Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F7/58—Random or pseudo-random number generators
  • G06F7/588—Random number generators, i.e. based on natural stochastic processes
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F7/58—Random or pseudo-random number generators
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
  • H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
  • H04L9/0656—Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
  • H04L9/0662—Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher with particular pseudorandom sequence generator
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
  • H04L9/0852—Quantum cryptography
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
  • G06N10/00—Quantum computing, i.e. information processing based on quantum-mechanical phenomena

Definitions

• the present disclosure pertains to a device for quantum random number generation based on an optical process of quantum nature comprising a light source emitting photons randomly as well as to a corresponding method, both allowing to obtain random numbers of high quality.
• the present disclosure is situated in the context of the generation of random numbers.
• the generation of high quality random numbers is essential to security of many applications such as cryptographic protocols, both classical and quantum.
• conventional asymmetric key protocols like the well known DSA-, RSA- and Diffie- Hellman-algorithms, use random numbers, tested for primality, to generate their keys.
• Another example is the unconditionally secure one-time pad protocol which needs a string of perfectly random numbers of a length equal to that of the data to be encrypted.
• the main limitation of this protocol is the requirement for key exchange.
• Quantum key distribution offers a way to generate two secure keys at distant locations, but its implementation also requires a vast quantity of random numbers. All these examples reflect Kerckhoffs' principle which dates back to the 19th century and states that the security of a cypher must reside entirely in the key.
• Random number generation nowadays thus not only concerns defense issues such as initially targeted by Kerckhoffs' studies but has influence on many other fields like computer technology and science in general, economy, lotteries and games, as well as privacy issues of institutional— or individual's personal data stored or 'encrypted based on protocols using random numbers.
• high quality random numbers are hard to produce, in particular they cannot be generated by a deterministic algorithm such as a computer program.
• existing algorithm-based quasi-random number generators may advantageously be used for simulation purposes, but are not adapted for cryptography, since the resulting quasi-random numbers are, in principle, reproducible.
• a physical random number generator is required, such as explained by C. H.
• image sensors have been used to generate random numbers of classical origin by extracting information from a moving scene, e.g., a lava lamp, or using sensor readout noise, like disclosed by R.G. Mende, L.C. Noll, and S. Sisodiya in patent US 5,732,138 entitled “Method for Seeding a Pseudo- Random Number Generator with a Cryptographic Hash of a Digitization of a Chaotic System", 1998.
• Other examples for such kind of physical random number generators are dis- closed in US 6,831,980, US 6,215,874, W02013/003943, EP 1 821 196, W001/95091.
• QRNGs quantum random number generators
• Known QRNGs are based on specialized hardware, such as single photon sources and detectors like disclosed, for example, by A. Stefanov, N. Gisin, 0. Guinnard, L. Guinnard, and H.
• QRNGs indeed produce random numbers of quantum, i.e., random origin
• the corresponding devices are complex and cost intensive.
• Devices which generate random numbers of classical origin have a low performance in terms of randomness and throughput.
• the device should have reduced size, complexity, and production cost as well as increased scope of applicability as compared to existing devices.
• the present disclosure proposes a device that achieves the objectives identified above, as well as a corresponding method.
• the device for random number generation based on an optical process of quantum nature distinguishes by the fact that it further comprises a light detector adapted to absorb the randomly emitted photons and to measure a number n of photons produced by said light source in a time interval T, and a randomness extractor, wherein the detector comprises a photon sensor acting as a photon-to-electron converter, an amplifier for converting the electron signal received from the photon sensor into a voltage and amplifying the voltage signal V, as well as an analog-to-digital converter for treating the amplified signal V received from the amplifier by encoding the amplified signal V into digital values d and sending these digital values d to the randomness extractor for further processing such as to produce quantum random numbers (QRNs) based on said number n of photons produced by the light source in a time interval T.
• QRNs quantum random numbers
• the light source may be chosen as a light emitting diode or a laser diode and the photon sensor may be formed by a CCD camera or a CMOS camera.
• the camera respectively in general the photon sensor, is operated in the linear regime where its Fano factor is close to 1, and— for optimal performance— the analog-to-digital converter is tuned such as to have an electron-to-digital conversion factor ⁇ fulfilling the condition ⁇ > 1.
• the device for generating random numbers can include a plurality or family of randomness extractors and the device can be calibrated using these extractors.
• the device includes a light source that emits photons and a photon sensor with a plurality of pixels that absorbs the photons emitted from the light source.
• the device can include a processor with soft- ware that calculates respective minimum entropy levels for the pixels of the photon sensor, and based on these calculated entropy levels, matches or associates one of the randomness extractors with each of the pixels.
• the extractor associated with the each pixel can generate a number of high-entropy bits for generating a random number.
• the disclosure is also related to a corresponding method and computer program means adapted to implement this method.
• Figure 1 schematically illustrates the distribution of probability P(n) that a number n of photons is measured by an image sensor's pixel, said probability being the combination of quantum uncertainty a q originating from the quantum nature of a light source and technical noise Gt originating from the technical equipment used.
• Figure 2 schematically illustrates the principal components of a device for random number generation according to an exemplary aspect, these components being a light source, a detector, and a randomness extractor, wherein the detector comprises several sub-elements, as well as the operating principle of the device.
• Figure 3 schematically illustrates an example of a device for random number generation according to an exemplary aspect, the device comprising an LED as a light source, a detector illuminated by said LED, and a randomness extractor which treats the digital output of the detector.
• Figures 4a and 4b show, for an ATIK 383L camera, respectively for the camera included in the Nokia N9 mobile telephone, the Fano factor F for various illuminating intensities.
• Figures 5a and 5b show normalized histograms of the photon distributions obtained when using an ATIK 383L CCD camera and a Nokia N9 CMOS camera, respectively, as a detector.
• Figure 6 schematically illustrates a block diagram of device for random number generation according to another aspect of the present disclosure.
• Figure 7A illustrates an example of a photon sensor according to the exemplary aspect to illustrate a method for calibrating the random number generation device described herein.
• Figure 7B illustrates a distribution of probability P(n) that a number n of photons is measured by the pixels in the corresponding regions "A", "B", and "C" as shown in Figure 7A.
• Figure 8 illustrates a graph depicting a representation illustrating a minimum en- tropy variation that is plotted as a function of the absorbed photons n according to an aspect of the present disclosure.
• Figure 9 illustrates a flowchart for a method of calibration of the random number generation device at a pixel level according to an aspect of the present disclosure.
• Figure 10 illustrates a method for calibration of the random number generation device according to an aspect of the present disclosure.
• the concept of the present disclosure relies on the fact that some properties of a quantum state are unknown before measurement as well as fundamentally unpredictable.
• One such property, used in most known QRNGs, is the path taken by a photon impinging on a beamsplitter.
• Another such property is the number of photons produced by a light source in a time interval T. It is the latter effect which is used in the context of this disclosure.
• most light sources emit photons at random times or emit a random number of photons at a time.
• both of these effects shall in the further course of the description be embraced by the wording that such light sources emit photons randomly. In any case, it is impossible to predict the number of photons emitted per unit time.
• Quantum noise This quantum effect is usually called “quantum noise” or “shot noise” and has been shown to be a property of the light field rather than a technical limitation of the light source or of the detector, see e.g., the article “Experimental Realization of Sub-Shot Noise Quantum Imaging” by G. Brida, M. Genovese, and I. R. Berchera published in Nat. Photon, 4(4):227-230, 2010. Only some particular light sources, namely amplitude-squeezed light, can overcome this fundamental noise, such as reported by Daniel F. Walls in the article “Squeezed States of Light” published in Nature, 306: 141-146, 1983.
• the basic assump- tions of this approach consist in that (a) a number n of photoelectrons can be measured by a detector, e.g., an image sensor's pixel, with a probability P(n), (b) this measured distribution will be, assuming that the detector is operating in a linear regime, the combination of quantum uncertainty o q and technical noise ⁇ ,, and (c) from a single shot measurement these two noise components cannot be distinguished, however the technical noise a t is assumed to be fully deterministic and thus known to an adversary.
• a detector e.g., an image sensor's pixel
• a device adapted to realize the above concept comprises, such as shown schematically in Figure 2, a light source 1, a detector 2, and a randomness extractor 3.
• the light source 1 may be chosen amongst a light emitting diode (LED), a laser diode (LD), or any other adequate light source, even ambient light, as long as the source emits photons randomly in the meaning defined above.
• the detector 2 comprises several elements and can be modeled, such as also schematically indicated in Figure 2, as lossy channel 2.1 with a transmission probability ⁇ , similar to a beamsplitter with a given splitting ratio, followed by a photon sensor 2.2 acting as a photon-to-electron converter with unit efficiency.
• the transmission probability ⁇ contains all the losses due to the optical elements and the photon sensor's 2.2 quantum efficiency.
• the photon sensor 2.2 may be realized by any kind of photon detector, in particular by an image sensor with an array of pixels or even by each individual pixel of such an image sensor, like a nowadays commercially available CCD or CMOS camera or similar off-the-shelf components adapted to act as an image sensor and having sufficient light sensitivity.
• the detector 2 further comprises processing electronics, in particular an amplifier 2.3 for converting the electron signal received from the photon sensor 2.2 into a voltage and amplifying the voltage signal V as well as an analog-to-digital converter (ADC) 2.4 which treats the amplified signal V received from the amplifier 2.3 by encoding the amplified signal V representing photon, respectively electron numbers into digital values and sending these values to further processing, i.e., to said randomness extractor 3 which will be described in more detail hereafter.
• the amplifier 2.3 and the ADC 2.4 may also be chosen amongst commercially available elements. All the above mentioned components may be inte- grated at a circuit, package or dye level.
• the randomness extractor can be implemented in software, but is also possible to realize that component by hardware.
• ⁇ an electron-to- digital conversion factor ⁇ . If ⁇ > 1 , then for each possible number of electrons generated by the photon sensor 2.2, i.e., for each possible number of photons produced by the light source 1 and absorbed by the sensor 2.2, there is one unique digital value or code at the output of the ADC 2.4, i.e., at the output of the detector 2.
• the condition ⁇ > 1 is thus not an obligatory requirement, but preferred for optimal performance of the device.
• noise needs to be added, since noise of different origins like, e.g., thermal noise, leakage current, or readout noise cannot be avoided in a real device. In general, this noise fol- lows a normal distribution and adds linearly to the signal, like symbolically indicated in Figure 1.
• a device such as described above allows to access the shot noise statistics of the light source 1 and thus to generate random numbers of quantum origin.
• each photon absorbed by the photon sensor 2.2 will generate an electron, in particular within a corresponding pixel if an image sensor with an array of pixels is used.
• the number of electrons generated in time interval T is unpredictable, due to the quantum nature of light and of the absorption process.
• the number of electrons is converted to a voltage, amplified and digitized by components internal or external to the sensor 2.2. It is important that the amount of light and the parameters for the amplification and digitization are appropriate, so that a significant amount of quantum entropy is collected.
• an appropriately tuned randomness extractor 3 allows to ensure that the output random numbers have a quan- turn origin, i.e., that the amount of quantum entropy per output bit is close to 1 , such as will become clear in the further course of the description which will also specify in more detail the required amount of light and said parameters for the amplification and digitization.
• the detector preferably should fulfill the condition ⁇ > 1 mentioned above.
• the measured value X can be encoded over b bits, but it is of course possible to encode the value on another basis than the binary system.
• the entropy H(X q ) of quantum origin per bit of the output will be on average H(X g )/b ⁇ l. Assuming adequately chosen operating conditions such as mentioned here above, where the ADC 2.4 is not saturated, the entropy s per bit can be approximated by dividing H(X q ) by the number of output bits of the ADC. To obtain a string of perfectly random bits, i.e., with unit quantum entropy per bit, an extractor is required.
• an extractor computes a number k of high-entropy output bits y t from a number 1 > k of lower-entropy input bits r,-. This can be done by performing a vector-matrix multiplication between the vector formed by the raw bit values r,- and a random 1 x k matrix M (performed modulo 2) according to
• the matrix M serving as randomness extractor 3 usually is a pre-generated constant. For raw input bits with entropy s per bit, the probability that the output vector yi deviates from a perfectly random bit string is bounded by
• an adequate randomness extractor 3 may also be realized by a hash function performing an operation equivalent to the above described matrix-multiplication extractor. This is known to the person skilled in the art and thus doesn't need to be further described at this place.
• a device such as described above, comprising a light source 1, a detector 2, and a randomness extractor 3 of the type just described, as well as the results which may be obtained with such a device, two different exemplary designs of the proposed random number generator shall now be exposed.
• image sensors like the ones found in digital cameras and smartphones have improved enormously. Their readout noise nowadays is of the order of a few electrons and their quantum efficiencies can achieve 80%.
• image sensors are 5 intrinsically parallel and offer high data rates. It is thus possible to use such image sensors as a component of a quantum random number generator, which shall in the following be demonstrated both with a commercial astronomy monochrome CCD camera, an ATI 383L camera, and a CMOS sensor in a mobile phone, a Nokia N9 camera. The latter is a color camera from which only the green pixels were used for the purpose of the following demonstration.
• Figure 3 schematically illustrates an example of a device for random number gen- eration according to an exemplary aspect of the present disclosure, the device comprising a light source 1 which is realized by a LED, a camera 2 which is fully and homogeneously illuminated by said LED and the raw data of which, i.e., the binary representation of pixel values produced by the camera 2, are concatenated and passed through a randomness extractor 3 which in turn outputs quantum random numbers (QRNs) ready to be used.
• the camera 2 is supposed to be formed either by said ATIK 383L camera or said Nokia N9 camera.
• a well-controlled light source like a LED like as schematically shown in Figure 3, is used.
• a number of photons n is absorbed by the photon sensor 2.2 of each camera 2 and converted into an equal number of electrons. This charge is in turn converted into a voltage by the amplifier 2.3 and finally digitized by the ADC 2.4.
• these components are supposed to form part of the camera 2 in Figure 3.
• the amplifier gain which in commercially available cameras corresponds to the "ISO" setting, is chosen such that each additional input electron will result in an output voltage increase sufficient to be resolved by the ADC, which means that each electron increases the digital output code c by at least 1.
• both detectors have a large range of intensities where the Fano factor is close to 1, in particular both the ATIK and the Nokia cameras have good linearity, i.e., better than 0.998 for a large range of light intensities.
• the statistics are dominated by the quantum uncertainty, i.e., by the shot noise.
• saturation occurs, which means that the Fano factor decreases, as the output is a constant.
• the Nokia N9 camera this happens at intensities corresponding to about 450 to 500 absorbed photons per pixel, whilst for the ATIK camera this happens at about 2 x 10 4 absorbed photons per pixel. This is due to the high amplifier gain used, which was chosen at ISO 3200.
• a Fano factor much greater than 1 is observed, which is due to the detector's technical noise.
• Image sensors such as CCD and CMOS have various sources of noise, like thermal noise, leakage current and readout noise.
• Thermal and leakage noise accumulate with integration time, such that it is possible to eliminate or at least greatly reduce these noise sources by using short exposure times, e.g., exposure times of the order of a millisecond, e.g., in the range of 0.1 to 100 milliseconds.
• readout noise becomes the dominant source of technical noise and is given by the readout circuit, the amplifier and the ADC.
• noise is usually counted in electrons
• the ATIK 383L CCD camera and the Nokia N9 CMOS camera have a noise of 10 e ⁇ , and 3.3 e ⁇ , respectively.
• the exposure time has to be chosen depending on the type of camera, i.e., the type of detector 2, and the light intensity such that the detector works in its linear regime and that, preferably, the readout noise becomes the dominant source of technical noise. In practice, the exposure times thus may vary greatly.
• Table 1 Normalized histograms of the obtained photon distributions are shown in Figures 5a and 5b for the ATIK 383L CCD camera and for the Nokia N9 CMOS camera, respectively.
• equation (2) it is then possible on the basis of these facts and operating parameters to use equation (2) to calculate the amount of entropy of quantum origin per pixel, which is 8.9 bits and 6.4 bits for the ATIK 383L CCD camera and for the Nokia N9 CMOS camera, respectively. These are encoded over 16 and 10 bits, respectively, resulting in an average entropy per output bit of 0.56 for the ATIK 383L CCD camera and 0.64 for the Nokia N9 CMOS camera. These results are also figuring in Table 1.
• an adequate extractor 3 is applied according to equation (3) which allows to apply a mixing of the randomness of quantum origin contained in each raw bit obtained from the detector 2 into the output bits of the randomness extractor 3 forming the final digital output of the QRNG as well as to increase the entropy in the output bits of the randomness extractor 3 as compared to the one in the raw bits obtained from the detector 2. This is an important reason why it is preferable, but not necessary for realization of a QRNG according to the present disclosure that the inevitable technical noise a t of the detector 2 is smaller, or comparable to, the quantum uncertainty a q .
• the choice of the extractor 3, in particular with respect to its dimension k, is done according to the above mentioned principles.
• the detected photon number distribution can be described by a Poisson distribution and its minimum entropy can be approximated by equation (1).
• the size and the compression factor of the extractor 3 may be tuned such as to ensure that each bit of output from the extractor has an amount of quantum entropy close to 1 by determining the size and the compression factor of the randomness ex- tractor so that the number of output bits per measurement is smaller than the minimal entropy of the detected photon number distribution.
• a second testing step may consist in the "die harder" randomness tests which can be applied on both the extracted bit strings, i.e., the raw random numbers produced at the output of the detector 2 and the random numbers delivered by the randomness extractor 3.
• This set of tests contains the NIST test, the diehard tests and some extra tests. The QRNG according to the present disclosure passed all these tests.
• a QRNG Quality of the random numbers generated
• other parameters of a QRNG are important, e.g., the production speed of the random numbers, as well as affordability and portability of the device.
• speed is not as important as the affordability and portability which are provided by this system.
• a quantum random number generator based on an image sensor can provide very reasonable performance in terms of speed.
• Consumer grade devices such as the CCD and CMOS detectors used acquire data at rates between 100 Megapixels per second and 1 Gigapixel per second. After the necessary processing, each pixel will typically provide 3 random bits so that rates between 300 Mbps and 3 Gbps can be obtained.
• processing can be done either on a Field Programmable Gate Array (FPGA) or could be embedded directly on a CMOS sensor chip, in- eluding the processing step realized by the randomness extractor 3 which in that case is fea- tured by hardware.
• FPGA Field Programmable Gate Array
• CMOS sensor chip CMOS sensor chip
• implementing the randomness extractor 3 fully in the software of a consumer device is possible and can sustain random bit rates greater than 1 Mbps, largely sufficient for most consumer applications. Therefore, it is possible to realize a device for quantum random number generation according to the present disclosure by using technol- ogy compatible with consumer and portable electronics.
• a corresponding method for random number generation comprises the steps of providing a light source 1 emitting photons randomly, providing a light detector 2 adapted to absorb the randomly emitted photons and to measure the number n of photons produced by said light source 1 in a time interval T and comprising a photon sensor 2.2, an amplifier 2.3, and an analog-to-digital converter 2.4, and providing a randomness ex- tractor 3, such as to allow detecting the number n of photons produced by said light source 1 in a time interval T and converting said number of photons into a corresponding number of electrons with the help of said photon sensor 2.2 of detector 2, converting the electron signal received from the
• the photon sensor 2.2 of detector 2 is illuminated by the light source 1 with a photon intensity situated within a range of intensities where the Fano factor of the photon sensor 2.2 is close to 1. It is also possible to control the mean number of absorbed photons by adjusting the exposure time of the camera, within the limit that the exposure time needs to be chosen such that the camera works in its linear regime.
• the raw digital values r, generated at the output of detector 2, respectively the digital values y ( at the output of the randomness extractor 3 are encoded over b bits, or are encoded on another basis than the binary system.
• a device for quantum random number generation allows generation of high quality random numbers of quantum origin since being based on a fundamentally random physical process.
• the random numbers may be generated at a high rate.
• the device can be implemented with commercially-available imaging devices such as CMOS and CCD cameras which are small and low cost. Also, it can be easily integrated on a printed circuit board.
• all elements such as light source, light detector, and randomness extractor, as well as other, optional components like for self-testing and further data processing such as encryption and transmission can be integrated at the system, circuit, package or dye level, which improves size, ease of use, security, reliability and energy efficiency of the whole device.
• many mobile and computing devices nowadays include an image sensor of a type adapted to be used, either by minor modification or in some cases directly, as a detector such as required in a device according to the present disclosure to generate quantum random numbers.
• image sensors have low-power consumption compatible with mobile and bat- tery powered applications.
• the randomness extractor can be implemented in hardware or, by software.
• the device can be integrated with other components such as a camera, encryption, transmission, diagnostic device etc.; in particular, given that many consumer electronics articles are anyway equipped with an image sensor adapted to be used for the purposes of the present disclosure, the latter may advantageously be integrated with such components and corresponding software into a computer, a telephone, in particular mobile computers or telephones, tablets, network cryptographic devices, personal cryptographic devices, electronic wallets, or any other type of similar instruments.
• a camera such as a camera, encryption, transmission, diagnostic device etc.
• the latter may advantageously be integrated with such components and corresponding software into a computer, a telephone, in particular mobile computers or telephones, tablets, network cryptographic devices, personal cryptographic devices, electronic wallets, or any other type of similar instruments.
• the exemplary device for random number generation is provided with a single randomness extractor 3.
• a light source 1 illuminates a matrix or array of pixels of the photon sensor 2.2 and the statistical distribution of the number of photons emitted by the light source 1 during a given time interval T is utilized as the source of randomness.
• each pixel can produce an integer that is statistically distributed according to the Poisson distribution, as discussed above.
• the randomness extractor 3 is provided to not only remove defects, but also to make the distribution of the integers uniform and unbiased.
• the actual entropy that is produced by a particular pixel of the array of photon sensor 2.2 can depend on local parameters, including the level of illumination, the sensitivity of the pixel, and the like.
• Figure 6 schematically illustrates a block diagram of device for random number generation according to another aspect of the present disclosure.
• a random number generation device that provides high entropy per bit by adapt- ing one of a plurality of randomness extractors based on the quality and conditions of each pixel.
• a group of pixels will yield sub-optimal entropy, for example, due to insufficient illumination, pixel saturation, or other pixel defects and nonlinearities.
• the amount of genuine quantum entropy generated by each pixel or group of pixels is evaluated and the measured value from such pixels is sent to the appropriate extractor, that will yield sufficiently high-entropy output bits.
• the random number generation device shown includes many of the same components of the exemplary aspect described above with respect to Figure 2. Namely, the device includes a light source 1 and a detector 2, which further includes a lossy channel 2.1, a photon sensor 2.2, an amplifier 2.3 and a ADC 2.4. The details of these components are described above and are the same and, therefore, will not be further described.
• the random number generation device includes a plurality of randomness extractors. As shown, the device includes a pair of randomness extrac- tors 3a and 3b, but it should be appreciated that the exemplary device can include three or more randomness generators in accordance with the spirit of the disclosure described herein.
• the random number generation device optimizes the random bit output after randomness extraction by adapting one or more randomness extractors 3a and 3b to each element of the photon sensor 2.2.
• the size and compression factor of the randomness extractor must be tuned according to the element or pixel with the lowest entropy. As a result, for all other pixels, the randomness extractor will be suboptimal, leading to a degraded random output throughput.
• this limitation is not well suited to dealing with entropy degradation due to aging of the photon sensor 2.2 or the like. Indeed, it is possible that, due to aging effects (e.g., degradation of the light source 1 or the like), the entropy of the pixel elements can fall below the minimum threshold of the randomness extractor, leading to imperfect randomness generation.
• the random number generation device goes through a periodic calibration in which the entropy of each pixel is measured and then the plurality of randomness extractors 3 a and 3b are matched to the pixels.
• the randomness extractors are matched to the pixels (or regions of pixels) such that the measured entropy is higher than the minimum entropy threshold of the selected randomness extractor and that the selected randomness extractor is the most efficient extractor meeting the previous measured condition.
• the randomness extractors can be implemented using vector-matrix multiplication, hash functions or the like and can be implemented using software and/or a combination of software and hardware.
• the matching can be implemented by identifying the entropy level of the pixel (or region of pixels), determining which randomness extractors of the plurality have a minimum entropy threshold that is below the measured entropy level, and then adjusting the software and are hardware such that the digital values corresponding to the electron signals output by the respective pixel are input to the matched/associated randomness extraction during normal operation of the device (i.e., when the device is operating to generate random numbers).
• the plurality of randomness extractors can concentrate the randomness that exists in many weakly-random bits into a few bits each with high level of randomness, for example, a minimum entropy of approximately 1.
• the randomness extractor can be configured on a by bit operation. That is, if it is determined known that a bit-string (e.g., 10 bits long) has a minimum entropy H m , n > 1 , then the randomness extractor can apply an operation that depends on all the bits, such as taking the XOR of the 10 bits, resulting in a single bit output that has an entropy very close to 1.
• the randomness extractors can be based on vector-matrix multiplication.
• an input bit vector with low en- tropy-per-bit of length X is multiplied by a (fixed) random bit matrix of size X, Y, which results in a shorter output bit vector of size Y with high entropy-per-bit.
• matrix size is an appropriate compromise between the efficiency of the extractor, i.e., how much of the entropy is extracted, and the requirement for computational resources.
• a larger matrix will extract randomness more efficiently, but require more gates to be implemented or longer software runtimes or requires larger buffers to acquire bits.
• the randomness extractors can be selected as hash functions that concentrate the entropy from an arbitrary-length input string into a fixed-length output that has higher entropy per bit.
• each of the plurality of randomness extractors 3a and 3b can have a different minimum entropy threshold according to the exemplary aspect.
• each pixel will be associated with a particular extractor of the plurality of randomness extractors 3 a and 3b.
• the pixels may be grouped by extractor.
• the random number generation device will operate for a period of time before a calibration of the device is performed.
• the calibration includes measuring the entropy of each pixel (or a portion thereof) of the photon sensor 2.2 and then determining the optimal randomness extractor of the plurality of randomness extractors 3a and 3b to be used for each pixel (or grouping of pixels).
• the process for selecting the optimal ran- domness extractor for a pixel or grouping of pixels will be described in more detail below with respect to Figure 10.
• Figure 7 A illustrates an example of a photon sensor according to the exemplary aspect to illustrate a method for calibrating the random number generation device described herein.
• the photon sensor which should be understood to be photon sensor 2.2, for example, is composed of X number of pixels. Furthermore, each pixel can be classified from X (1; i ) to X ( , N ) based on the particular pixel's column number and row number. As described above, based on a typical light source used (e.g., an LED light source), the number of photons emitted per unit of time is governed by a Poisson distribution. As a result, the number of detectable photons shows a statistical variation depending on the pixel location which is described as a Poisson distribution.
• a typical light source used e.g., an LED light source
• illumination may not be uniform, for example because of the geometric arrangement of the device, which can lead to additional statistical variations depending on pixel location.
• the detected signal can also depend on pixel intrinsic characteristic and defaults (as it may be a dead or hot pixel). Therefore, the level of detected signal will very across the pixel array, which implies that the level of ex- tractable entropy will also vary across the pixel array.
• a first region “A” (which corresponds to pixel location ⁇ 3 ⁇ 4 ) ) is a light sensor region having high intensity illumination and high photon density detection.
• a second region “B” is a light sensor region with a medium intensity illumination and medium photon density detection.
• a third region “C” is a light sensor region with low intensity illumination and low photon density detection.
• a dead pixel is illustrated in X(i ,t ).
• Figure 7B further illustrates a distribution of probability P(n) that a number n of photons is measured during a timeslot by the pixels in the corresponding regions "A", "B", and "C".
• the probability P(n) can be based on the combination of quantum uncertainty ⁇ ? originating from the quantum nature of a light source and technical noise originating from the technical equipment used.
• the mean of the distribution and the probability P(n) that the number n of photons will be measured is highest at the pixel location X(ij), and is slightly lower at the adjacent pixels (e.g., X(i j -i) or X(ij+i)) to the focal pixel, and lowest at pixels spaced farther from the focal pixel (e.g., X(ij>), for example at pixel X(ij+ 2
• the measured values output at each pixel are encoded over b bits according to an exemplary aspect, although it is of course possible to encode values on another basis than the binary system.
• the amount of quantum entropy corresponds to the entropy of a Poisson distribution with a mean equal to the average number n of photons absorbed, where n is the number of absorbed protons.
• the minimum entropy variation is calculated according to the following formula:
• Figure 8 illustrates a graph depicting a representation illustrating a minimum entropy variation that is plotted as a function of the absorbed photons n.
• the graph illustrated in Figure 8 provides several regions that can be defined depending on the illumination in the regions, as defined by a number of photons detected in the region.
• Figure 8 illustrates regions "A" and "B” that correspond to the regions of the pixel array described above with respect to Figure 7A.
• region “B” is the area defined as 1 - ⁇ log( «) - ⁇ 10
• region "A" is the area where 10 - ⁇ log( w) 1000 .
• n is equal to the mean of the number of photons absorbed over a given time interval T.
• Area "A” is the most illuminated pixel or region, whereas Area “B” is less illuminated.
• the minimum entropy levels or thresholds H A and Hg are defined accordingly.
• UMAX corresponds to the highest level of entropy the pixel can obtain before saturation, which leads to a "null” extractor, as will be discussed in detail below.
• Area "C” could have insufficient or be saturated, and, therefore, need to be associated with the null extractor.
• the entropy s of quantum origin per bit of output is defined on average as H min lb, where b is the number of bits over which the measured values output at each pixel are encoded.
• the entropy 3 ⁇ 4 for raw input bits per bit for region "A" is H b and likewise the entropy 3 ⁇ 4 for region "B” is J3 ⁇ 4/b.
• the randomness extractor is required to obtain a string of perfectly random bits (i.e., with a unit quantum entropy per bit).
• the randomness extractor is configured to calculate a number k of high entropy output bits y j from a number / - k of lower entropy bits r t -. This operation may be done by performing a vector-matrix multiplication between the vector formed by the raw bit values r ⁇ and a random / x k matrix M, according to formula (3).
• a minimum entropy H A and 3 ⁇ 4 can be calculated and a dedicated randomness extractor can be associated based on the respective minimum entropy values as described above.
• matrix MA is a lxk A matrix
• matrix M B is lxk B matrix with k A k B .
• the random number generation device is configured to be periodically calibrated.
• the normal operation i.e., generation of random numbers, as described above
• the device can associate each such element with a particular randomness extractor of the plurality of randomness extractors 3a and/or 3b. According to one exemplary aspect, this association is performed by determining that the measured entropy is higher than the minimum entropy threshold of the selected extractor.
• the device can ensure that the selected randomness extractor is the most efficient of all the extractors that satisfies this condition. Accordingly, once this association is made, random number generation device can return to normal operation (i.e., generation of random numbers) where the associated randomness extractor for a given pixel or region of pixels will receive the respective digital values from the specific pixel or region of pixels to produce quantum random numbers based on the number n of photons produced by the light source in a time interval T, as described above.
• normal operation i.e., generation of random numbers
• the calibration process can be repeated periodically.
• the random number generation device is configured to adjust the number generation process to avoid or minimize aging effects of the photon sensor 2.2 that lead to entropy degradation.
• Figure 9 illustrates a flowchart for a method of calibration of the random number generation device at pixel level according to an aspect of the present disclosure.
• Figure 9 illustrates a method for selecting a particular randomness extractor according to the response of a specific pixel subjected to illumination.
• the calibration starts and N reading cycles of each pixel are performed through pixel illumination as described above (shown as step 905 in Figure 9).
• the illumination can be continuous, i.e. the light source is on during the whole N reading cycles, or pulsed, i.e. the light source is turned on and off at each cycle of the N cycles.
• the output of the N reading cycles are used to plot histograms of photons detected (Step 910).
• the amount of photons absorbed n and associated entropy minimum entropy H min is estimated for each pixel.
• One possible approach to estimate the minimum entropy is to calculate the mean photon number associated with the statistical distribution represented by the histogram.
• the device can for example calculate and store for each pixel X ( j j) an estimate of the average the absorbed photons per reading cycle n X( j j) and a pixel-specific minimum entropy
• the exemplary aspect of the device includes a plurality of randomness extractors 3 a and 3b.
• a third randomness extractor 3o is provided.
• the randomness extractor which includes a set of extractors (3a, 3b, and 3o) can be chosen depending on the number of photons detected by a pixel over a reading cycle.
• extractor 3a is designed to transform M bits in N bits (with 2 x N ⁇ M), where extractor 3 a is dedicated to areas with higher illumination.
• extractor 3b has the capacity to transform M bits in N bits (with 10 x N ⁇ M), where extractor 3b is dedicated to low light illumination areas.
• extractor 3o transforms M bits in 0 bits, which is dedicated to areas with saturation or very low light illumination (e.g., the null extractor described above).
• an extractor from a family of predefined set of extractors (the set of extractor 3a, 3b and 3o) is associated to each illumination area (e.g., respectively, A, B and C of Figure 7a) and by consequence to a pixel or a sub-matrix of pixels (a sub matrix does not need to be formed of adjacent pixels).
• Said step 920 relies on two sub-steps 925 and 930 where the software of the disclosed device is executed to determine which randomness extractor should be used for which pixel.
• the device will associate extractor 3o with the pixel X (step 930a).
• n A , 3 ⁇ 4, and njyiA can be predetermined thresholds for associating the ran- domness extractors.
• the device assumes that the pixel is absorbing at a very low light and thus assigns the null extractor, as described above.
• the device recognizes that pixel has reached saturation and again assigns the null extractor, as described above.
• the result of the process described in Fig. 9 is an "entropy to extractor map". This map associates each pixel to a particular extractor of the family of extractors (as an example 3a, 3b, 3o).
• This calibration process described in Fig. 9 may be done as a boot step before quantum random number generation operation, when the disclosed device is turned on.
• the activation of this cali- bration process can be triggered by events such as time interval since last calibration, change in environmental conditions or even external user request.
• Figure 10 illustrates the method for calibration of the random number generation device based on live update, which means that calibration is done while random bits acquisition is done in parallel.
• the operation cycles starts in order to generate random numbers. This is done while light source 1 illuminates the photon sensor 2.2 including a matrix of pixels and absorbed photons are measured to characterize the output of the light sensor matrix in a second step 1010.
• the illumination can be continuous or pulsed.
• This illumination-reading step 1010 enables simul- taneously to acquire random bits and update the "entropy to extractor map" based on said acquired bits.
• step 1020 the values read at Step 1010 on each pixel of the light sensor matrix are stored in a buffer.
• the buffer used for each pixel is determined according to the "entropy to extractor map".
• a buffer can be associated to a single pixel. In this case, the values read from this specific pixel are appended at each step 1020 to the buffer.
• a buffer can also be associated to a sub-matrix consisting of more than one pixel. Note that the sub-matrix does not need to consist of adjacent pixels.
• the values read from all the pixels of the sub-matrix are appended at each 1020 to the buffer.
• the buffers of Step 1020 are emptied from time-to-time (not shown on Figure 10). This is achieved by sending at least some of the values stored in the buffer to the randomness extractor associated with this buffer and erasing these values from this buffer.
• a minimum entropy H min is calculated at each reading cycle. This calculation takes into account the minimum entropy value calculated at the previous step, as well as the current illumination-reading cycle.
• One possibility to calculate this minimum entropy is to update a moving average of the mean number of photons absorbed in a cycle and to use this value to calculate the minimum entropy.
• the moving average can be updated after each reading while the random number generation device is operating to ensure that a defective element will not impact random numbers output.
• the entropy to extractor map is updated, which implies that one of the randomness extractor of the plurality of randomness extractors 3a and 3b is defined for each pixel (or region of pixels) based on the minimum entropy Hmin calculated at Step 1030.
• the calibration process is done in parallel to random number generation device normal operation and the calibration process ends when the operation cycle ends (Step 1050).
• a null or "dummy" randomness extractor can be implemented for the random number generation device.
• pixels can be faulty or degrade over time where they do not exhibit an entropy level that is sufficient for practical purposes of gen- erating a random number according to the device and method described above.
• These elements can be referred to as "hot" elements or pixels of the photon sensor.
• the null randomness extractor can be applied or associated with these pixels or regions of pixels.
• the digital values generated by any "hot" elements will be output to the null randomness extractor, which, in turn, does not output any random bits for the random number generation.
• randomness extractor 3a can be an operational extractor and randomness extractor 3 b can be a null extractor.
• a "sufficient" minimum entropy level can readily be viewed as a predetermined threshold stored in memory of the random number generating device and the entropy levels for each pixel can be compared against this predetermined threshold to determine whether the pixel exhibits a sufficient entropy level to be used to generated output bits for a random number.
• a device for quantum random number generation allows generation of high quality random numbers of quantum origin since being based on a fundamentally random physical process.
• the device maximizes the bit rate produced by selecting the optimal randomness extractors for each element.
• the device is configured to overcome aging effects by periodically performing and repeating the calibration step and using multiple randomness extractors with each element.
• the device overcomes the develop- ment of "hot" elements that exhibit an entropy level that is too low and insufficient for random number generation.
• the calibration method enables the device to maintain optimal randomness and avoid pixels that might be dead (“white pixels") due to several effects, including aging, thermal, mechanical, illumination power, electrostatic fields and the like.
• the calibration method enables opti- mal random number generation even if certain single elements of the photon sensor 2.2 may be defective.
• the present disclosure is also related to computer program means stored in a computer readable medium adapted to implement the above described method.
• the systems and methods described herein may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the methods may be stored as one or more instructions or code on a non- transitory computer-readable medium.
• Computer-readable medium includes data storage.
• such computer-readable medium can comprise RAM, ROM, EEPROM, CD-ROM, Flash memory or other types of electric, magnetic, or optical storage medium, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a processor of a general purpose computer.
• module refers to a real- world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or field-programmable gate array (FPGA), for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the module's functionality, which (while being executed) transform the microprocessor system into a special-purpose device.
• a module can also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software.
• a module can be executed on the processor of a general purpose computer (such as the one described in greater detail in Fig. 3 above). Accordingly, each module can be realized in a variety of suitable configurations, and should not be limited to any example implementation exemplified herein.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Signal Processing (AREA)
• Computer Networks & Wireless Communication (AREA)
• Computer Security & Cryptography (AREA)
• Mathematical Analysis (AREA)
• General Engineering & Computer Science (AREA)
• Electromagnetism (AREA)
• Pure & Applied Mathematics (AREA)
• Mathematical Optimization (AREA)
• Computational Mathematics (AREA)
• Light Receiving Elements (AREA)
• Investigating, Analyzing Materials By Fluorescence Or Luminescence (AREA)

Priority Applications (3)

Applications Claiming Priority (2)

Publications (1)

Family

ID=57321265

Family Applications (1)

Country Status (3)

Cited By (4)

Families Citing this family (11)

Family Cites Families (6)

• 2016
  • 2016-10-31 EP EP16795249.8A patent/EP3375130A1/en active Pending
  • 2016-10-31 WO PCT/EP2016/076200 patent/WO2017080860A1/en active Application Filing
  • 2016-11-10 CN CN201610990894.2A patent/CN107066236B/zh active Active

Non-Patent Citations (3)

Also Published As

Similar Documents

Legal Events