Oscillator, random number generator, and method of operating an oscillator

Abstract

Embodiments of the present invention provide an oscillator, a random number generator, and a method for operating the oscillator. The oscillator circuit includes a plurality of inverters connected in a series, at least a first feedback tap and a second feedback tap, and an alternating circuit. The at least first feedback tap and the second feedback tap are configured to respectively feedback a first output signal and a second output signal, the first output signal and the second output signal being derived from a first point and a second point in the series, respectively. The alternating circuit is configured to derive an input signal from the at least first output signal and the second output signal by alternating between the at least first feedback tap and the second feedback tap, and apply the input signal to the input of the series.

Description

Technical Field

[0001] The present invention generally relates to data security, and more particularly to an attack-resistant ring oscillator (RO) and random-number generator (RNG). Background Art

[0002] Various random number generation techniques are known in the art. For example, U.S. Patent 4,905,176 describes a random number generator that is resistant to cryptographic attacks. The random number generator operates based on low-frequency sampling of the output of a pseudo-random number generator (PRS), which operates at a varying frequency derived from a free-running ring oscillator. Summary of the Invention

[0003] Embodiments of the present invention described herein provide an oscillator circuit comprising a plurality of inverters connected in series, at least a first feedback tap and a second feedback tap, and an alternating circuit. The at least first feedback tap and the second feedback tap are configured to respectively feedback a first output signal and a second output signal, the first output signal and the second output signal being derived from a first point and a second point in the series, respectively. The alternating circuit is configured to derive an input signal from the at least first output signal and the second output signal by alternating between the at least first feedback tap and the second feedback tap, and apply the input signal to an input of the series.

[0004] In some embodiments, the first point is a midpoint in the string and the second point is an endpoint of the string. In the disclosed embodiment, the alternating circuit is configured to alternate between at least the first feedback tap and the second feedback tap in a psudo-random switching pattern.

[0005] In some embodiments, the alternating circuit includes (i) a multiplexer configured to multiplex at least a first feedback tap and a second feedback tap to an input of the serial, and (ii) a sequence generator configured to generate a bit sequence and control the multiplexer using the bit sequence. In an exemplary embodiment, the sequence generator includes a linear feedback shift register (LFSR).

[0006] In one embodiment, a first number of inverters are connected from the input of the string through the first feedback tap to the input of the string, and a second number of inverters are connected from the input of the string through the second feedback tap to the input of the string, and both the first number and the second number are odd numbers. In another embodiment, the first number of inverters are connected from the input of the string through the first feedback tap to the input of the string, and the second number of inverters are connected from the input of the string through the second feedback tap to the input of the string, and both the first number and the second number are mutually-prime numbers.

[0007] According to an embodiment of the present invention, a random number generator (RNG) circuit is further provided, comprising a first oscillator, a second oscillator, and a sampling circuit. The first oscillator is configured to generate a first signal within a first frequency range. The second oscillator is configured to generate a second signal within a second frequency range, the second frequency range being lower than the first frequency range. The sampling circuit is configured to sample the first signal using the second signal to output pseudo-random number data. At least one of the first oscillator and the second oscillator comprises a plurality of inverters connected in a series, at least a first feedback tap and a second feedback tap, and an alternating circuit. The at least first feedback tap and the second feedback tap are configured to respectively feedback a first output signal and a second output signal, the first output signal and the second output signal being derived from a first point and a second point in the series, respectively. The alternating circuit is configured to derive an input signal from the at least first output signal and the second output signal by alternating between the at least first feedback tap and the second feedback tap, and apply the input signal to the input of the series.

[0008] According to an embodiment of the present invention, a method is further provided, comprising operating a circuit comprising (i) a plurality of inverters connected in series, and (ii) at least a first feedback tap and a second feedback tap configured to respectively feedback a first output signal and a second output signal, the first output signal and the second output signal being derived from a first point and a second point in the series, respectively. An input signal is derived from the at least first output signal and the second output signal by alternating between the at least first feedback tap and the second feedback tap. The input signal is applied to an input of the series. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0010] Figure 1 FIG. 4 is a block diagram schematically illustrating an attack-resistant ring oscillator (RO) according to an embodiment of the present invention.

[0011] Figure 2 The operation is schematically illustrated according to an embodiment of the present invention. Figure 1 Flowchart of the RO method.

[0012] Figure 3 According to an embodiment of the present invention, Figure 1 Graph of the output signal generated by the RO as a function of time.

[0013] Figure 4 FIG. 1 is a block diagram schematically illustrating an attack-resistant random number generator (RNG) according to an embodiment of the present invention.

[0014]

Figure Number

[0015] 100:Semiconductor junction

[0016] 20: Ring Oscillator (RO)

[0017] 24A, 24B: Section

[0018] 26A, 26B: Feedback tap

[0019] 28: Multiplexer (MUX)

[0020] 32A, 32B: NAND gate

[0021] 36: Linear Feedback Shift Register (LFSR)

[0022] 40,44: NAND gate

[0023] P1, P2, P3: points

[0024] 50, 54, 58: Steps 60A, 60B, 60C, 64A, 64B: Time period

[0025] 70: Random Number Generator (RNG)

[0026] 74: High frequency RO

[0027] 78: Low frequency RO

[0028] 82: Sampling circuit DETAILED DESCRIPTION

[0029] Overview

[0030] Embodiments of the present invention described herein provide improved ring oscillators (ROs) and random number generators (RNGs), as well as related methods. The disclosed ROs and RNGs are resilient to various security threats, such as fault injection and other side-channel attacks. Therefore, the disclosed techniques are useful, for example, in various cryptographic applications involving random number generation.

[0031] In some embodiments, the RO includes a plurality of inverters connected in series, two feedback taps connected to feed back output signals taken from two different points in the series (e.g., one taken from an end point of the series and the other taken from a midpoint), and a multiplexer (MUX) configured to select between the two feedback taps and connect the selected feedback tap to the input of the series.

[0032] When one feedback tap is selected by the MUX, the RO circuit experiences a certain loop delay. When the other feedback tap is selected, the RO circuit experiences a different loop delay. Switching the MUX alternates the ring oscillator's loop delay, and thus its oscillation frequency, between two values ​​associated with the two feedback taps.

[0033] In some embodiments, the RO includes a sequence generator that generates a bit sequence, which serves as a select signal for switching the MUX. For example, the sequence generator may include a linear feedback shift register (LFSR) that generates a pseudo-random bit sequence. The RO output can be obtained from a suitable point in the sequence.

[0034] When operating as described above, the RO alternates between two loop delays, and therefore two oscillator frequencies, in a rapid and unpredictable manner. This alternation makes the RO highly resilient to attack.

[0035] The embodiments disclosed below are primarily discussed as examples for a configuration with two feedback taps. However, a RO may typically include a larger number of multiplexed feedback taps to alternate between more than two loop delays and corresponding oscillation frequencies.

[0036] In certain embodiments of the present invention, the disclosed alternating frequency RO design is used as a component of a random number generator (RNG). In an exemplary embodiment, the RNG includes a high-frequency oscillator configured to generate a high-frequency signal and a low-frequency oscillator configured to generate a low-frequency signal. The two oscillators operate asynchronously relative to each other. The RNG further includes a sampling circuit configured to sample the high-frequency signal using the low-frequency signal. The output of the sampling circuit, i.e., the high-frequency signal sampled by the low-frequency signal, is used as the output of the RNG.

[0037] In certain embodiments, one or both oscillators in an RNG are implemented using the disclosed design with alternating oscillation frequencies. Such RNGs are highly resilient to attacks. For example, conventional attacks on RO-based RNGs employ side-channel signals (e.g., electromagnetic signals) synchronized with the RO oscillation frequency. The disclosed techniques render such attacks impractical.

[0038] Design of an attack-resistant ring oscillator

[0039] Figure 1 This is a block diagram schematically illustrating a resistant ring oscillator (RO) 20 according to an embodiment of the present invention. RO 20 can be used in various systems and applications. In particular, the use of this RO in the design of a resistant random number generator (RNG) is further described below. According to embodiments of the present invention, the RO and RNG can be used in any applicable system or application that utilizes random number generation, such as a secure integrated circuit performing cryptographic operations.

[0040] RO 20 comprises a plurality of logic inverters connected in a cascade. In this example, the cascade is formed by two segments, denoted by 24A and 24B, each of which includes a set of inverters. The input of the cascade is denoted by P1, the midpoint between the endpoints of segment 24A is denoted by P2, and the endpoint of the cascade is denoted by P3. In this example, P3 also serves as the RO output. Alternatively, the RO output can be obtained from any other suitable point in the cascade.

[0041] RO 20 further includes two feedback taps, designated 26A and 26B, connected to different points in the inverter series. In this example, feedback tap 26A feeds back the output signal from the midpoint (P2), while feedback tap 26B feeds back the output signal from the end point (P3) of the series.

[0042] In addition to the series of inverters and feedback taps, RO 20 includes an alternation circuit configured to derive an input signal from the output signals fed back by feedback taps 26A and 26B by alternating between the two feedback taps. The derived input signal is provided to the input of the series, i.e., point P1.

[0043] exist Figure 1 In this embodiment, the interleaving circuit includes a multiplexer (MUX) 28 and a linear feedback shift register (LFSR) 36. Feedback taps 26A and 26B are connected to corresponding inputs of MUX 28. The output of MUX 28 is connected to the input (P1) of the serial bus. The output of LFSR 36 serves as a select signal to control MUX 28.

[0044] In this example, two NAND gates 32A and 32B are also placed in the feedback path to selectively enable or disable the operation of RO 20. In each of NAND gates 32A and 32B, one input is connected to the corresponding feedback tap, while the other input is connected to the enable signal. The outputs of NAND gates 32A and 32B are connected to the corresponding inputs of MUX 28. In an alternative embodiment, NAND gates 32A and 32B may be omitted, in which case feedback taps 26A and 26B are connected directly to the inputs of MUX 28.

[0045] The LFSR 36 can be initialized by any suitable initial value (seed). The LFSR is clocked by a clock signal generated by a series of inverters. Figure 1 As shown in the example of FIG. 3 , LFSR 36 receives the output signal from P3 as an input signal and uses this signal as a clock.

[0046] In some embodiments, LFSR 36 pseudo-randomly generates a new bit value during each clock cycle. This bit value is used to select between the two inputs of MUX 28. For example, without loss of generality, during clock cycles in which LFSR 36 generates a value of "0," MUX 28 connects input A (and feedback tap 26A) to the input of the serial; whereas during clock cycles in which LFSR 36 generates a value of "1," MUX 28 connects input B (and feedback tap 26B) to the input of the serial. Alternatively, the opposite rule may be used.

[0047] During the clock cycle selected by the feedback tap 26A, the RO 20 oscillates at a frequency determined by the total loop delay (e.g., from P1 back to P1) through the feedback tap 26A. As shown in the figure, this loop delay is the sum of the delays of the following components:

[0048] Section 24A

[0049] NAND gate 32A

[0050] ●MUX 28

[0051] During the clock cycles selected by the feedback tap 26B, the RO 20 oscillates at a frequency determined by the total loop delay (e.g., from P1 back to P1) through the feedback tap 26B. The loop delay during these clock cycles is the sum of the delays of:

[0052] Section 24A

[0053] Section 24B

[0054] NAND gate 32B

[0055] ●MUX 28

[0056] exist Figure 1 In the exemplary embodiment, segments 24A and 24B of the series of inverters, as well as MUX 28, are implemented using NAND gates. This implementation is depicted in the two insets at the bottom of the figure. As can be seen, MUX 28 is implemented using four NAND gates 40, while each inverter in the series (in segments 24A and 24B) is implemented using its own NAND gate 44, with the inputs of each NAND gate 44 connected together.

[0057] In this implementation, the total loop delay when feedback tap 26A is selected is given by D1 = (N1 + 3)·D, while the total loop delay when feedback tap 26B is selected is given by D2 = (N1 + N2 + 3)·D, where D represents the unit delay of a single NAND gate, N1 represents the number of inverters in segment 24A, and N2 represents the number of inverters in segment 24B. The "3·D" in both loop delays accounts for the delay of MUX 28 (equal to 2·D) and the delay of NAND gate 32A or NAND gate 32B (equal to 1·D).

[0058] Typically, the total number of inverters spanned when feedback tap 26A is selected (D1 / D) and the total number of inverters spanned when feedback tap 26B is selected (D2 / D) are both odd numbers. In some embodiments, although not necessarily, N1 and N2 are selected so that the total number of inverters D1 / D and D2 / D are mutually prime numbers. In one example, N1 = 20 and N2 = 6, resulting in D1 = 23 and D2 = 29.

[0059] In a non-limiting example, D=50 pSec (picoseconds), 23·D=1.15 nS (nanoseconds) (corresponding to an oscillation frequency of approximately 896 MHz (million Hertz)), and 29·D=1.45 nS (corresponding to an oscillation frequency of approximately 689 MHz). However, in alternative embodiments, any other suitable values ​​may be used.

[0060] Figure 1 The configuration of RO 20 shown in FIG is an example configuration for conceptual clarity only. In alternative embodiments, any other suitable configuration may be used. For example, MUX 28 may be controlled not by LFSR 36 but by any other suitable sequence generator. The bit sequence controlling MUX 28 does not need to be pseudo-random.

[0061] Furthermore, in an alternative embodiment, RO 20 may include M feedback taps, where M is greater than 2. In such an embodiment, MUX 28 includes M inputs. A sequence generator (e.g., an LFSR) may be used to generate multi-bit values ​​to alternate between the M inputs, thereby causing the RNG to alternate between M different oscillation frequencies.

[0062] Figure 2 FIG2 is a flow chart schematically illustrating a method for operating RO 20 according to an embodiment of the present invention. The method begins at operation 50 by operating the series of inverters and feedback taps 26A and 26B. At an alternation step 54, an alternation circuit (e.g., LFSR 36 and MUX 28) alternates between the two output signals provided by feedback taps 26A and 26B. At an input drive step 58, the output of MUX 28 is applied to the input of the series of inverters.

[0063] Figure 3 According to an embodiment of the present invention, Figure 1 An example of an output signal generated by an RO 20 as a function of time is shown. The graph shows the alternation between two oscillation frequencies. As can be seen in the figure, the RO output signal alternates between two time periods having two different oscillation frequencies:

[0064] Periods 60A, 60B, 60C, ..., during which MUX 28 connects input A (and feedback tap 26A) to the input of the string, and thus RO 20 oscillates at an oscillation frequency determined by the loop delay of feedback tap 26A.

[0065] • Periods 64A, 64B, ..., during which MUX 28 connects input B (and feedback tap 26B) to the input of the string, and thus RO 20 oscillates at an oscillation frequency determined by the loop delay through feedback tap 26B.

[0066] The lengths of the time periods 60A, 64A, 60B, 64B, . . . are determined by the run lengths of “0 seconds” and “1 second” in the output of the LFSR 36 and are therefore pseudo-random numbers.

[0067] Design of attack-resistant random number generator

[0068] As mentioned above, in some embodiments, the alternating frequency of RO 20 is designed to serve as a component of a random number generator (RNG).

[0069] Figure 4 FIG2 is a block diagram schematically illustrating an attack-resistant RNG 70 according to an embodiment of the present invention. RNG 70 includes a high-frequency RO 74 configured to generate a high-frequency signal and a low-frequency RO 78 configured to generate a low-frequency signal. RO 74 and RO 78 operate asynchronously relative to each other. In some embodiments, one or both of the ROs are intentionally designed to generate noise, for example, by using an analog noise source to amplify temperature noise or noise from any other noise source.

[0070] The high-frequency signal and the low-frequency signal may have any suitable frequencies, as long as the low-frequency signal has a frequency significantly lower than the high-frequency signal. In some embodiments, although not necessarily, the high-frequency signal has a frequency of approximately megahertz and the low-frequency signal has a frequency of approximately kilohertz.

[0071] RNG 70 further includes sampling circuit 82, which is configured to sample the high-frequency signal using the low-frequency signal. The output of sampling circuit 82 is provided as the RNG's "random data out" output. In an exemplary embodiment, sampling circuit 82 samples the high-frequency signal on the rising edge of the low-frequency signal. Alternatively, sampling on the falling edge, or on both the rising and falling edges, may be used.

[0072] Further aspects of RNGs based on high-frequency and low-frequency oscillators are discussed in U.S. Patent No. 4,905,176 cited above, and U.S. patent application Ser. No. 16 / 995,951, filed on August 18, 2020, and entitled “Distributed Random-Number Generator,” the disclosures of which are incorporated herein by reference.

[0073] In some embodiments, the high frequency RO 74, the low frequency RO 78, or both, may use the above Figure 1 In this way, either or both of RO 74 and RO 78 can have alternating oscillation frequencies, making RNG 70 resistant to attacks. The frequencies of the two oscillators are selected so that at any time, and regardless of the alternating frequency, the frequency of the low-frequency signal is lower than the frequency of the high-frequency signal.

[0074] Figure 4 The configuration of RNG 70 shown in FIG is an example configuration for conceptual clarity only. In alternative embodiments, any other suitable configuration may be used. For example, when only one of oscillator 74 and oscillator 78 is implemented using the configuration of RO 20, the other oscillator does not need to be a ring oscillator.

[0075] In various embodiments, the disclosed RO and RNG circuits may be implemented using any suitable hardware or firmware, such as one or more discrete components, one or more application-specific integrated circuits (ASICs), and / or one or more field-programmable gate arrays (FPGAs).

[0076] It should be understood that the above embodiments are listed by way of example only, and the present invention is not limited to what is specifically shown or described above. On the contrary, the scope of the present invention includes the various combinations and subcombinations of the features described above, as well as variations or modifications thereof that occur to a person skilled in the art upon reading the above description and that are not disclosed in the prior art. The documents incorporated by reference in this application should be considered an integral part of this application, unless any term defined in such incorporated documents conflicts with the definition expressly or impliedly in this specification, in which case only the definition in this specification shall prevail.

Claims

1. An oscillator circuit, characterized in that: include: A plurality of inverters are connected in series in a string; at least one first feedback tap and a second feedback tap, configured to feed back a first output signal and a second output signal, respectively, wherein the first output signal and the second output signal are obtained from a first point and a second point in the series, respectively; and an alternating circuit configured to derive an input signal from at least the first output signal and the second output signal by alternating between at least the first feedback tap and the second feedback tap, and apply the input signal to an input of the series, the alternating circuit comprising: a multiplexer configured to multiplex at least the first feedback tap and the second feedback tap to the input of the string; and a sequence generator configured to generate a bit sequence and control the multiplexer using the bit sequence; wherein the sequence generator receives the second output signal; in: The series is formed by a first section and a second section, the first section includes a first number of inverters, and the second section includes a second number of inverters; The first section receives the input signal and outputs the first output signal; The second section receives the first output signal and outputs the second output signal; and The second output signal is an output of an oscillator.

2. The oscillator circuit according to claim 1, wherein: The first point is a midpoint in the series, and the second point is an end point in the series.

3. The oscillator circuit according to claim 1, wherein: The alternating circuit is configured to alternate between at least the first feedback tap and the second feedback tap in a pseudo-random number switching pattern.

4. The oscillator circuit according to claim 1, wherein: The sequence generator includes a linear feedback shift register.

5. The oscillator circuit according to claim 1, wherein: The first number of inverters are connected from the input of the series to the input of the series via the first feedback tap, and the second number of inverters are connected from the input of the series to the input of the series via the second feedback tap. Both the first number and the second number are odd numbers.

6. The oscillator circuit according to claim 1, wherein: The first number of inverters are connected from the input of the series to the input of the series via the first feedback tap, and the second number of inverters are connected from the input of the series to the input of the series via the second feedback tap, wherein the first number and the second number are coprime numbers.

7. A random number generator circuit, characterized in that: include: a first oscillator configured to generate a first signal within a first frequency range; a second oscillator configured to generate a second signal within a second frequency range, the second frequency range being lower than the first frequency range; and a sampling circuit configured to sample the first signal by using the second signal to output pseudo random number data; At least one of the first oscillator and the second oscillator comprises: A plurality of inverters are connected in a series; at least one first feedback tap and a second feedback tap, configured to feed back a first output signal and a second output signal, respectively, wherein the first output signal and the second output signal are obtained from a first point and a second point in the series, respectively; and an alternating circuit configured to derive an input signal from at least the first output signal and the second output signal by alternating between at least the first feedback tap and the second feedback tap, and apply the input signal to an input of the series, the alternating circuit comprising: a multiplexer configured to multiplex at least the first feedback tap and the second feedback tap to the input of the string; and a sequence generator configured to generate a bit sequence and control the multiplexer using the bit sequence; wherein the sequence generator receives the second output signal; in: The series is formed by a first section and a second section, the first section includes a first number of inverters, and the second section includes a second number of inverters; The first section receives the input signal and outputs the first output signal; The second section receives the first output signal and outputs the second output signal; and The second output signal is an output of an oscillator.

8. The random number generator circuit according to claim 7, wherein: The alternating circuit is configured to alternate between at least the first feedback tap and the second feedback tap in a pseudo-random number switching pattern.

9. The random number generator circuit according to claim 7, wherein: The sequence generator includes a linear feedback shift register.

10. A method of operating an oscillator, characterized in that: include: operating a circuit comprising a plurality of inverters and at least a first feedback tap and a second feedback tap, the plurality of inverters being connected in a series, and at least the first feedback tap and the second feedback tap being configured to feed back a first output signal and a second output signal, respectively, the first output signal and the second output signal being obtained from a first point and a second point in the series, respectively; deriving an input signal from at least the first output signal and the second output signal by alternating between at least the first feedback tap and the second feedback tap, comprising configuring a sequence generator to generate a bit sequence, and controlling a multiplexer with the bit sequence, the multiplexer multiplexing at least the first feedback tap and the second feedback tap to an input of the string, wherein the sequence generator receives the second output signal; as well as applying the input signal to an input of the series; in: The series is formed by a first section and a second section, the first section includes a first number of inverters, and the second section includes a second number of inverters; The first section receives the input signal and outputs the first output signal; The second section receives the first output signal and outputs the second output signal; and The second output signal is an output of an oscillator.

11. The method of operating an oscillator according to claim 10, wherein: The first point is a midpoint in the series, and the second point is an end point in the series.

12. The method of operating an oscillator according to claim 10, wherein: Obtaining the input signal includes alternating between at least the first feedback tap and the second feedback tap in a pseudo-random switching pattern.

13. The method of operating an oscillator according to claim 10, wherein: Generating the bit sequence includes generating the bit sequence through a linear feedback shift register.

14. The method for operating an oscillator according to claim 10, wherein: The first number of inverters are connected from the input of the series to the input of the series via the first feedback tap, and the second number of inverters are connected from the input of the series to the input of the series via the second feedback tap. Both the first number and the second number are odd numbers.

15. The method of operating an oscillator according to claim 10, wherein: The first number of inverters are connected from the input of the series to the input of the series via the first feedback tap, and the second number of inverters are connected from the input of the series to the input of the series via the second feedback tap, wherein the first number and the second number are coprime numbers.

Images