WO2009135724A1

WO2009135724A1 - Device and method for generating a random bit sequence

Info

Publication number: WO2009135724A1
Application number: PCT/EP2009/053345
Authority: WO
Inventors: Markus Dichtl
Original assignee: Siemens Aktiengesellschaft
Priority date: 2008-05-09
Filing date: 2009-03-23
Publication date: 2009-11-12
Also published as: DE102008022918A1

Abstract

A device (1) for generating a random bit sequence comprises an oscillator unit (2), which generates an oscillator signal (OS) having jitter, at least one delay unit (3, 4, 5), which supplies a delayed oscillator signal (D1, D2, D3), a logic unit (6), which logically links the oscillator signal (OS) to the delayed oscillator signal (D1, D2, D3) into a random signal (ZS), and a scanning unit (7) for scanning the random signal (ZS) and generating a random bit (ZB). With a method for generating a random bit sequence, an oscillator signal (OS) having jitter is delayed, and the delayed oscillator signal (D1, D2, D3) is logically linked to the oscillator signal (OS) in order to generate a random signal (ZS).

Description

description

Apparatus and method for generating a random bit string

The present invention relates to apparatus and methods for generating random bits and random bit strings. This is for example used to implement a random number generator.

Random numbers, which occur in digital form as random bit sequences, are often required in security-relevant applications. For asymmetric authentication methods, for example, it is necessary to generate and use random numbers. Particularly in the case of RFID tags with security functionality, corresponding random numbers with particularly low hardware expenditure must be generated. It is desirable to use only digital logic circuits, which can be implemented with low cost.

In the past, random number generators z. B. using analog noise sources whose signals are digitized used. However, hybrid analog / digital circuits are expensive to implement.

Even with pure digital circuits random numbers can be generated, for example, the statistical fluctuations of period lengths of ring oscillators are exploited. Digital ring oscillators are usually formed from an odd number of inverters which are cyclically arranged or fed back together. The fluctuations of the period lengths are referred to in particular as jitter and are usually small compared to the period length (about 1% of the period). This usually restricts the use of particularly fast random number or random bit generation.

Jitter-based random number generation is essentially known in the form of two methods. On the one hand there is the Possibility to wait for several periods of jitter, so that the contributions accumulated by the jitter fluctuations to a completely random phase position of the respective ring oscillator. A major disadvantage of this approach is that only low data rates of the random bits can be achieved because up to several thousand period lengths must be taken into account in order to achieve a random phase position of the ring oscillator used. Correspondingly long waiting times result from the central limit value set of the probability calculation according to which the standard deviation of the phase position of a ring oscillator after n periods is only Vn times the standard deviation of a corresponding period.

On the other hand, it has been proposed, for example, in EP 1 562 291 B1, to adjust the phase position of the ring oscillators used in such a way that sampling always takes place in the vicinity of a signal edge. However, this has the disadvantage that an increased control and circuit complexity is required and also undesirable statistical dependencies between the generated random bits can occur.

It is therefore an object of the present invention to provide an improved apparatus for generating random bits.

This object is achieved by a device having the features of patent claim 1.

Accordingly, an apparatus for generating a random bit sequence comprises an oscillator device, a plurality of delay devices, a logic device and a sampling device. The oscillator device generates an oscillator signal applied with a jitter. The delay devices each provide a delayed oscillator signal. The logic device logically links the delayed oscillator signals and optionally also the oscillator signal to an input signal. falling signal. The scanner samples the random signal and generates a random bit.

It is also possible to equip the device with only one delay device and to logically link the resulting delayed oscillator signal by means of the logic device with the oscillator signal for generating the random signal.

A corresponding method provides for delaying an oscillator signal, which has a jitter, several times and logically linking the delayed oscillator signals (and the oscillator signal) for generating a random signal.

Also, logically combining the oscillator signal with a single delayed oscillator signal realizes the proposed invention and provides an improved random signal.

By generating and using a plurality of, each having a jitter, oscillator signals or delayed oscillator signals, the logic operation increases the probability, for example, make a periodic sampling of the thus generated random signal in the vicinity of a signal edge. Sampling or sampling of a jittered signal edge is more likely to occur with a number k of delay elements or delay devices by a factor of k + 1 than sampling of only one oscillator signal. A rate of random bit generation can be increased by the factor (k + 1) ² as compared with a simple ring oscillator whose oscillator signal is sampled. This results in a higher random bit generation rate by a factor of 16 for three delay devices or delayed oscillator signals and 25 for four delay devices or delayed oscillator signals. For generating the oscillator signals, in particular, a digital ring oscillator circuit which generates a digital oscillator signal oscillating between two logic levels is suitable.

The advantage of using completely digital components in the apparatus for generating the random bits is, inter alia, the simple expedient implementability, for example in RFID devices or on smart cards.

The delay devices can be connected in series. However, it is also conceivable to provide a plurality of different delay times supplying delay devices in parallel. A maximum delay time of the respective delayed oscillator signal is preferably less than half the oscillation period of the oscillation or oscillator signal supplied by, for example, the ring oscillator circuit.

As a logic means for logically combining the delayed oscillator signals (and the non-delayed oscillator signal) is particularly suitable an XOR gate. The scanning device, which may be implemented as a D flip-flop, for example, is configured in such an embodiment that a sampling of the random signal takes place periodically. In order to derive a digital random number in binary coded form, a register means for storing a plurality of detected random bits may be provided. For example, a shift register into which the successively detected random bits are inserted may be used.

In the method for generating a random bit sequence, for example, the following method steps are performed: providing an oscillator signal with a jitter, delaying the oscillator signal to produce a plurality of delayed oscillator signals, logically combining the delayed oscillator signals to produce a random signal, and Sampling the random signal at predetermined times to generate a random bit.

Alternatively, only the delayed oscillator signals can be logically linked to one another or only a single delayed oscillator signal with the undelayed oscillator signal.

Further advantageous embodiments of the invention are subject matter of the subclaims and the embodiments of the invention described below. Furthermore, the invention will be explained in more detail by means of embodiments with reference to the following figures. It shows:

FIG. 1 shows a circuit diagram of a first embodiment of a device for generating random bits;

FIG. 2: possible signal forms of oscillator signals and scanning signals;

Figure 3 is a flow chart for a method for generating random bits; and

FIG. 4 shows a circuit diagram of a second embodiment of a device for generating random bits.

In the figures, identical or functionally identical elements have been given the same reference numerals, unless stated otherwise.

FIG. 1 shows a device 1 which delivers a random bit ZB at an output 9. The random number generation device 1 has an oscillator device 2, which is designed as a ring oscillator. In this case, the ring oscillator 2 is formed from an odd number of serially connected inverters 10-14, wherein the output signal of this inverter chain OS the input of the first inverter 10th is fed back. This digital resonant circuit or ring oscillator 2 thus provides at the output 29 an oscillation signal OS. Due to disturbances and non-ideal electronic components or even temperature effects, there is no ideal oscillating signal, but a jittered oscillation signal OS. That is, there are basically fluctuations in the period lengths of successive oscillation cycles. As already mentioned, this typical jitter moves by about 1% of the nominal oscillation period.

There are several delay devices 3, 4, 5 are provided, the inputs 15, 16, 17 and outputs 18, 19, 20 have. A signal present at a respective input 15, 16, 17 is output at the output 18, 19, 20 by a respective delay time later. The three delay elements 3, 4, 5 shown in FIG. 1 are connected in series with one another and fed to the input 15 of the first delay element of the oscillator signal OS. A first delayed oscillator signal D1 is thus present at the output 18 of the first delay element 3. The first delayed oscillator signal Dl is supplied to the input 16 of the second delay element 4, which provides a second delayed oscillator signal D2 at its output 19. This second delayed oscillator signal D2 is fed to the input 17 of the third delay element 5, which supplies at its output 20 a third delayed oscillator signal D3. There are thus four different time-shifted oscillator signals OS, D1, D2, D3, each of which is jittered.

A logic device 6 designed as an XOR gate accepts these jitter-applied oscillator signals OS, D1, D2, D3 at inputs 21-24 and supplies a random signal ZS at an output 25 using a logical XOR function. Due to the logic operation, the random signal ZS has, depending on the setting of the delay times of the delay elements 3, 4, 5 - for example, when the time delay of the third delayed oscillator signal D3 opposite the original oscillator signal OS is less than half the period of the nominal ring oscillator period-within a nominal ring oscillator period T, three additional fluctuating signal edges, which fluctuate according to the jitter.

This random signal ZS is now supplied to a scanning device designed as a D flip-flop 7. The D flip-flop 7 has a data input 26, a clock input 27 and a data output 28. The clock-edge-controlled D flip-flop 7 detects the present at its data input 26 signal at a rising edge signal at its clock input 27. This is a Sampling signal SM, which may be, for example, a periodic clock signal, the clock input 27 supplied. The random number generating device 1 has for this purpose an input 8 to which a corresponding sampling or clock signal can be supplied.

FIG. 2 shows, for a more detailed explanation, possible signal forms for oscillator signals and a clock signal. In the figure 2A is an example of an oscillator signal OS, which varies between two logic levels L and H, shown in the time course. The additional vertical lines on the signal edges should symbolize the jitter. Basically, there is an average (nominal) period T, which, however, only corresponds to the time average over many oscillations or oscillations. Basically, the jitter results in a distribution around the nominal ring oscillator period T.

By the delay elements 3, 4, 5 in the random number generation device 1 further similar waveforms are generated shifted in time. In particular, by the use of the logic device or the XOR gate 6, the probability is significantly increased in a periodic sampling of the resulting random signal ZS compared to the single signal, as shown in Figure 2A, to scan at a signal edge. FIG. 2B shows by way of example a sampling signal SM executed as a clock signal. In the exemplary embodiment of FIG. 1, a sampling and detection of the random signal takes place in each case with respect to the rising signal edges of the sampling signal SM. The thus sampled or sampled random signal ZS can be tapped off as logic random bit ZB at the output 28 of the flip-flop 7 and is, as shown in FIG. 1, fed to the output 9 as a random bit ZB.

FIG. 3 schematically shows an exemplary flow diagram of the method for generating random bits, which can be implemented in particular by the device as illustrated in FIG. Initially, in step S1, an oscillator signal is generated, for example, by means of a digital ring oscillator circuit. The corresponding oscillator signal has a jitter.

In the following step S2 delayed oscillator signals are generated by the oscillator signal is delayed differently in time.

In step S3, a logical combination of the delayed oscillator signals and the oscillator signal takes place.

Subsequently, the random signal generated by the logic operation is sampled or sampled periodically, for example. This happens in step S4. The result of this sampling is a random bit ZB, which can be used, for example, as a binary digit in a random number.

By repeatedly going through the steps S1-S4, a random bit sequence is generated, which can be used as binary digits of a random number, as indicated in step S5. In this respect, the method step S1 is realized by the ring oscillator 2, as shown in FIG. The delay in step S2 is performed by the delay elements 3, 4, 5. The logic operation in step S3 is performed by the XOR gate 6. The sampling is performed by the D flip-flop 7.

FIG. 4 shows a second embodiment of a device 100 for generating random bits or a random number. The device 100 has substantially the same elements as shown in FIG. The same or functionally identical elements will therefore not be discussed further.

A digital ring oscillator 2 supplies an oscillator signal OS which is supplied to inputs 15, 16 of two different delay elements 3, 4. The delay elements 3, 4 have different delay times, wherein the maximum delay time is preferably less than half of the nominal period of the ring oscillator 2. At outputs 18, 19 of the delay elements 3, 4 thus delayed oscillator signals Dl, D2 can be tapped. By means of an XOR gate 6, a random signal ZS is generated from the oscillator signals or delayed oscillator signals OS, D1, D2 present at inputs 21, 22, 23, which can be tapped off at the output 25 of the XOR gate 6.

The ring oscillator 2 can be started and stopped by an activation signal AKT. For this purpose, one of the delay elements is not designed as an inverter, but NAND gate 110. The ring oscillator 2 thus has three logic elements 110, 11, 12, which are connected in series with each other. Of these, the first logic element 110 is a NAND gate, to which the activation signal AKT is supplied as well as the output signal of the last present in the chain of inverters 11, 12, which corresponds to the oscillator signal OS. The device 100 also has a control device 31, which generates on the one hand an activation signal AKT for starting the ring oscillator 2, a sampling signal SM, which is the clock input 27 of a D-type flip-flop 7 is supplied, and a control signal CT which supplies to the Data output 28 of the D flip-flops downstream shift register 32 controls.

The random signal ZS is fed to the data input 26 of the D-type flip-flop 7 and the random bit ZB detected or sampled by the D-type flip-flop 7 is fed to the shift register 32. At each sampling, for example by a rising signal edge of the clock or sampling signal SM, the flip-flop 7 outputs a random bit ZB to the shift register 32, so that it is gradually filled. If there are sufficient random bits for a random number of predetermined bit widths, the control device 31 causes an output of the random bit sequence as a binary coded random number ZZ at the output 9 of the device 100.

Although the present invention has been explained in more detail with reference to selected embodiments, it is not limited thereto, but variously modifiable. The proposed number of delay elements or logic elements in the ring oscillator circuits can of course be changed. Furthermore, in addition to the exemplified logical links or scanning devices, further implementations are possible which, for example, implement the method steps illustrated in FIG.

Claims

claims

1. Device (1) for generating a random bit sequence with an oscillator device (2) which generates an oscillator signal (OS) applied with a jitter, at least one delay device (3, 4, 5), which has at least one delayed oscillator signal (D1, D2, D3), a logic device (6) which logically links the delayed oscillator signal (D1, D2, D3) with the oscillator signal (OS) to a random signal (ZS) and a sampling device (7) for sampling the random signal (ZS) and generating a random bit (ZB).

2. Device (1) according to claim 1, wherein a plurality of delay devices (3, 4, 5) are provided, which provide delayed oscillator signals (Dl, D2, D3), and the oscillator signal (OS) of the logic device (6) to the logical Linkage with the delayed oscillator signals (Dl, D2, D3) is supplied.

3. Device (1) according to claim 2, wherein the delay devices (3, 4, 5) are connected in series.

4. Device (1) according to claim 3, wherein the logic device (6) exclusively the delayed oscillator signals

(Dl, D2, D3) logically linked together.

5. Device (1) according to any one of claims 1-4, wherein the oscillator device (2) is designed as a digital Ringoszillatorschalt- circle.

6. Device (1) according to any one of claims 1-5, wherein the logic device (6) is an XOR gate.

7. Device (1) according to any one of claims 1-6, wherein the scanning device (7) is arranged such that a sampling of the random signal (ZS) takes place periodically.

8. Device (1) according to any one of claims 1-7, wherein the scanning device (7) is designed as a D flip-flop.

9. Device (1) according to any one of claims 1-8, wherein the oscillator signal (OS) has an oscillation period (T) and a maximum delay time of the delayed oscillator signals (Dl, D2, D3) is less than half the oscillation period (T / 2 ).

10. Device (1) according to claim 9, wherein the sum of the delay times of the delay means (3, 4, 5) is less than half the oscillation period (T / 2).

11. Device (1) according to any one of claims 1-10, wherein further comprises a register means (32) for storing a plurality of detected random bits (ZB) as a random number (ZZ) is provided.

12. A method for generating a random bit sequence in which an oscillator signal (OS), which has a jitter, is delayed several times and the delayed oscillator signals (Dl, D2, D3) for generating a random signal (ZS) are logically linked together.

13. A method for generating a random bit sequence in which an oscillator signal (OS), which has a jitter, is delayed and the delayed oscillator signal (Dl, D2, D3) for generating a random signal (ZS) are logically linked to the oscillator signal (OS) ,

14. The method of claim 12 or 13, wherein the following steps are performed:

- providing (Sl) an oscillator signal (OS) with a jitter; - delaying (S2) the oscillator signal (OS) to produce at least one delayed oscillator signal (Dl, D2, D3);

- Logically combining (S3) the delayed oscillator signals (Dl, D2, D3) for generating a random signal (ZS) or the Oscillator signal (OS) with the at least one delayed oscillator signal (Dl, D2, D3); and

- Sampling (S4) of the random signal (ZS) at predetermined times for generating a random bit (ZB).

15. The method according to any one of claims 12-14, wherein the delayed oscillator signals (Dl, D2, D3) are subjected to an XOR operation.

16. The method according to any one of claims 12-15, wherein the oscillator signal (OS) with the delayed oscillator signals (Dl, D2, D3) for generating the random signal (ZS) is logically linked.

17. The method according to any one of claims 12-16, wherein the sampling of the random signal (ZS) takes place periodically.

18. The method according to any one of claims 12-17, wherein the oscillator signal (OS) has an oscillation period (T) and the oscillator signal (OS) is delayed by a maximum delay time, which is less than half the oscillation period (T / 2).

19. The method of claim 11, wherein the oscillator signal is a digital oscillator signal fluctuating between two logic levels.