Multiple choke ring oscillator sampled true random number generator

Abstract

The application discloses a kind of multi-toroid ring oscillator sampled true random number generators, the circuit structure includes an output D trigger, multiple entropy source modules and multiple XOR gates, the main signal input end of output D trigger is connected the output end of an XOR gate, and the two input ends of XOR gate connected with output D trigger are respectively connected the output end of two next stage XOR gates;The output end of output D trigger is used to output random sequence;The output end of two entropy source modules is simultaneously connected with the input end of an XOR gate, and the output end of two XOR gates connected with entropy source module is respectively connected the two input ends of previous stage XOR gate;The number of entropy source module is 2 power n. In the above-mentioned circuit structure, by multi-stage choke inverter head-to-tail connection and with entropy source D trigger and buffer circuit combination form entropy source module, can output sequence with high randomness and lower running energy consumption, with high energy efficiency ratio Application effect.

Description

Technical Field

[0001] This invention relates to the technical field of integrated circuit hardware security, and in particular to a true random number generator sampled by a multi-choke ring oscillator. Background Technology

[0002] The purpose of True Random Number Generator (TRNG) circuit design is to generate truly random number sequences. These random number sequences are crucial for ensuring cryptographic security and the security of computer systems. Since random number sequences are the foundation of these applications, if the sequences are predictable or pseudo-random, they can be exploited by attackers to crack encryption algorithms or steal keys. This could allow attackers to crack ciphers by inferring patterns. If an attacker obtains the key, they can use it to decrypt encrypted data, thereby gaining access to sensitive information. Attackers can also use random numbers to forge digital signatures and authentication credentials, impersonating others and committing fraud. Cracked random numbers can also be used to attack protocols, causing system malfunctions. In short, if a random number generator is compromised, it will lead to system security problems and potentially serious consequences such as data breaches, identity theft, and cyberattacks. Therefore, when designing systems, it is essential to use sufficiently powerful and reliable random number generation methods to ensure system security. A True Random Number Generator is a type of random number generator that utilizes physical processes or quantum phenomena to generate random numbers. Their principle is based on true physical randomness, such as thermal noise, radioactive decay, photons, chaotic circuits, etc., all of which are unpredictable. Therefore, the random numbers generated by true random number generators are difficult to predict, possessing true randomness and unpredictability.

[0003] True random number generators are used in lightweight IoT devices, as well as in servers and large-scale encryption systems. The design of true random number generators presents common challenges for different application scenarios, but also varies depending on the specific needs of each scenario.

[0004] Lightweight IoT devices are highly sensitive to power consumption and area requirements. Therefore, true random number generators used in such devices need to be optimized in terms of area and power consumption, while ensuring a high throughput to meet the needs of true random number generation.

[0005] True random number generators used in applications such as data centers, large servers, and quantum key distribution have even higher performance requirements. Because these applications handle massive data streams, the generators need to be high-speed to quickly generate a sufficient number of random numbers. Simultaneously, these applications have stringent reliability requirements, necessitating highly reliable generators to avoid failures and low-quality random numbers. These applications typically handle large amounts of sensitive information, so the generators also need to be highly secure, ensuring the generation of truly random numbers with high entropy and unpredictability, rather than pseudo-random numbers that are at risk of being predicted.

[0006] To meet these performance metrics, the design and implementation of true random number generator circuits for these application scenarios require some investment. Achieving a high-speed, highly reliable, and highly secure true random number generator necessitates complex circuit design, which increases area overhead. Furthermore, the complex circuitry required to enhance randomness leads to higher power consumption, increasing operating costs. Therefore, existing true random number generators suffer from high power consumption. Summary of the Invention

[0007] This invention provides a true random number generator sampling by a multi-choke ring oscillator, aiming to solve the problem of high power consumption in existing true random number generators.

[0008] This invention discloses a true random number generator sampling by a multi-choke ring oscillator, characterized in that the circuit structure includes an output D flip-flop, multiple entropy source modules, and multiple XOR gates; the main signal input terminal of the output D flip-flop is connected to the output terminal of an XOR gate, and the two input terminals of the XOR gate connected to the output D flip-flop are respectively connected to the output terminals of two next-stage XOR gates; the output terminal of the output D flip-flop is used to output a random sequence.

[0009] The outputs of the two entropy source modules are simultaneously connected to the input of an XOR gate, and the outputs of the two XOR gates connected to the entropy source modules are respectively connected to the two inputs of the previous stage XOR gate.

[0010] The number of entropy source modules is 2. n There are n, where n is an integer not less than 2;

[0011] The entropy source module is a choke-type ring oscillator consisting of an entropy source D flip-flop, a buffer circuit, and multiple choke inverters.

[0012] The voltage regulator input terminals of the choke inverters are all connected to the first voltage regulator, and the ground terminals of the choke inverters are all grounded; the first voltage input terminals of the choke inverters are all connected to the first output power supply; and the second voltage input terminals of the choke inverters are all connected to the second output power supply.

[0013] Multiple choke inverters are connected in series. The output of the first choke inverter is connected to the input of the next choke inverter, the output of the previous choke inverter is connected to the input of the next choke inverter, and the input of the last choke inverter is connected to the output of the previous choke inverter. The input of the first choke inverter is connected to the output of the last choke inverter, and the connection point is connected to the input of the buffer circuit.

[0014] The output of the cache circuit is connected to the main signal input of the entropy source D flip-flop; the output of the entropy source D flip-flop serves as the output of the entropy source module.

[0015] The true random number generator sampled by the multi-choke ring oscillator, wherein the number of choke inverters included in the entropy source module is an odd number of not less than 3.

[0016] The true random number generator sampled by the multi-choke ring oscillator, wherein the choke inverter includes a third MOS transistor, a fourth MOS transistor, a fifth MOS transistor, and a sixth MOS transistor;

[0017] The first terminal of the third MOSFET serves as the regulated input terminal of the choke inverter, and the gate of the third MOSFET serves as the first voltage input terminal of the choke inverter. The second terminal of the third MOSFET is connected to the first terminal of the fourth MOSFET, and the second terminal of the fourth MOSFET is connected to the first terminal of the fifth MOSFET, with the connection point serving as the output terminal of the choke inverter. The gate of the fourth MOSFET is connected to the gate of the fifth MOSFET, with the connection point serving as the input terminal of the choke inverter. The second terminal of the fifth MOSFET is connected to the first terminal of the sixth MOSFET, and the gate of the sixth MOSFET serves as the second voltage input terminal of the choke inverter. The second terminal of the sixth MOSFET serves as the ground terminal of the choke inverter.

[0018] The true random number generator with multi-choke ring oscillator sampling, wherein the third MOS transistor and the fourth MOS transistor are both enhancement-mode PMOS transistors or depletion-mode PMOS transistors, and the fifth MOS transistor and the sixth MOS transistor are both enhancement-mode NMOS transistors or depletion-mode NMOS transistors.

[0019] The true random number generator with multi-choke ring oscillator sampling, wherein the third MOS transistor, the fifth MOS transistor, and the sixth MOS transistor are all enhancement-mode NMOS transistors or depletion-mode NMOS transistors; and the fourth MOS transistor is an enhancement-mode PMOS transistor or a depletion-mode PMOS transistor.

[0020] The true random number generator with multi-choke ring oscillator sampling, wherein the third MOS transistor and the fifth MOS transistor are both enhancement-mode NMOS transistors or depletion-mode NMOS transistors, and the fourth MOS transistor and the sixth MOS transistor are both enhancement-mode PMOS transistors or depletion-mode PMOS transistors.

[0021] The true random number generator with multi-choke ring oscillator sampling, wherein the third, fourth and sixth MOS transistors are all enhancement-mode PMOS transistors or depletion-mode PMOS transistors, and the fifth MOS transistor is an enhancement-mode NMOS transistor or a depletion-mode NMOS transistor.

[0022] The true random number generator sampled by the multi-choke ring oscillator, wherein the buffer circuit is composed of multiple basic inverters connected in series;

[0023] The voltage input terminals of the basic inverters are all connected to the second regulated power supply, and the ground terminals of the basic inverters are all grounded.

[0024] The input terminal of the first-level basic inverter serves as the input terminal of the buffer circuit. The output terminal of the previous-level basic inverter is connected to the input terminal of the next-level basic inverter. The output terminal of the last-level basic inverter serves as the output terminal of the buffer circuit.

[0025] The true random number generator sampled by the multi-choke ring oscillator, wherein the basic inverter includes a first MOS transistor and a second MOS transistor;

[0026] The gate of the first MOS transistor is connected to the gate of the second MOS transistor, and the connection point serves as the input terminal of the basic inverter; the source of the first MOS transistor serves as the voltage input terminal of the basic inverter; the drain of the first MOS transistor is connected to the drain of the second MOS transistor, and the connection point serves as the output terminal of the basic inverter; the source of the second MOS transistor serves as the ground terminal of the basic inverter.

[0027] The true random number generator sampled by the multi-choke ring oscillator, wherein the circuit structure further includes a post-processing circuit;

[0028] The post-processing circuit includes multiple post-processing D flip-flops, a first post-processing XOR gate, a second post-processing XOR gate, a third post-processing XOR gate, and a fourth post-processing XOR gate;

[0029] The clock signal input terminals of the post-processing D flip-flops are all connected to the clock signal transmission terminal; the two input terminals of the fourth post-processing XOR gate are respectively connected to the output terminal of the last post-processing D flip-flop and the output terminal of the output D flip-flop.

[0030] The output of the last processed D flip-flop is also connected to the input of the first processed D flip-flop.

[0031] The output of the third post-processing XOR gate is connected to the input of the last processing D flip-flop, and the two input segments of the third post-processing XOR gate are respectively connected to the output of the last processing D flip-flop and the output of the previous processing D flip-flop.

[0032] The output of the second post-processing XOR gate is connected to the input of the processing D flip-flop connected to the third post-processing XOR gate. The two inputs of the second post-processing XOR gate are respectively connected to the output of the last processing D flip-flop and the output of the previous processing D flip-flop.

[0033] The output of the first post-processing XOR gate is connected to the input of the processing D flip-flop connected to the second post-processing XOR gate. The two inputs of the first post-processing XOR gate are respectively connected to the output of the last processing D flip-flop and the output of the previous processing D flip-flop.

[0034] The outputs of the other post-processing D flip-flops are all connected to the inputs of the next-level post-processing D flip-flops.

[0035] This application discloses a true random number generator sampling using a multi-choke ring oscillator. The circuit structure includes an output D flip-flop, multiple entropy source modules, and multiple XOR gates. The main signal input of the output D flip-flop is connected to the output of an XOR gate. The two inputs of the XOR gate connected to the output D flip-flop are respectively connected to the outputs of two subsequent XOR gates. The output of the output D flip-flop is used to output a random sequence. The outputs of two entropy source modules are simultaneously connected to the input of an XOR gate. The outputs of the two XOR gates connected to the entropy source modules are respectively connected to the two inputs of the previous stage XOR gate. The number of entropy source modules is 2^n, where n is an integer not less than 2. In the above circuit structure, by connecting multiple choke inverters end-to-end and combining them with entropy source D flip-flops and buffer circuits, an entropy source module based on a choke ring oscillator is formed. This module can output sequences with high randomness and low operating energy consumption, giving the true random number generator circuit structure a high energy efficiency ratio. Attached Figure Description

[0036] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 The overall circuit diagram of the true random number generator with multi-choke ring oscillator sampling provided in the embodiments of the present invention;

[0038] Figure 2 The circuit structure diagram of the entropy source module provided in the embodiment of the present invention;

[0039] Figure 3 A circuit structure diagram of a buffer provided in an embodiment of the present invention;

[0040] Figure 4 The circuit structure diagram of the basic inverter provided in the embodiments of the present invention;

[0041] Figure 5 A circuit structure diagram of the post-processing circuit provided in an embodiment of the present invention;

[0042] Figure 6 The circuit structure diagram of the choke inverter provided in the embodiment of the present invention;

[0043] Figure 7 Another circuit diagram of the choke inverter provided in an embodiment of the present invention;

[0044] Figure 8 Another circuit diagram of a choke inverter provided in an embodiment of the present invention;

[0045] Figure 9 Another circuit diagram of the choke inverter provided in the embodiment of the present invention;

[0046] Figure 10 A comparison chart showing the performance of a true random number generator sampled by a multi-choke ring oscillator provided in an embodiment of the present invention;

[0047] Figure 11 Application effect diagram of the true random number generator with multi-choke ring oscillator sampling provided in the embodiment of the present invention;

[0048] Figure 12 Another application effect diagram of the true random number generator with multi-choke ring oscillator sampling provided in the embodiment of the present invention;

[0049] Figure 13 This is another application effect diagram of the true random number generator with multi-choke ring oscillator sampling provided in the embodiment of the present invention;

[0050] Figure 14 This is another application effect diagram of the true random number generator with multi-choke ring oscillator sampling provided in the embodiment of the present invention.

[0051] Figure reference numerals: DFF1, Output D flip-flop; ES, Entropy source module; XOR, XOR gate; DFF2, Entropy source D flip-flop; Buffer, Buffer circuit; CSRO, Choke ring oscillator; CSI, Choke inverter; M3, Third MOSFET; M4, Fourth MOSFET; M5, Fifth MOSFET; M6, Sixth MOSFET; PI, Basic inverter; VDD, Second regulated power supply; M1, First MOSFET; M2, Second MOSFET; DFF3, Post-processing D flip-flop; XOR1, First post-processing XOR gate; XOR2, Second post-processing XOR gate; XOR3, Third post-processing XOR gate; XOR4, Fourth post-processing XOR gate. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0054] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0055] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0056] This invention discloses a true random number generator sampling by a multi-choke ring oscillator, such as... Figure 1As shown, the circuit structure includes an output D flip-flop DFF1, multiple entropy source modules ES, and multiple XOR gates. The main signal input terminal of the output D flip-flop DFF1 is connected to the output terminal of an XOR gate. The two input terminals of the XOR gate connected to the output D flip-flop DFF1 are respectively connected to the output terminals of two next-stage XOR gates. The output terminal of the output D flip-flop DFF1 is used to output a random sequence. The output terminals of the two entropy source modules ES are simultaneously connected to the input terminal of an XOR gate. The output terminals of the two XOR gates connected to the entropy source modules ES are respectively connected to the two input terminals of the previous-stage XOR gate. The number of entropy source modules ES is 2^n, where n is an integer not less than 2. Furthermore, the specific structure of the entropy source module ES is as follows: Figure 2 As shown, the entropy source module ES is a choke-type ring oscillator composed of an entropy source D flip-flop DFF2, a buffer circuit Buffer, and multiple choke inverters CSI. The regulated input terminals of the choke inverters CSI are all connected to the first regulated power supply, and the ground terminals of the choke inverters CSI are all grounded. The first voltage input terminals of the choke inverters CSI are all connected to the first output power supply. The second voltage input terminals of the choke inverters CSI are all connected to the second output power supply. Multiple choke inverters CSI are connected in series, and the output terminal of the first choke inverter CSI is connected to the next stage choke inverter. The input terminal of the choke inverter CSI is connected to the input terminal of the next-level choke inverter CSI, and the input terminal of the last-position choke inverter CSI is connected to the output terminal of the previous-level choke inverter CSI. The input terminal of the first-position choke inverter CSI is connected to the output terminal of the last-position choke inverter CSI, and the connection point is connected to the input terminal of the buffer circuit. The output terminal of the buffer circuit is connected to the main signal input terminal of the entropy source D flip-flop DFF2. The output terminal of the entropy source D flip-flop DFF2 serves as the output terminal of the entropy source module ES. The number of choke inverter CSIs included in the entropy source module ES is an odd number of not less than 3.

[0057] A current-starved inverter is a special type of CMOS (Complementary Metal Oxide Semiconductor) inverter circuit with adjustable current transfer characteristics. In a traditional CMOS inverter, a rise or fall in the input voltage causes the output voltage to flip accordingly. However, in a current-starved inverter, its transfer characteristics can be controlled by adjusting the current, thereby regulating its performance to some extent.

[0058] Choke inverter such as Figure 6As shown, the circuit includes a conventional CMOS inverter and two current-controlled transistors (NMOS and PMOS), which are connected to the drains of the pull-up and pull-down transistors of the conventional inverter, respectively. By adjusting the gate voltages of these two current-controlled transistors, i.e., chokes, the current flowing through the inverter can be adjusted, thereby affecting its output characteristics. When the choke gate voltage is adjusted to increase the choking degree, the current flowing through the inverter decreases, and the switching speed of the output voltage slows down; conversely, when the choking degree is decreased, the current of the inverter increases, and the switching speed of the output voltage speed increases.

[0059] Choke inverters are important in many applications, especially in analog and mixed-signal integrated circuit design. They can be used to generate adjustable clock signals, produce adjustable delay lines, and implement dynamic biasing in analog and digital signal processing circuits. Furthermore, choke inverters play a crucial role in the design of random number generators (such as ring oscillators) because they can change the oscillation speed and jitter of the ring oscillator by adjusting the current, thereby achieving higher quality random number output.

[0060] A choke ring oscillator can be obtained by connecting an odd number of choke inverters end to end. For example, the circuit structure of a choke ring oscillator formed by connecting three choke inverters end to end is as follows. Figure 2 As shown. The jitter of a choke-type ring oscillator composed of an odd number of choke inverters is analyzed. First, the frequency of the ring oscillator is evaluated, and its frequency can be expressed by formula (1):

[0061]

[0062] Where I is the average current of the ring oscillator, C is the load capacitance of the ring oscillator, M is the number of stages (number) of the choke inverter, and V DD This is the power supply voltage (the voltage at the first voltage input terminal).

[0063] The rising and falling edges of the oscillation signal of a ring oscillator are affected by random noise, resulting in accumulated jitter. The total jitter of the ring oscillator, obtained by adding these two types of jitter together, can be expressed by formula (2):

[0064]

[0065] Where γ N and γ P These are the noise figures for NMOS and PMOS transistors, respectively.

[0066] If all transistors in the inverter operate in the weak inversion region, the average current can be expressed by formula (3):

[0067]

[0068] Where I0 is V ds Drain-source voltage equals thermal voltage V t The current at kT / q is a constant when the temperature is fixed. Where q = 1.602 × 10⁻⁶. -19 Coulomb is the charge of one electron. Therefore, the jitter noise of a ring oscillator operating in the weak inversion region can be expressed by formula (4):

[0069]

[0070] From the above formulas (2) and (4), it can be seen that if you want to increase the jitter noise of the ring oscillator RO, you can reduce the charging and discharging current or reduce the oscillation frequency. Since the charging and discharging current can be reduced and the oscillation frequency can be reduced by using a choke, the ring oscillator composed of inverters operating in the weak inversion region (i.e., the choke-type ring oscillator CSRO) will exhibit greater jitter noise.

[0071] To quantify the jitter of the aforementioned ring oscillator RO and choke-type ring oscillator CSRO, formula (5) can be used:

[0072]

[0073] Where δ jitter R describes the jitter of a ring oscillator. jitter This indicates the maximum distribution range of jitter, measured in picoseconds (ps). jitter The period of the ring oscillator is expressed in picoseconds (ps). The jitter of the ordinary 3-stage RO is quantified as 0.6475 according to formula (5). The jitter of the 3-stage CSRO is 0.7726. It can be seen that the CSRO has a greater jitter, which is as expected. Simultaneously, testing shows that the power consumption of the 3-stage CSRO at an oscillation frequency of 3.59 GHz is 3.28 uW. To pull the output level of the 3-stage CSRO to the standard 1.1V and 0V levels, a buffer stage needs to be connected to its output, with a power consumption of 5.84 uW. The power consumption of the 3-stage RO at 26 GHz is 33.33 uW. That is, the choke ring oscillator composed of three choke inverters in this application can meet the corresponding design requirements. The voltage of the first output power supply can be the standard 1.1V voltage.

[0074] The entropy source module in this design references a traditional sampling RO jitter design structure. This design XORs the outputs of a sufficient number of ring oscillators, samples the result using a D flip-flop, and outputs a random number. Its working principle is as follows: Figure 10 As shown, Figure 10The upper-middle waveform corresponds to an ideal, jitter-free RO output; the middle waveform corresponds to an RO output with slight jitter; and the lower waveform corresponds to an RO output with significant jitter. If a slower clock is used to acquire these three waveforms, the acquired value of the ideal RO output is deterministic. The acquired value of the RO output with slight jitter will result in two parts: partly randomness in the jittered area, and partly non-randomness in the deterministic area. If a clock is used for acquisition... Figure 10 The waveform diagram in the lower middle section shows a RO output filled with jitter, which highly suggests that the acquired output will have a high degree of randomness. Even a single RO, including a CSRO (CS-based RO), while exhibiting greater jitter than a typical RO, cannot produce a fully jittered output signal. Therefore, this application's method uses multiple independent CSROs. Each CSRO output signal exhibits jitter on both its rising and falling edges. Furthermore, due to process mismatches, the oscillation frequency and jitter level of each CSRO are not entirely identical. Thus, a sufficient number of CSROs can fill every moment of clock sampling with jitter. In this case, sampling the CSRO outputs using the sampling clock and XORing them together yields a random output. Simultaneously, a D flip-flop is connected after each CSRO. Testing shows that this modification can converge the 0-1 ratio to 0.5, resulting in a random sequence with good randomness.

[0075] In a more specific embodiment, such as Figures 6 to 9 As shown, the choke inverter CSI includes a third MOSFET M3, a fourth MOSFET M4, a fifth MOSFET M5, and a sixth MOSFET M6. The first terminal of the third MOSFET M3 serves as the regulated input terminal of the choke inverter CSI, and the gate of the third MOSFET M3 serves as the first voltage input terminal of the choke inverter CSI. The second terminal of the third MOSFET M3 is connected to the first terminal of the fourth MOSFET M4, and the second terminal of the fourth MOSFET M4 is connected to the first terminal of the fifth MOSFET M5, with the connection point serving as the output terminal of the choke inverter CSI. The gate of the fourth MOSFET M4 is connected to the gate of the fifth MOSFET M5, with the connection point serving as the input terminal of the choke inverter CSI. The second terminal of the fifth MOSFET M5 is connected to the first terminal of the sixth MOSFET M6, and the gate of the sixth MOSFET M6 serves as the second voltage input terminal of the choke inverter CSI. The second terminal of the sixth MOSFET M6 serves as the ground terminal of the choke inverter CSI. In this configuration, the first electrode of the MOSFET is the source and the second electrode is the drain, or the first electrode of the MOSFET is the drain and the second electrode is the source. Neither of these configurations affects the function of the choke inverter (CSI) as an entropy source.

[0076] In a specific application, such as Figure 6 As shown, the third MOS transistor M3 and the fourth MOS transistor M4 are both enhancement-mode PMOS transistors or depletion-mode PMOS transistors, and the fifth MOS transistor M5 and the sixth MOS transistor M6 are both enhancement-mode NMOS transistors or depletion-mode NMOS transistors.

[0077] In a specific application, such as Figure 7 As shown, the third MOS transistor M3, the fifth MOS transistor M5, and the sixth MOS transistor M6 are all enhancement-mode NMOS transistors or depletion-mode NMOS transistors; the fourth MOS transistor M4 is an enhancement-mode PMOS transistor or a depletion-mode PMOS transistor.

[0078] In a specific application, such as Figure 8 As shown, the third MOS transistor M3 and the fifth MOS transistor M5 are both enhancement-mode NMOS transistors or depletion-mode NMOS transistors, and the fourth MOS transistor M4 and the sixth MOS transistor M6 are both enhancement-mode PMOS transistors or depletion-mode PMOS transistors.

[0079] In a specific application, such as Figure 9 As shown, the third MOS transistor M3, the fourth MOS transistor M4 and the sixth MOS transistor M6 are all enhancement-mode PMOS transistors or depletion-mode PMOS transistors, and the fifth MOS transistor M5 is an enhancement-mode NMOS transistor or a depletion-mode NMOS transistor.

[0080] All four configurations of the choke inverters described above can achieve the function of generating oscillations and serving as the basic structure of entropy source to generate random sequences, as described in this application.

[0081] In a specific embodiment, such as Figure 3 As shown, the buffer circuit is composed of multiple basic inverters PI connected in series; the voltage input terminals of each basic inverter PI are connected to the second regulated power supply VDD, and the ground terminals of each basic inverter PI are all grounded; the input terminal of the first basic inverter PI serves as the input terminal of the buffer circuit, the output terminal of the previous basic inverter PI is connected to the input terminal of the next basic inverter PI, and the output terminal of the last basic inverter PI serves as the output terminal of the buffer circuit.

[0082] Specifically, such as Figure 4As shown, the basic inverter PI includes a first MOSFET M1 and a second MOSFET M2; the gate of the first MOSFET M1 is connected to the gate of the second MOSFET M2, and the connection point serves as the input terminal of the basic inverter PI; the source of the first MOSFET M1 serves as the voltage input terminal of the basic inverter PI; the drain of the first MOSFET M1 is connected to the drain of the second MOSFET M2, and the connection point serves as the output terminal of the basic inverter PI; the source of the second MOSFET M2 serves as the ground terminal of the basic inverter PI. Wherein, the first MOSFET M1 is an N-type MOSFET, and the second MOSFET M2 is a P-type MOSFET.

[0083] The entropy source circuit designed in this paper is as follows: Figure 1 As shown, a choke-type ring oscillator (CSRO) is constructed using three stages of choke inverters, followed by a four-stage inverter as a buffer to pull the CSRO output to standard high and low levels. An entropy source D flip-flop is then used to acquire the CSRO output. The output of the entropy source circuit is then XORed with an XOR tree to obtain a single bit output. To improve circuit reliability and prevent timing errors caused by excessive cascading of XOR gates, an output D flip-flop is inserted every two XOR gates to synchronize the signal before inputting or transmitting it to the next XOR gate. Figure 1 The structure shown is only the most basic structure. The number of entropy source modules can be 2 to the power of n (then the number of CSROs is equal to the number of entropy source modules). For example, a TRNG design based on CSROs uses 16 CSROs as entropy sources, outputting a 1-bit random number sequence after XORing. The sampling clock frequency is set to 100MHz. Due to the influence of process error mismatch, the oscillation frequency and jitter of the 16 CSROs are different. Testing was performed using a test program, and all test results were passed, indicating that 16 CSROs can generate sufficient jitter, and after XORing, high-quality random numbers can be generated. The PVT of the circuit was tested under FF, SS, SF, FS process corners, ±15% VDD (15% deviation from the standard voltage of 1.1V), and -40-125℃ conditions. All output ports can generate random numbers, and all CSROs can oscillate.

[0084] In one specific application, the circuit structure further includes a post-processing circuit; such as... Figure 5As shown, the post-processing circuit includes multiple post-processing D flip-flops (DFF3), a first post-processing XOR gate (XOR1), a second post-processing XOR gate (XOR2), a third post-processing XOR gate (XOR3), and a fourth post-processing XOR gate (XOR4). The clock signal input terminals of the post-processing D flip-flops (DFF3) are all connected to the clock signal transmission terminal. The two input terminals of the fourth post-processing XOR gate (XOR4) are respectively connected to the output terminal of the last post-processing D flip-flop (DFF3) and the output terminal of the output D flip-flop (DFF1). The output terminal of the last post-processing D flip-flop is also connected to the input terminal of the first post-processing D flip-flop. The output terminal of the third post-processing XOR gate (XOR3) is connected to the input terminal of the last post-processing D flip-flop, and the two input segments of the third post-processing XOR gate (XOR3) are respectively connected to the last post-processing D flip-flop. The output terminal of the first post-processing XOR gate XOR1 is connected to the input terminal of the processing D flip-flop connected to the second post-processing XOR gate XOR2. The two input terminals of the second post-processing XOR gate XOR2 are respectively connected to the output terminal of the last processing D flip-flop and the output terminal of the previous processing D flip-flop. The output terminal of the first post-processing XOR gate XOR1 is connected to the input terminal of the processing D flip-flop connected to the second post-processing XOR gate XOR2. The two input terminals of the first post-processing XOR gate XOR1 are respectively connected to the output terminal of the last processing D flip-flop and the output terminal of the previous processing D flip-flop. The output terminals of the other post-processing D flip-flops DFF3 are all connected to the input terminals of the next-level post-processing D flip-flops DFF3.

[0085] The post-processing circuit can use an 11-bit finite element filter structure, such as... Figure 5 As shown, although the randomness of the original random numbers generated by the TRNG in this design is good after testing, given the requirements of the AIS31 standard for the highest level of security for true random number generators, the security of the generated true random number sequence can be further enhanced by adding a post-processing module.

[0086] In this application, a True Random Number Generator (TRNG) corresponding to the above circuit structure was fabricated using a 40nm standard CMOS process. The fabricated TRNG was then tested at a power supply voltage V. DDExperimental verification was conducted under a voltage of 1.1V. The random number generator constructed above contained eight entropy source modules (eight CSROs), each CSRO containing three choke inverters, and each buffer circuit consisted of four basic inverters connected in series. To evaluate the quality of the generated random numbers, the collected random number data was subjected to NIST 800-22 and NIST 800-90B tests. The testing objective was for the collected random number data to pass both NIST tests under the expected test conditions. Furthermore, it also needed to pass other randomness tests, such as autocorrelation, Shannon entropy, and FFT tests.

[0087] In each test, 10M bits of random number data were collected as input. For the NIST 800-22 test, default parameters were used, and the 10M bits of data in CSV format were divided into 10 groups, each containing 1M bits. For the NIST 800-90B test, the 10M bits of data were converted to bin format for input into the test program.

[0088] This design anticipates that at least eight CSRO outputs will be sufficient to generate high-quality random numbers; therefore, quality testing was conducted starting with the raw random numbers from the eight CSRO outputs. 10 Mbits of data were collected at sampling clocks of 10 MHz and 20 MHz, and then subjected to NIST testing.

[0089] In the NIST 800-22 test, the confidence level α is set to 0.01. A test is considered passed when the p-value for each test is greater than 0.01. The test program automatically calculates the minimum number of groups that need to pass based on the number of groups in the output data and determines whether the pass rate meets the expected standard. If it does not meet the standard, an asterisk ('*') is used before the pass rate proportion. The test also reports a uniformity of p-values, displayed before the pass rate (i.e., the p-value in table x). This parameter describes the uniformity of the p-value distribution across the 10 data groups. If the distribution is too uneven or variable, the p-value will decrease. A test is considered passed when the p-value is greater than 0.0001. Otherwise, an asterisk ('*') is used before the test.

[0090] The test results are shown in Table 1. All eight random numbers output by CSRO using sampling clocks of 10MHz and 20MHz successfully passed the NIST 800-22 test. This demonstrates that the technical method described in this application can generate high-quality random numbers without post-processing under these conditions.

[0091] Table 1. NIST 800-22 test results for 10Mbit data

[0092]

[0093] Subsequently, the random number data was tested using the NIST 800-90B standard. The test results are shown in Table 2, including tests for independent and identically distributed (i.i.d.) and non-independent and identically distributed (non-i.i.d.) random numbers. Notably, the minimum entropy calculated by the evaluator in the non-i.d. test was also sufficiently high. This result demonstrates that our random number generator exhibits good performance in terms of entropy quality.

[0094] Table 2. NIST 800-90B Test Results for 10M-bit Random Numbers

[0095]

[0096] The purpose of the Autocorrelation Function (ACF) test is to evaluate the correlation between data points at different time points in a random number sequence. The ACF test is an important method in random number quality assessment, primarily used to detect the presence of periodicity, patterns, or other hidden correlations in a random number sequence. In the ACF test, the autocorrelation coefficients of the random number sequence are calculated at different time delays. These coefficients reflect the degree of correlation between data points at different time intervals in the sequence. For an ideal random number sequence, the autocorrelation coefficient should be close to zero, meaning that the data in the sequence are independent at different time points and there is no correlation. If the autocorrelation coefficient is significantly higher than zero at some time delays, it indicates the presence of potential correlations in the sequence, which may lead to poor random number quality.

[0097] This test used 10M bits of random numbers generated by 8 CSROs sampled at 20MHz for ACF testing, and set the maximum hysteresis value Lag to 10000. The test results are as follows: Figure 11 As shown, the horizontal axis represents the lag value (Lag), the vertical axis represents the autocorrelation coefficient (ACF), and the 95% confidence interval is marked with a dashed line. It can be seen that the data used in this test has very low autocorrelation.

[0098] Subsequently, a 0-1 ratio test was performed on the collected 10M bits of data, and the test results are as follows: Figure 12 As shown, the 0-1 ratio for each 1M bits of data is very close to 50%, indicating that the random numbers generated by the TRNG do not have a significant bias towards 0 or 1.

[0099] Shannon entropy can be expressed by formula (6):

[0100] H(X)=-∑P(X)*log2(P(X)) (6);

[0101] Where P(X) is the probability of 1 appearing in the random number sequence. The closer the ratio of 0 to 1 in a random number sequence is to 50%, the greater its Shannon entropy will be. Figure 13 As shown, there are 10 sets of 1M bits of data. The Shannon entropy of each set of data is above 0.99999, and the Shannon entropy of the 10M bits of data as a whole is 0.99999944.

[0102] Finally, 1M bits of the acquired 10M bits of data were subjected to FFT (Fast Fourier Transform) analysis. FFT is a method for analyzing the spectrum of a signal; it converts a time-domain signal into a frequency-domain signal to better observe periodic components. For a random number sequence, a uniform distribution in the frequency domain means that the frequency components in the sequence are balanced, with no one or several specific frequency components significantly dominating. The analysis results are as follows... Figure 14 As shown, the FFT output graph is smooth and without obvious peaks, indicating that the energy of each frequency component in the random number sequence is relatively evenly distributed. This means that there is no significant periodic component in the random number sequence, so it can be concluded that the random number sequence has good randomness.

[0103] The tests also included random number sampling at a 20MHz clock sampling rate for the outputs of 16 CSROs, 32 CSROs, 64 CSROs, and the post-processed outputs of 16 CSROs, and performed corresponding randomness tests. The data output from these ports all passed the corresponding randomness tests. However, considering layout area and power consumption, the random number output of the 8 CSROs in this design offers the highest cost-effectiveness while maintaining good randomness. The area occupied by the 8 CSROs, their XOR gates, and the sampling circuitry is 360μm. 2 It has a power consumption of 20uW and an energy consumption of 1pJ / bit at a throughput of 20Mbps.

[0104] Finally, the test results of this design were compared with those of previous work, as shown in Table 3:

[0105] Table 1

[0106]

[0107] This invention discloses a true random number generator sampling using a multi-choke ring oscillator. The circuit structure includes an output D flip-flop, multiple entropy source modules, and multiple XOR gates. The main signal input of the output D flip-flop is connected to the output of an XOR gate. The two inputs of the XOR gate connected to the output D flip-flop are respectively connected to the outputs of two subsequent XOR gates. The output of the output D flip-flop is used to output a random sequence. The outputs of two entropy source modules are simultaneously connected to the input of an XOR gate. The outputs of the two XOR gates connected to the entropy source modules are respectively connected to the two inputs of the previous stage XOR gate. The number of entropy source modules is 2^n, where n is an integer not less than 2. In the above circuit structure, by connecting multiple choke inverters end-to-end and combining them with entropy source D flip-flops and buffer circuits, an entropy source module based on a choke ring oscillator is formed. This module can output sequences with high randomness and low operating energy consumption, giving the true random number generator circuit structure a high energy efficiency ratio.

[0108] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A true random number generator sampling by a multi-choke ring oscillator, characterized in that, The circuit structure includes an output D flip-flop, multiple entropy source modules, and multiple XOR gates; The main signal input terminal of the output D flip-flop is connected to the output terminal of an XOR gate, and the two input terminals of the XOR gate connected to the output D flip-flop are respectively connected to the output terminals of two next-stage XOR gates; the output terminal of the output D flip-flop is used to output a random sequence. The outputs of the two entropy source modules are simultaneously connected to the input of an XOR gate, and the outputs of the two XOR gates connected to the entropy source modules are respectively connected to the two inputs of the previous stage XOR gate. The number of entropy source modules is 2. n There are n, where n is an integer not less than 2; The entropy source module is a choke-type ring oscillator consisting of an entropy source D flip-flop, a buffer circuit, and multiple choke inverters. The voltage regulator input terminals of the choke inverters are all connected to the first voltage regulator, and the ground terminals of the choke inverters are all grounded; the first voltage input terminals of the choke inverters are all connected to the first output power supply; and the second voltage input terminals of the choke inverters are all connected to the second output power supply. Multiple choke inverters are connected in series. The output of the first choke inverter is connected to the input of the next choke inverter, the output of the previous choke inverter is connected to the input of the next choke inverter, and the input of the last choke inverter is connected to the output of the previous choke inverter. The input of the first choke inverter is connected to the output of the last choke inverter, and the connection point is connected to the input of the buffer circuit. The output of the buffer circuit is connected to the main signal input of the entropy source D flip-flop; the output of the entropy source D flip-flop serves as the output of the entropy source module.

2. The true random number generator sampling by a multi-choke ring oscillator according to claim 1, characterized in that, The number of choke inverters contained in the entropy source module is an odd number of not less than 3.

3. The true random number generator sampling with multi-choke ring oscillator according to claim 2, characterized in that, The choke inverter includes a third MOSFET, a fourth MOSFET, a fifth MOSFET, and a sixth MOSFET; The first terminal of the third MOSFET serves as the regulated input terminal of the choke inverter, and the gate of the third MOSFET serves as the first voltage input terminal of the choke inverter. The second terminal of the third MOSFET is connected to the first terminal of the fourth MOSFET, and the second terminal of the fourth MOSFET is connected to the first terminal of the fifth MOSFET, with the connection point serving as the output terminal of the choke inverter. The gate of the fourth MOSFET is connected to the gate of the fifth MOSFET, with the connection point serving as the input terminal of the choke inverter. The second terminal of the fifth MOSFET is connected to the first terminal of the sixth MOSFET, and the gate of the sixth MOSFET serves as the second voltage input terminal of the choke inverter. The second terminal of the sixth MOSFET serves as the ground terminal of the choke inverter.

4. The true random number generator sampling with multi-choke ring oscillator according to claim 3, characterized in that, The third and fourth MOS transistors are both enhancement-mode PMOS transistors or depletion-mode PMOS transistors, and the fifth and sixth MOS transistors are both enhancement-mode NMOS transistors or depletion-mode NMOS transistors.

5. The true random number generator sampling with multi-choke ring oscillator according to claim 3, characterized in that, The third, fifth, and sixth MOS transistors are all enhancement-mode NMOS transistors or depletion-mode NMOS transistors; the fourth MOS transistor is an enhancement-mode PMOS transistor or a depletion-mode PMOS transistor.

6. The true random number generator sampling by a multi-choke ring oscillator according to claim 3, characterized in that, The third and fifth MOS transistors are both enhancement-mode NMOS transistors or depletion-mode NMOS transistors, and the fourth and sixth MOS transistors are both enhancement-mode PMOS transistors or depletion-mode PMOS transistors.

7. The true random number generator sampling with multi-choke ring oscillator according to claim 3, characterized in that, The third, fourth, and sixth MOS transistors are all enhancement-mode PMOS transistors or depletion-mode PMOS transistors, and the fifth MOS transistor is an enhancement-mode NMOS transistor or a depletion-mode NMOS transistor.

8. The true random number generator sampling by a multi-choke ring oscillator according to any one of claims 1-3, characterized in that, The buffer circuit is composed of multiple basic inverters connected in series; The voltage input terminals of the basic inverters are all connected to the second regulated power supply, and the ground terminals of the basic inverters are all grounded. The input terminal of the first-level basic inverter serves as the input terminal of the buffer circuit. The output terminal of the previous-level basic inverter is connected to the input terminal of the next-level basic inverter. The output terminal of the last-level basic inverter serves as the output terminal of the buffer circuit.

9. The true random number generator sampling by a multi-choke ring oscillator according to claim 8, characterized in that, The basic inverter includes a first MOSFET and a second MOSFET; The gate of the first MOS transistor is connected to the gate of the second MOS transistor, and the connection point serves as the input terminal of the basic inverter; the source of the first MOS transistor serves as the voltage input terminal of the basic inverter; the drain of the first MOS transistor is connected to the drain of the second MOS transistor, and the connection point serves as the output terminal of the basic inverter; the source of the second MOS transistor serves as the ground terminal of the basic inverter.

10. The true random number generator sampling by a multi-choke ring oscillator according to any one of claims 1-3, characterized in that, The circuit structure also includes a post-processing circuit; The post-processing circuit includes multiple post-processing D flip-flops, a first post-processing XOR gate, a second post-processing XOR gate, a third post-processing XOR gate, and a fourth post-processing XOR gate; The clock signal input terminals of the post-processing D flip-flops are all connected to the clock signal transmission terminal; the two input terminals of the fourth post-processing XOR gate are respectively connected to the output terminal of the last post-processing D flip-flop and the output terminal of the output D flip-flop. The output of the last processed D flip-flop is also connected to the input of the first processed D flip-flop. The output of the third post-processing XOR gate is connected to the input of the last processing D flip-flop, and the two input segments of the third post-processing XOR gate are respectively connected to the output of the last processing D flip-flop and the output of the previous processing D flip-flop. The output of the second post-processing XOR gate is connected to the input of the processing D flip-flop connected to the third post-processing XOR gate. The two inputs of the second post-processing XOR gate are respectively connected to the output of the last processing D flip-flop and the output of the previous processing D flip-flop. The output of the first post-processing XOR gate is connected to the input of the processing D flip-flop connected to the second post-processing XOR gate. The two inputs of the first post-processing XOR gate are respectively connected to the output of the last processing D flip-flop and the output of the previous processing D flip-flop. The outputs of the other post-processing D flip-flops are all connected to the inputs of the next-level post-processing D flip-flops.

Images