WO2012051920A1

WO2012051920A1 - True random number generator based on sub-threshold properties

Info

Publication number: WO2012051920A1
Application number: PCT/CN2011/080844
Authority: WO
Inventors: 单伟伟; 陆寅超; 戚隆宁; 秦娟; 刘君寅; 时龙兴
Original assignee: 东南大学
Priority date: 2010-10-18
Filing date: 2011-10-17
Publication date: 2012-04-26
Also published as: CN101957741A

Abstract

Disclosed is a true random number generator based on sub-threshold properties. The generator comprises: a fast oscillator, a slow oscillator, a level conversion circuit, a sampling trigger, a signal post-processing circuit, wherein the output end of the fast oscillator is connected to the data end of the sampling trigger via the level conversion circuit, the output end of the slow oscillator is connected to the clock end of the sampling trigger, and the output end of the sampling trigger is connected to the input end of the signal post-processing circuit; the output end of the signal post-processing circuit serves as the output end of the generator, and the signal post-processing circuit carries out a series of hybridization and noise processing procedures on the output signals of the sampling trigger so as to improve the random nature of the output sequence. The structures of the generator and random source circuit provided in the present invention are simple, and it is only necessary for a series of odd level inverter chains to be cascaded; the random property is good, with enhanced frequency jitter in the sub-threshold region and the signal post-processing circuit with high randomization capability enhancing the random property of the output sequence, improving the output result.

Description

A true random number generator based on subthreshold characteristics

The present invention relates to the field of information security and integrated circuit technology, and more particularly to a true random number generator based on sub-threshold characteristics for generating an unpredictable sequence of true random numbers.

Background technique

With the rapid development of computer technology and communication technology, especially the extensive use of the Internet, information has become a very important asset in today's society. The continuous development of the information society has made each person's life closely related to the generation, reception, storage, processing and transmission of information. The combination of business, financial industry and the Internet poses a huge challenge to cryptography and information security.

Random numbers play a very important role in modern cryptography, and they are an important part of crypto chips and hardware. There are two main types of random number generators: pseudo-random number generators and true random number generators. The random sequence calculated by the deterministic algorithm is called a pseudo-random number. If the attacker has enough computing power, the law of pseudo-random number generation can be predicted. The true random number generator utilizes the random noise source of nature, and its output sequence is unpredictable and non-reproducible, which can better protect the transmission of information, and is suitable for chip hardware entities with high information security requirements.

At present, three methods are commonly used to obtain true random numbers in a circuit system: 1) directly obtained by using a resistive thermal noise source; 2) obtained by an oscillation sampling method with clock jitter; 3) obtained by using a discrete-time chaotic circuit. The most commonly used real-noise generator based on the oscillating sampling method is to use a jittered oscillator as a random source, and a precise other oscillator to sample the data output. The random source comes from the frequency jitter on the jittered oscillator. . The jittered oscillator is usually designed to be susceptible to noise disturbance. The more common method is to amplify the thermal noise of the resistor into the oscillator to make its frequency jitter; or by increasing the number of stages of the oscillation chain or increasing the number of oscillation chains. The method adjusts the frequency ratio of the fast and slow oscillators to enhance the effect of external noise on the oscillator frequency. However, the design method of adding resistance thermal noise is complicated and difficult to implement; and the design method using multiple or multi-stage oscillation chains uses a large number of oscillation chains, and the frequency ratio of the fast and slow oscillators is adjusted properly, which is cumbersome and troublesome. The effect is more general.

The ideal random sequence should satisfy the random distribution of numbers 0 and 1 and have no correlation with each other. The first, second and higher order correlation coefficients are small enough to meet other complex stochastic performance criteria. However, the real random number generator in actual work will be affected by temperature, process deviation, power supply ripple and other circuit crosstalk, etc., which makes the output random sequence performance worse. Therefore, the true random number generator needs a post-processing circuit to output. The sequences are digitally processed to achieve higher random performance criteria to meet the needs of the application. Summary of the invention

OBJECT OF THE INVENTION In order to overcome the shortcomings of the conventional random number generator based on the oscillation sampling method, the random jitter is insufficient or the circuit is cumbersome. The present invention provides a true random number generator based on the subthreshold characteristic designed based on the oscillation sampling method. Using a new high-performance random jitter source, a simple circuit can be used to generate high-performance random sequences that can be used in cryptography and other related applications.

Technical Solution: In order to achieve the above object, the technical solution adopted by the present invention is:

A true random number generator based on sub-threshold characteristics, comprising a fast oscillator, a slow oscillator, a level shifting circuit, a sampling flip-flop and a signal post-processing circuit, wherein the output of the fast oscillator passes through a level shifting circuit Connected to the data terminal of the sampling flip-flop, the output of the slow oscillator is connected to the clock terminal of the sampling flip-flop, the output of the sampling flip-flop is connected to the input end of the signal post-processing circuit, and the output of the signal post-processing circuit As the output of the generator, the signal post-processing circuit performs a series of hybridization and noise processing on the output signal of the sampling flip-flop to improve the random characteristics of the output sequence.

The fast oscillator can be implemented by a ring oscillator circuit, and is formed by a series of odd-numbered inverters. By controlling the working voltage supplied to the ring oscillator circuit, the fast oscillator can be operated in the sub-threshold region, and the sub-threshold region ring oscillation is utilized. The circuit is susceptible to external disturbances and can increase the random nature of the final output sequence.

The slow oscillator is a crystal clock circuit, and the precision of the crystal clock circuit is relatively high. The clock frequency of the slow oscillator is less than 1/10 of the clock frequency of the fast oscillator.

The sampling flip-flop uses an edge-sensitive register to sample the fast oscillator and maintain the stability of the sampled data; preferably a D flip-flop is used.

The signal post-processing circuit is composed of an XOR network, a pseudo-random circuit and a SHA1 hash function circuit, and the output end of the sampling flip-flop is connected with the input end of the XOR network, and the output of the XOR network and the input of the pseudo-random circuit The end phase is connected, the output of the pseudo random circuit is connected to the input end of the SHA1 hash function circuit, and the output end of the SHA1 hash function circuit is used as the output end of the generator. The data output by the sampling trigger is first connected to the XOR network, and then the data is white-noised by a pseudo-random circuit, and finally the SHA1 hash function circuit is connected, and the output data of the output of the SHA1 hash function circuit is The output value of the generator.

The XOR network is composed of two or more shift registers connected in series, and an XOR gate is connected between the output ends of adjacent shift registers, and is transmitted to the next stage step by step, and a single random sample is obtained for each sampling. The seed is sequentially shifted and adjacent to XOR to obtain a serial output value; the output of the XOR gate connected to the output of the highest level shift register is connected to the input of the pseudo-random circuit as an output of the XOR network.

The pseudo-random circuit is a linear feedback shift register comprising two or more serially connected registers and a characteristic polynomial constructing a feedback function network, the feedback function network being a modulo two adder circuit; the random number output thus obtained has Similar to the spectrum of Gaussian white noise, the correlation is weak, which greatly improves the random characteristics.

A hash function circuit is also serially connected in the signal post-processing circuit, and the hash function itself is mathematically unidirectional, The characteristics of compressibility and anti-collision can optimize the statistical characteristics of the input data sequence. The present invention adopts the anti-exhaustive SHA1 algorithm to implement the hash network, and can obtain high-performance random number output, the SHA1 Ha The Greek function circuit can be implemented by a typical digital circuit.

The duty cycle of the slow oscillator is as close as possible to 50%, so that the probability of "0" and "1" in the output sequence is close to 50%, and the duty ratio of the slow oscillator is preferably 50%.

Since the fast oscillator operates in the lower subthreshold power supply region, while other circuits generally operate in the normal 1. 8V supply voltage region, the circuits in two different voltage domains cannot communicate directly, so the fast oscillator and the sampling flip-flop There is a need to design a level shifting circuit for matching digital signals between two different voltage domains. The level shifting circuit can be implemented by four PMOS transistors and four NMOS transistors, respectively denoted as a zeroth PMOS transistor MP0, a first PMOS transistor MP1, a second PMOS transistor MP2, a third PMOS transistor MP3, and a zero NMOS transistor. MN0, first NMOS transistor MN1, second NMOS transistor MN2, and third NMOS transistor MN3; first PMOS transistor MP1 and first NMOS transistor MN1 constitute an inverter output connected to the input of the zeroth NMOS transistor MN0, the zeroth NMOS transistor The drain terminal of MN0 is connected to the gate of the second PMOS transistor MP2, the drain terminal of the second PMOS transistor MN2 is connected to the gate of the zeroth PMOS transistor MP0, the zeroth NMOS transistor MN0, the zeroth PMOS transistor MP0, and the second NMOS transistor MN2 The second PMOS transistors MP2 collectively form a cross structure, and the output is connected to an inverter input terminal composed of a third NMOS transistor MN3 and a third PMOS transistor MP3.

Advantageous Effects: The present invention provides a true random number generator based on sub-threshold characteristics, and the structure of the random source circuit is simple, and only one string of inverter chains of odd-numbered stages can be cascaded; random characteristics are good, frequency jitter The enhanced and randomized signal post-processing circuitry enhances the random nature of the output sequence, resulting in better output.

DRAWINGS

Figure 1 is a schematic structural view of the present invention;

2 is a schematic diagram showing the circuit structure of a fast oscillator and a level shifting circuit according to the present invention;

Figure 3 is a working flow chart of the signal post-processing circuit;

Figure 4 is a schematic diagram showing the circuit structure of the signal post-processing circuit.

detailed description

The present invention will be further described below in conjunction with the accompanying drawings.

As shown in FIG. 1, a true random number generator based on sub-threshold characteristics includes a fast oscillator, a slow oscillator, a level shifting circuit, a sampling flip-flop, and a signal post-processing circuit that improves the random characteristics of the output sequence. The output end of the fast oscillator is connected to the data terminal of the sampling flip-flop through a level conversion circuit, the output end of the slow oscillator is connected to the clock end of the sampling flip-flop, and the output end of the sampling flip-flop and the signal post-processing The input terminals of the circuit are connected, and the output of the signal post-processing circuit serves as the output of the generator.

As shown in FIG. 2, it is a schematic diagram of the circuit structure of the fast oscillator and level shifting circuit. The fast oscillator It is a random source, which is realized by a ring oscillator circuit composed of an odd number of inverters in series. The circuit structure is simple, and its frequency is easily affected by factors such as power supply voltage jitter, temperature and circuit noise, and thus has a certain phase jitter; its phase noise The variance will increase with time. After several cycles of accumulation, these jitters will become more obvious. However, the simple phase jitter on the ring oscillator circuit is small, generally at the ps level, if not amplified, even if The superposition of several periods of jitter is also difficult to achieve satisfactory results.

In this example, since the ring oscillator circuit operates in the subthreshold region, its frequency is more affected by the circuit noise, and the phase jitter can be enhanced to a large extent. The following is a description of the principle:

The ring oscillator circuit is composed of an odd number of inverters connected in series, and the oscillation period is T=2*N*t _pd , where N is the number of inverters, and t _pd is the transmission delay time of each inverter. When N is determined, the period of the ring oscillator is determined by the transmission delay time of the inverter. In the case of a normal operating supply voltage, the falling time t _pHl of the NMOS transistor (similar to the _PM0S crystal) is: .52- c _L v _DD

pHL 0

(W / L) _n k _n 'V _DSATn (V _DD - V _Tn - V _DSATn 12) The rise time ^ „ has a similar formula, and the delay time t _d = (t _pHl +t _plH ) /2. In the design, the power supply voltage is chosen to be high enough to satisfy V _DD 〉〉V _Tn +V _DSATn /2. Under these conditions, the delay is basically independent of the supply voltage:

(WIL) _n k _n 'V _DSATn However, when the circuit operates at a sub-threshold, the supply voltage is below the threshold voltage V _Tn and the effect of the supply voltage V _DD will become extraordinarily significant. At this time, there are three main factors affecting the transmission delay of the inverter: 1. Load capacitance C _l; 2. Transistor width to length ratio W/L; 3. Power supply voltage V _DD . The load capacitance and the width-to-length ratio W/L are both established parameters, and generally do not change in the circuit. Therefore, the voltage jitter caused by the jitter of the power supply voltage and the influence of the environmental noise becomes an important factor of the frequency jitter of the ring oscillator circuit. On the other hand, a ring oscillator circuit operating in the subthreshold region is more sensitive to external noise sources that are not degraded.

When the inverter operates in the subthreshold region, the delay time has the following formula according to the model established by CMOS theory:

Kc _nn

VDD - V _{T e}

Exp( ~—^)

nVth

Of which 1. , ₈ , ^ ₈ are the fitted values. This equation shows that the supply voltage has a large effect on the delay time. It is thus concluded that the power supply voltage jitter in the sub-threshold region causes a larger inverter delay time jitter, and the amplification of the phase jitter can be achieved to a large extent after a period of time accumulation. The level shifting circuit includes a zeroth PMOS transistor MP0, a first PMOS transistor MP1, a second PMOS transistor MP2, a third PMOS transistor MP3, a zeroth NMOS transistor MN0, a first NMOS transistor MN1, a second NMOS transistor MN2, and a The three NMOS transistor MN3; the first PMOS transistor MP1 and the first NMOS transistor MN1 form an inverter output connected to the input of the zeroth NMOS transistor MN0, and the drain of the zeroth NMOS transistor MN0 is connected to the gate of the second PMOS transistor MP2, The drain terminal of the second PMOS transistor MN2 is connected to the gate of the zeroth PMOS transistor MP0, and the zeroth NMOS transistor MN0, the zero PMOS transistor MP0, the second NMOS transistor MN2, and the second PMOS transistor MP2 together form a cross structure, and the output is connected to An inverter input terminal formed by the third NMOS transistor MN3 and the third PMOS transistor MP3.

The slow oscillator is a crystal clock circuit having a clock frequency of less than 1/10 of the clock frequency of the fast oscillator; the duty cycle of the slow oscillator is about 50%.

The sampling flip-flop is implemented using a D flip-flop or an edge sensitive register.

As shown in FIG. 3, the working process of the signal post-processing circuit in this example: the sampling signal output by the sampling trigger first performs five-stage shifting, and then waits for the enabling decision of the post-processing start: if the enable end determines If it is N0, it will return to the five-stage shift stage to continue the shift operation. If the enable end determines YES, it will jump into the XOR network, XOR the adjacent bit output and finally get the serial output. The output data stream is sent to the linear feedback shift register for pseudo-synchronization and is converted to 192-bit parallel data by 192-bit serial conversion. The parallel data enters the SHA1 hash hybrid network, and after the message packet is filled, the link variable is initialized, and the 80-round cyclic compression algorithm is obtained, the hash function output is obtained as the output value of the true random number generator.

As shown in FIG. 4, in order to realize the circuit structure diagram of the signal post-processing circuit workflow in FIG. 3, the signal post-processing circuit includes an exclusive-OR network, a pseudo-random circuit and a SHA1 hash function circuit. The input data of the signal post-processing circuit is first connected to the XOR network, and its output is used as the input of the pseudo-random circuit to whiten the data. Finally, the data is connected to the SHA1 hash function circuit, and the final output is obtained as a true random number generator. output value.

The XOR network as shown in the figure is composed of a series of five shift registers connected in series, and an XOR gate is connected between the outputs of adjacent shift registers, and is transferred to the next stage step by step, and each sample is obtained. A single random seed is sequentially shifted and adjacent to XOR to obtain a serial output value; an output of the XOR gate connected to the output of the fifth stage shift register is connected as an output of the XOR network to the input of the pseudo random circuit .

Assuming that the probability that the sampled signal output by the sampling trigger is "1" is A, then the probability of generating "0" is ideally /7=β. According to the XOR network shown in Fig. 4, after the data passes through the first-order XOR gate, the probability of outputting "1" is 2p Gp), and the probability of outputting "0" is p ² + ap) ² . Using mathematical induction, if the XOR chain has n-order XOR gates, then The probability that the output gets "1" is: p (l) = 0.5H 0. 5) ⁿ

The probability that the output gets "0" is: p (0)=0H 0. 5) ⁿ

In this example, a five-level XOR chain is used to optimize the statistical effect.

The pseudo-random circuit is implemented by a linear feedback shift register commonly used in communication systems to generate a pseudo-random noise sequence, comprising two or more serially connected registers and a characteristic polynomial constructing a feedback function network, the feedback function network being a modulo two adder circuit . As shown in Figure 4, the circuit structure of the six-stage linear feedback shift register is shown. The characteristic polynomial of the feedback logic is G ) = + ; c + l. According to the theory of pseudo-random circuits, the output of the linear feedback shift register has the following three characteristics:

(1) 0-1 distribution characteristics: In a pseudo-random period, element 1 appears more than the number of occurrences of element 0.

(2) Run characteristics: The number of runs of element 0 and element 1 is half; the run of elements of length k (lk r-2) accounts for 2- ^{k of the} total number of runs.

(3) Correlation: The autocorrelation function of the output sequence is a periodic binary function.

The pseudo-randomization of the true random seed makes the statistical characteristics of the true random number more excellent. The present invention cross-converts the output of the pseudo-random circuit and continues to input into the SHA1 hash function circuit for hybrid operation, so as to further improve the random number. performance.

As shown in the right half of Figure 4, the structure of the SHA1 hash function is shown, and the output is a hash value of 160 bits. The input sequence length can be any value, here this example uses a 192-bit string and converts the result as a hash input. First, the information is grouped in units of 192 bits, and the initialization variables A=0x67452301, B=0xEFCDAB89, C=0x98BADCFE, D=0xl0325476, E=0xC3D2ElF0. The core of the algorithm is a module consisting of 4 loops, each loop consists of 20 steps, the step function used in each loop is the same, and the step function in different loops contains 4 different nonlinear functions (Ch, Parity, Maj) , Parity), each loop takes the 192-bit ^ and 160-bit cache values A, B, C, D, E currently being processed as input, and then updates the cached content. The final step of the output modulo 2 ³² plus the input of the first loop yields the final hash value.

Using the final output as a true random number provides a secure and reliable key input for modules such as encryption algorithms.

The above description is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention.

Claims

Claim

A true random number generator based on subthreshold characteristics, characterized in that: the generator comprises a fast oscillator, a slow oscillator, a level shifting circuit, a sampling flip-flop and a signal for improving random characteristics of the output sequence Processing circuit, the output end of the fast oscillator is connected to the data end of the sampling flip-flop through a level conversion circuit, the output end of the slow oscillator is connected to the clock end of the sampling flip-flop, and the output end of the sampling flip-flop is The input of the signal post-processing circuit is connected, and the output of the signal post-processing circuit serves as the output of the generator.

2. The sub-threshold characteristic based real random number generator according to claim 1, wherein: said fast oscillator is implemented by a ring oscillator circuit formed by seriesing an odd number of inverters, said fast oscillator operating In the sub-threshold area.

3. The sub-threshold characteristic based real random number generator according to claim 1, wherein: said slow oscillator is a crystal oscillator clock circuit, and said slow oscillator clock frequency is a fast oscillator Less than 1/10 of the clock frequency.

4. The sub-threshold characteristic based real random number generator of claim 1, wherein: said sampling flip flop uses an edge sensitive register.

5. The sub-threshold characteristic based real random number generator according to claim 1, wherein: the sampling flip-flop adopts a D flip-flop.

6. The sub-threshold characteristic based real random number generator according to claim 1, wherein: said signal post-processing circuit is composed of an exclusive OR network, a pseudo random circuit and a SHA1 hash function circuit, and the sampling trigger The output end is connected to the input end of the XOR network, the output end of the XOR network is connected to the input end of the pseudo random circuit, and the output end of the pseudo random circuit is connected to the input end of the SHA1 hash function circuit, SHA1 hash function The output of the circuit acts as the output of the generator.

7. The sub-threshold characteristic based real random number generator according to claim 6, wherein: the XOR network is formed by connecting two or more shift registers in series, at an output end of an adjacent shift register. The XOR gate is connected to the next stage and passed to the next stage step by step. The output of the XOR gate connected to the output of the highest level shift register is connected to the input of the pseudo random circuit as the output of the XOR network.

8. The sub-threshold characteristic based real random number generator according to claim 7, wherein: the pseudo random circuit is a linear feedback shift register comprising two or more serially connected registers and a characteristic polynomial A feedback function network is constructed, and the feedback function network is a modulo two adder circuit.

9. The sub-threshold characteristic based real random number generator according to claim 1, wherein: the slow oscillator has a duty ratio of 50%.

10. The sub-threshold characteristic based real random number generator according to claim 1, wherein: the level shifting circuit comprises a zeroth PMOS transistor MP0, a first PMOS transistor MP1, and a second PMOS crystal. a transistor MP2, a third PMOS transistor MP3, a zeroth NMOS transistor MN0, a first NMOS transistor MN1, a second NMOS transistor MN2, and a third NMOS transistor MN3; the first PMOS transistor MP1 and the first NMOS transistor MN1 constitute an inverter output connection To the input of the zeroth NMOS transistor MN0, the drain of the zeroth NMOS transistor MN0 is connected to the gate of the second PMOS transistor MP2, the drain of the second PMOS transistor MN2 is connected to the gate of the zeroth PMOS transistor MP0, the zeroth NMOS transistor MN0, the zeroth PMOS transistor MP0, the second NMOS transistor MN2, and the second PMOS transistor MP2 together form a cross structure, and the output is connected to an inverter input terminal composed of a third NMOS transistor MN3 and a third PMOS transistor MP3.