operation by alternately switching the operation mode B . In a random number generation circuit that latches an intermediate node output of a ring oscillator composed of an odd number of inverters with a clock and outputs it as a random value,
A delay generation unit A in which inverters of odd La stages are connected in cascade;
A delay generator B in which even Lb stage inverters are connected in cascade;
An even number Lc stage of inverters connected in a cascade, and a delay generator C connected to an output of the final stage of the delay generator A;
A first selector that switches between the output of the final stage inverter of the delay generation unit A and the output of the final stage inverter of the delay generation unit B and is connected to the first stage inverter of the delay generation unit A;
A second selector for switching between the output of the final stage inverter of the delay generation unit A and the output of the final stage inverter of the delay generation unit C and connected to the first stage inverter of the delay generation unit B;
For the first selector and the second selector, the output of the last stage inverter of the delay generation unit A is switched within the period of the clock to form a short period ring oscillator with an odd number of La stage inverters. In operation mode A, the first selector switches to the output of the final stage inverter of the delay generator B, and the second selector switches to the output of the final stage inverter of the delay generator A With respect to the operation mode B in which a long-cycle ring oscillator is formed by an odd (La + Lb) stage inverter, and the delay generator B and the delay generator C are connected to the first selector and the second selector. By switching to the output of each final stage inverter, an odd (La + Lb + Lc) stage inverter is used to form a ring oscillator having a longer cycle than that of operation mode B A control unit that outputs a control signal for selecting the operation mode C, and sequentially switching the operation mode A, the operation mode B, and the operation mode C to continue the oscillation operation, and at the timing of the operation mode C. A random number generation circuit characterized in that the intermediate node output of the ring oscillator is latched and output as a random value. In a random number generation circuit that latches an intermediate node output of a ring oscillator composed of an odd number of inverters with a clock and outputs it as a random value,
An odd number p or more of three delay generation units A each having an odd number of La stages of inverters connected in cascade;
When the p delay generation units A are arranged in a ring shape, the output of the final stage inverter and the output of the final stage inverter of the previous delay generation unit A are switched for each delay generation unit A, and the delay P first selectors connected to the first stage inverter of the generator A;
An operation mode A in which the first selector is switched to the output of the inverter at the final stage for each delay generation unit A within the period of the clock to form a short-cycle ring oscillator with an odd number of La stages of inverters. And a control unit that outputs a control signal for selecting an operation mode B in which a long-cycle ring oscillator is formed by an odd (La × p) stage inverter by switching to the output of the last stage inverter of the delay generation unit A of the preceding stage And alternately switching between the operation mode A and the operation mode B and continuing the oscillation operation, and latching the intermediate node output of the ring oscillator at the timing of the operation mode B and outputting as a random value A random number generation circuit characterized by that. The random number generation circuit according to claim 3,
An odd number q of three or more delay generation units D each including the p delay generation units A and the first selector;
When the q delay generation units D are arranged in a ring shape, the output of the last-stage inverter and the output of the final-stage inverter of the previous-stage delay generation unit D are switched for each delay generation unit D. Q second selectors connected to the first stage inverter of the generator D, and
The control unit switches to the output of the inverter at the final stage for each delay generation unit D within the period of the clock and switches the output to the second selector with an odd (La × p) stage inverter for a long period. Operation mode B for forming a ring oscillator of the first stage, and an operation for forming a ring oscillator having a longer period with an odd (La × p × q) stage inverter by switching to the output of the last stage inverter of the delay generation unit D of the preceding stage The control signal for selecting mode C is output, and the operation mode A, the operation mode B, and the operation mode C are sequentially switched to continue the oscillation operation, and the intermediate node output of the ring oscillator at the timing of the operation mode C A random number generation circuit characterized by being configured to latch and output as a random value. In the random number generation circuit according to any one of claims 1 to 4,
In place of one inverter of the delay generation unit A, a logic gate is provided that enables or disables the inverter operation by an externally input reset signal and switches the operation state of the ring oscillator to an active state or a sleep state. Random number generation circuit. In the random number generation circuit according to claim 1 or 3,
The control unit switches the selector with a control signal corresponding to a phase difference between the clock and a delayed clock obtained by delaying the clock, and delays the operation mode B so that the operation time of the operation mode B is longer than that of the operation mode A. A random number generation circuit characterized in that the delay time is set. In the random number generation circuit according to claim 2 or 4 ,
The control unit switches the first selector and the second selector with a control signal corresponding to a phase difference between the clock and a delayed clock obtained by delaying the clock, and the operation time in the operation mode C is the longest. A random number generation circuit characterized in that the delay time of the delay clock is set to be In the random number generation circuit according to any one of claims 1 to 4,
A plurality of ring oscillators capable of switching each operation mode,
The control unit is configured to collectively switch each operation mode of a plurality of ring oscillators with the control signal,
A random number generation circuit characterized by taking an exclusive OR of intermediate node outputs of the plurality of ring oscillators, latching the output, and outputting the result as a random value. In the random number generation circuit according to any one of claims 1 to 4,
A plurality of ring oscillators capable of switching each operation mode,
The control unit is provided separately for each of the plurality of ring oscillators, and each operation mode of the plurality of ring oscillators is individually switched by the control signal.
A random number generation circuit characterized by taking an exclusive OR of intermediate node outputs of the plurality of ring oscillators, latching the output, and outputting the result as a random value. In the random number generation circuit according to any one of claims 1 to 4,
A random number generation circuit comprising: an equalization circuit that inputs the latched random number value and converts a random number sequence biased at a frequency of 0 or 1 into a balanced random number sequence.

Images