WO2014117983A1

WO2014117983A1 - Method and device for generating random bits

Info

Publication number: WO2014117983A1
Application number: PCT/EP2014/050308
Authority: WO
Inventors: Markus Dichtl; Bernd Meyer
Original assignee: Siemens Aktiengesellschaft
Priority date: 2013-02-01
Filing date: 2014-01-09
Publication date: 2014-08-07
Also published as: DE102013201687A1

Abstract

The invention relates to a method for generating a random bit, the method comprising: Generating (S1) a noise signal (RS); scanning (S2) the noise signal (RS) subject to a clock signal (CK) with the aid of a first intermediate storage element (3) for generating a first bit value (B1); scanning (S2) of the noise signal (RS) subject to the clock signal (CK) with the aid of at least one additional intermediate storage element (4) for generating at least one additional bit value (B2); and determining at least one random bit (ZS) subject to the generated bit values (B1, B2). A device (1, 100, 101) for generating a random bit comprises: A noise signal source (2) for generating a noise signal (RS), a first intermediate storage element (3), and at least one additional intermediate storage element (4) for simultaneously scanning the noise signal (RS) subject to a clock signal (CK).

Description

description

Method and apparatus for generating random bits The present invention relates to a method for generating a random bit and to a device for generating one or more random bits. For example, a random bit sequence is generated which is used as a binary random number. The proposed devices and methods for generating random bits serve, for example, the implementation of random number generators.

Random data is needed for security applications, for example. Thus, random bits can be used to derive cryptographic keys or the like. Ideally, random bits generated have the same probability of occurrence and are statistically independent of each other. For this purpose, a random source for generating the random bits with a high entropy is desired.

From the generated random bits further more complex random numbers, such as random bit sequences or random bytes, can be derived. In the past, among other things, physical processes such as radioactive decays have been used as random events. The difficulty here is to carry out measurements on the physical system at low cost in order to be able to derive the random data. In particular, implementations that are not worthy of mention are desirable

Require mixed signals from analog and digital elements.

Pseudo-random number generators are known and generate random bits based on an algorithm of so-called seed data. Since the derived pseudo-random bit string is essentially deterministic after the seed determination, such random number generators are not suitable for cryptographic applications. In the past, hardware random number generators have been exploited utilizing fluctuations of period lengths or jitter in ring oscillator circuits. Frequently, however, the achieved entropy and / or random data rate did not meet the desired requirements.

It is therefore an object of the present invention to provide an improved method and / or apparatus for generating random bits.

Accordingly, a method for generating a random bit is proposed which comprises the steps:

Generating a noise signal;

Sampling of the noise signal as a function of a

Clock signal by means of a first latch element for generating a first bit value;

Sampling the noise signal as a function of the clock signal with the aid of at least one further buffer element for generating at least one further bit value; and

Determining at least one random bit in dependence on the generated bit values. Furthermore, an apparatus for generating a random bit is proposed, which comprises:

a noise signal source for generating a noise signal;

a first latching element and at least one further latching element for simultaneously sampling the noise signal in response to a clock signal.

The device is in particular configured to perform a corresponding method for generating a random bit. In embodiments, the device has at least three buffer elements. This achieves good entropy of the bit-pattern-generating bit values. The noise signal originates, for example, from a noise signal source which generates a signal. For example, irregular vibrations can be generated. The noise signal source can also provide a true random signal which varies between predetermined signal levels. By simultaneously sampling the noise signal in the manner of a sample as a function of a clock signal at a clock time, a respective level is detected in the buffer elements and buffered. The detected level then corresponds to a bit value, for example 0 or 1 or L or H.

The particular analog noise signal is thus scanned simultaneously multiple times, whereby, for example, caused by physical differences of the implemented intermediate storage elements in a semiconductor process deviations. Also, a signal propagation time can lead to different sampling results and thus different bit values. The buffer element is for example a flip-flop. Particularly in the case of a D flip-flop, the sampling of the input signal, in the present case the noise signal, requires a clock edge. Since the noise signal has an irregular temporal signal curve, inaccuracies or randomness result from the different physical implementation of the buffer elements. For example, there may be violations of setup and hold times of the flip-flops, so that different measurement results are detected at different buffer elements. Potential metastatic states in the staging elements can also be used as a source of chance.

It will be understood that a clock signal source is a corresponding clock signal that fluctuates regularly between two levels. nal, wherein the clock signal comprises rising and falling clock edges. The generated clock signal is fed to clock inputs of the latching elements which, on the basis of signal characteristics, for example signal edges, internally perform a sampling of the signal level at a data input and interpret it as a logic level. The logic level is then understood as a bit value and output.

The distance from the clock signal source to the various latch elements may be different, and that

Clock signal can therefore be influenced differently by the signal path, so that the signal shapes can differ slightly. The clock signal at a respective buffer element is understood to mean that, starting from the clock signal generator, the clock signal is branched to the buffer elements as "branch clock signals." The respective branch clock signal therefore corresponds essentially to the influences of the signal path or other factors on the generated clock signal.

In the buffer elements can also speak of sample and hold or sample and hold members. Essentially, however, flip-flops are used.

In embodiments of the method and / or the device for generating a random bit, the noise signal is supplied directly to a respective data input of the buffer elements or the data inputs of the buffer elements are coupled to a common line node, at which the noise signal can be tapped.

In embodiments of the method and apparatus, the noise signal is generated by means of a physical noise source. It is also conceivable that the noise signal is generated by means of a digital ring oscillator. Does the noise signal source include a digital ring oscillator circuit, An odd number of inverter devices is fed back, resulting in a substantially oscillating signal. With particularly short inverter chains, for example three or five inverters, a quasi-analogue signal form results through the short feedback path. Such an oscillation signal can be regarded as a noise signal.

In embodiments, a corresponding digital ring oscillator comprises between three and ten inverters that are directly or indirectly fed back together. In further embodiments, eleven to twenty inverters are fed back.

In further embodiments, the digital ring oscillator circuits include Glois or Fibonacci and / or simple ring oscillators.

The device for generating random bits preferably comprises exclusively digital components. This has the advantage that no mixed signal circuits are necessary, which must process analog and digital signals. In this respect, production with the aid of purely digital circuit components is also cost-effective. A random number generator or a device for generating random numbers can then be produced using standard semiconductor processes or else implemented as FPGAs or in FPGA devices.

In variants of the method, the generation of the bit values can take place a plurality of times in succession, and the determination of at least one random bit is then carried out as a function of a plurality of previously generated bit values. In this respect, the sets of bit values or bit patterns that are generated successively exploit the "contained" randomness in order to essentially derive random data.

In embodiments of the method or a correspondingly implemented device, for example, a In the case of a programmable microprocessor, a microcontroller or the like as a control device, the bit values are mapped to bytes with the aid of a hash function. For example, the bit values of a given bit width (number of bit values) generated during a scanning process are mapped to a word of lesser bit width, for example one byte.

It is also possible to post-process the bit values or bytes. In doing so, e.g. a modified Neumann method for generating predetermined random patterns of bit values used. One conceivable method is described in: Ari Juels, Markus Jakobsson, Elizabeth A. M. Shriver, Bruce

Hillyer: "How to Turn Dice into Fair Coins" in IEEE Transactions on Information Theory, Vol. 46, No. 3, pg. 911-921, Year: 2000.

Embodiments of the method provide that the bit values generated during a sampling are assigned to a predetermined random value. For example, a random pattern is generated each time a scan is performed, and a limited number of different patterns can be generated depending on the bit width or the number of random bits generated during a scan. This depends on the concrete electronic or physical design of the device.

In order to reduce or compensate correlations between bit values or bits, suitable methods are known. Overall, the method enables a circuit-wise easy-to-implement random number generator. Only a small number of electronic components are necessary, which can be manufactured as standard. Due to the generation of multiple bit values in one scan, the data rate can be increased over known randombit generators. In embodiments, between 48 and 72 bit values are preferably generated, in particular 64 bit values. From this, at least two different random bits are generated or derived.

Further possible implementations of the invention also include not explicitly mentioned combinations of method steps, features or embodiments of the method or the random bit generator described above or below with regard to the exemplary embodiments. The skilled person will also add or modify individual aspects as improvements or additions to the respective basic form of the invention. The above-described characteristics, features, and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following description of the embodiments, which will be described in detail in conjunction with the drawings.

Showing:

1 shows a schematic illustration of a first exemplary embodiment of a device for generating random bits;

FIG. 2 is a schematic flow diagram of a method for generating random bits; FIG.

Fig. 3 is a schematic representation of a second embodiment of an apparatus for generating random bits; and Fig. 4 is a diagram for explaining correlations between random bit values. In the figures, identical or functionally identical elements are provided with the same reference numerals, unless stated otherwise. 1 shows a schematic representation of a first embodiment of a device 1 for generating random bits. For explaining the operation and the generation of random bits, a flowchart for a method for generating random bits is schematically indicated in FIG.

The first embodiment of a random bit generator 1 comprises a noise signal generator 2 which supplies a noise signal RS at an output 5. The noise signal RS is, for example, an analog or quasi-analog signal which is generated by the noise source 2. The noise signal RS is preferably generated by mutually coupled digital switching elements in the noise signal generator 2.

The device 1 comprises two buffer elements, which are designed as D flip-flops 3, 4. Each flip-flop 3, 4 has a data input D, a clock input C and a data output Q. The noise signal RS is fed directly to the data inputs D of the flip-flops 3, 4. To the clock inputs C of the flip-flops 3, 4 a common clock signal CK is coupled. At the outputs Q of the flip-flops 3, 4, bit values can be tapped as a function of the buffered or sampled level of the noise signal RS. For this purpose, the outputs Q are routed to a respective output 6, 7 of the random bit generator device. At the outputs 6, 7 bit values Bl and B2 can be tapped.

The flip-flops 3, 4 provide substantially well-defined logic levels 0, 1 and L, H as bit values Bl, B2. By contrast, the noise signal RS fluctuates irregularly between predetermined levels, so that it is not possible to predict which logic level is detected or sampled by the flip-flops 3, 4 at the respective clock edge time. For generating little correlated random bit values at the outputs 6, 7, the provision of the noise signal RS takes place in a first step S1. Subsequently, in response to the clock signal CK, for example in the case of a rising or falling clock signal edge, sampling or sampling of the noise signal RS conducted to the data inputs D ensues in step S2. Due to, for example, violations of setup and hold times for the flip-flops 3, 4 or other operating parameters counteracting the normal operation of flip-flops, randomness or entropy arises which is used to generate random bits from the bit values Bl, B2 can be. In step S3, therefore, the determination of a random bit occurs as a function of the generated bit values Bl, B2. It is possible for the differently sampled or generated bit values Bl, B2 to depend on operating conditions such as temperature voltage or external fields. Even manufacturing variations in the physical implementation of the flip-flops 3, 4 or the geometry of the circuit and signal propagation time can lead to different Abtannergeb- results in spite of the same clock signal CK.

By multiple sampling in succession and a statistical evaluation, correlations of the bit values which can be tapped off at the outputs 6, 7 can be treated or compensated so that true random bits or random values can be derived. Essentially, in the simple representation of FIG. 1, four possible bit patterns B1 B2 = 01, 10, 11, 00 are produced. For example, a corresponding "random bit pattern" is generated at each rising clock edge.

FIG. 3 shows a further embodiment of a random bit generator. The random bit generator 10 comprises an (analog) noise source 20, which supplies a random noise signal RS at an output 5. The device 10 comprises, for example, N = 64 D flip-flops 3-1 to 3-N, each having data inputs D, clock inputs C and data outputs Q. The data inputs D are coupled together to the output 5 and receive the noise signal RS. The device is equipped with a clock signal generator 9 which supplies a clock signal CK which is fed to the clock inputs C of the flip-flops 3-1 to 3-N. A control device 8, for example a microcontroller or processor, which is suitably programmed or set up, controls the noise source 20 and the clock generator 9 via control signals CT1 and CT2.

In the embodiment of FIG. 3, the noise signal source 20 is designed as a ring oscillator with three feedback inverters 12, 13, 14. The feedback path can be interrupted via a controllable switch 15. The controllable switch can be controlled by the control device 8, for example, by control signals CT1. A well-defined signal level, for example H or L, can be tapped at a node 16. The switch 15 switches between the well-defined level at an open feedback path and a closed feedback path. Regularly, for example, the path is closed, so that a random oscillation of the ring oscillator begins. Due to the particularly short feedback path with only three inverters results in an analog noise signal RS at the output 5.

In operation of the random bit generator 10, in response to the clock signal CK, the noise signal RS is sampled in parallel and simultaneously from the flip-flops 3-1 to 3-N, thereby generating a respective bit or bit value B1-BN present at the respective output Q can be tapped. The bit pattern from the bit values Bl-BN is fed via a suitable data line to the input 17 of the control device 8. The control device 8 can evaluate or post-process the detected bit patterns Bl-BN. For example, skews or correlations of the bit values can be compensated by suitable calculation methods.

At the output 8 in the control device 8 there is then a random bit or number signal ZS, which is output at the output 11 of the random bit generator 10. The random bit or Number generator 10 may be implemented as FPGA, for example.

Investigations by the applicant have shown that, for example, when implementing the device shown schematically in FIG. 3 as a FPGA with N = 64 flip-flops, a relatively low correlation of the 64 bits B1-B64 occurs. It follows, for example, that with repeated starting of the ring oscillator 20 and after a predetermined time by the sampling of the bit values Bl-BN about 150 different bit patterns occur. This results in an entropy of 5.2 bits per measurement. In this respect, random words of the bit width 5 can be generated reasonably reliably with the aid of the device 10.

FIG. 4 shows a correlation diagram with gray values, with a black box representing a correlation of 1 and a white box representing a correlation of -0.81. At the edges, the 64 possible bit values B1-B64 are recorded. It can be seen that each bit correlates with itself to 100%. It can also be seen that groups of bits occur which correlate relatively strongly with each other, while other bits are largely uncorrelated. The correlation of the sampled noise signal components and the bit values Bl-BN generated therefrom may, for example, depend on the topology of the implemented digital circuit. In the implementation of the random bit generator as an FPGA, the combination of configurable logic blocks of multiplexers, adders, flip-flops, and the like can lead to correlation, since, for example, signal paths are particularly similar for certain flip-flop groups.

The detected bit patterns of 64 bits can, for example, be mapped to bytes by means of hashing and then be post-processed using known methods. A suitable method is, for example, in Ari Juels, Markus Jakobson, Elizabeth AM Shriver, Bruce Hillyer: "How to turn lo- aded dice into fair coins "in IEEE Transactions on Information Theory, Vol. 46, No. 3, Pg. 911-921, Year: 2000. In this respect, there is potentially an additional overhead in the post-processing of the generated bit patterns, for example by a microprocessor or suitable software, however, a very high bit rate can be achieved with random bits.

The proposed methods and devices are based essentially exclusively on digital circuit components, so that standard processes can be used for production. Despite the quasi-analog noise signal generation with the help of short ring oscillators, no complex mixed-signal implementation is necessary. Overall, only a few electronic components are needed, so that cost-sensitive applications can be equipped with random bit or number generators.

Although the invention has been further illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

Claims

claims

A method of generating a random bit comprising:

Generating (S1) a noise signal (RS);

Sampling (S2) the noise signal (RS) as a function of a clock signal (CK) by means of a first buffer element (3) for generating a first bit value (Bl);

Sampling (S2) the noise signal (RS) as a function of the clock signal (CK) with the aid of at least one further buffer element (4) for generating at least one further bit value (B2); and

Determining (S3) at least one random bit (ZS) in dependence on the generated bit values (B1, B2).

2. The method of claim 1, wherein the sampling of the noise signal (RS) at predetermined clock edges simultaneously using the first and the further latch elements (3, 4).

3. The method of claim 1 or 2, wherein the noise signal (RS) by means of a physical noise source (2) is generated.

4. The method according to any one of claims 1-3, wherein the

Noise signal (RS) using a particular digital ring oscillator (20) is generated.

5. The method according to any one of claims 1-4, wherein the

Noise signal (RS) directly to a respective data input (D) of the latch elements (3, 4) is supplied.

6. The method according to any one of claims 1-5, wherein at least five bit values (B1 ... BN) are generated.

The method of any of claims 1-6, further comprising: mapping the bit values (B1 ... BN) to bytes using a hash function.

The method of any of claims 1-7, further comprising: subjecting the bit values (B1 ... BN) or the bytes to a method for generating predetermined random patterns of bit values.

9. The method of claim 1, further comprising: assigning the bit values (B1..B.N) generated during a sampling to a predetermined random value.

10. The method according to any one of claims 1-9, wherein the generation of the bit values (Bl, B2) is performed several times in succession, and the determination (S3) of at least one random bit (ZS) in dependence on a plurality of previously generated bit values (B1, B2) ,

11. Apparatus (1, 10) for generating a random bit comprising: a noise signal source (2) for generating a noise signal {RS);

a first intermediate storage element (3) and at least one further intermediate storage element (4) for simultaneous sampling of the noise signal (RS) in response to a clock signal (CK).

12. Device (1, 10) according to claim 11, which is adapted to perform a method according to any one of claims 1-10.

13. Device (1, 10) according to claim 11 or 12, wherein the latching elements (3, 4) are flip-flop devices.

14. Device (1, 10) according to any one of claims 11 - 13, wherein the device (1, 10) exclusively comprises digital components.

15. Device (1, 10) according to any one of claims 11 - 14, where in the device (1, 10) is part of an FPGA device.