Random number generator

Abstract

The invention relates to a random number generator. The invention relates to an apparatus and a method for generating random numbers. The random number is expected to have a minimum deviation or no deviation from any of its possible values, such that each possible value that the random number can take has the same or substantially the same likelihood. In some examples, the disclosed devices and methods involve sampling two kTC noise signals from a capacitor and using the two sampled signals to generate a random number with a minimum or no deviation. In some other examples, the disclosed apparatus and methods additionally or alternatively use a scrambling circuit to generate scrambled random numbers using random numbers and random or pseudo-random dither signals.

Description

Technical Field

[0001] The present disclosure relates to apparatus and methods for generating random numbers. Background Art

[0002] The present disclosure relates to the generation of random numbers in which the probability that the random number has any one of its possible values ​​is equal or substantially equal each time a new random number is generated. This may be referred to as a "dynamic" random number because it has the potential to change each time a new number is generated. This is in contrast to another type of random number, which may be referred to as a "static" or "persistent" random number, in which numbers generated by different copies of the same device are randomly different, but numbers generated by a particular copy of the device should ideally remain the same over time (e.g., numbers generated by a Physical Unclonable Function (PUF) should be static random numbers). In the present disclosure, the term "random number" is intended to mean a "dynamic random number."

[0003] Random numbers are used for a variety of different purposes. Ideally, each possible value for the number should be equally likely, so that each time a new number is generated, there is no bias towards numbers with one (or more) specific values. However, due to the physical properties of the circuits / devices / systems that generate random numbers, there may be unintentional inherent biases towards specific values, so care should be taken to minimize or eliminate these biases. In addition, for some uses of random numbers (e.g., cryptography), a malicious third party may wish to manipulate the circuits / devices / systems that generate random numbers so that the numbers they generate are no longer random. Therefore, it may be desirable to design and / or operate the circuits / devices / systems in a way that makes it difficult for third parties to understand or influence the operation of the circuits / devices / systems, thereby improving the security and reliability of the random numbers generated. Summary of the invention

[0004] The present invention relates to devices and methods for generating random numbers. It is desirable that the random number has minimal or no deviation for any of its possible values, so that each possible value that the random number can take has the same or substantially the same probability. In some examples, the disclosed devices and methods involve sampling two kTC noise signals from a capacitor and using the two sampled signals to generate a random number with minimal or no deviation. In some other examples, the disclosed devices and methods additionally or alternatively use a scrambling circuit to generate a scrambled random number using a random number and a random or pseudo-random jitter signal.

[0005] In a first aspect of the present disclosure, there is provided a random number generating device, comprising a first random number generator, the first random number generator comprising a first noise generator circuit, comprising: a first capacitor for generating kTC noise; and a first buffer, coupled to the first capacitor to buffer a capacitor voltage including the kTC noise generated by the first capacitor, and output a buffered voltage; and a determining unit, configured to: read out a first buffered voltage from an output of the first buffer, wherein the first buffered voltage is a buffered version of a first capacitor voltage including a first kTC noise generated by the first capacitor at a first time; and read out a second buffered voltage from the output of the first buffer, wherein the second buffered voltage is a buffered version of a second capacitor voltage including a second kTC noise generated by the first capacitor at a second time, wherein the random number generating device is configured to generate a random number based on the first buffered voltage and the second buffered voltage.

[0006] The noise generator circuit may further include a first switch coupled to the first capacitor to form a first switched capacitor arrangement such that changing the state of the first capacitor from closed to open generates a capacitor voltage including kTC noise at the first capacitor.

[0007] The first buffer may be configured to apply a gain to the capacitor voltage to generate a buffered voltage.

[0008] The determination unit may include a sampling circuit configured to sample the first buffer voltage (and optionally the second buffer voltage). The input capacitance of the sampling circuit may be greater than the capacitance of the first capacitor.

[0009] The sampling circuit may include an amplifier including at least one capacitor, wherein the sampling circuit is configured to sample the first buffered voltage (and optionally the second buffered voltage) using the at least one capacitor.The amplifier may be an auto-zero amplifier.

[0010] The determination unit may include a comparator configured to compare the sampled first buffer voltage with the second buffer voltage, wherein the generation of the random number is based on an output of the comparator.

[0011] The sampling circuit may include an analog-to-digital ADC converter configured to convert the first buffered voltage into a first digital value and convert the second buffered voltage into a second digital value, wherein the random number generation device is configured to generate a random number using the first digital value and the second digital value.

[0012] The first random number generator may further include a second noise generator circuit including: a second capacitor for generating kTC noise; and a second buffer coupled to the second capacitor to buffer a capacitor voltage including the kTC noise generated by the second capacitor and output a buffered voltage; wherein the determination unit is further configured to: read out a third buffered voltage from the output of the second buffer, wherein the third buffered voltage is a buffered version of a third capacitor voltage, the third capacitor voltage includes a third kTC noise generated by the second capacitor at the first time, and wherein the first buffered voltage and the third buffered voltage together form a first differential signal (which may be a true / full differential or a pseudo differential); and read out a fourth buffered voltage from the output of the second buffer, wherein the fourth buffered voltage is a buffered version of a fourth capacitor voltage, the fourth capacitor voltage includes a fourth kTC noise generated by the second capacitor at the second time, and wherein the second buffered voltage and the fourth buffered voltage together form a second differential signal (which may be a true / full differential or a pseudo differential), wherein the random number generation device is configured to generate a random number based on the first differential signal and the second differential signal.

[0013] The determination unit may further include an auto-zero differential sampling circuit (which may be true / full differential or pseudo differential) configured to sample the first differential signal (and optionally the second differential signal). The determination unit may be configured to generate a random number based on determining a difference between the second differential signal (optionally, the sampled second differential signal) and the sampled first differential signal.

[0014] The random number generating device may further include a scrambling circuit configured to receive the random number generated by the first random number generator and a jitter signal which is a random value signal or a pseudo-random value signal, and wherein the scrambling circuit is configured to generate a scrambled random number based on the jitter signal and the random number generated by the first random number generator.

[0015] The scrambling circuit may be configured to set the scrambled random number equal to the random number generated by the first random number generator when the jitter signal is a first value, and set the scrambled random number to a value different from the random number generated by the first random number generator when the jitter signal is a second value. For example, when the jitter signal is the second value, the scrambled random number is set to the reciprocal of the random number generated by the first random number generator. Optionally, the random number generating device may further include a second random number generator to generate a random jitter signal.

[0016] The random number generation device of the first aspect may also include: one or more other random number generators having the same design as the first random number generator; and a multi-bit random number unit configured to generate a multi-bit random number based on random numbers generated using at least some of the one or more other random number generators and the first random number generator. The first random number generator and the one or more other random number generators may be configured to operate in parallel.

[0017] In a second aspect, a method for generating a random number is provided, the method comprising a first noise generator circuit, comprising: generating a first buffered voltage output from a buffer, wherein the first buffered voltage includes a first kTC noise generated by a capacitor at a first time; generating a second buffered voltage output from the buffer, wherein the second buffered voltage includes a second kTC noise generated by the capacitor at a second time; and generating a random number based on the first buffered voltage and the second buffered voltage.

[0018] In a third aspect, a device for generating a scrambled random number is provided, the device comprising: a first random number generator configured to generate a first random number; and a scrambling circuit configured to receive the first random number and a first jitter signal, and generate a scrambled random number based on the first random number and the first jitter signal, wherein the first jitter signal is a random value signal or a pseudo-random value signal.

[0019] The scrambling circuit may be configured to generate a scrambled random number by setting the scrambled random number to a value equal to the first random number when the first jitter signal is a first value, and setting the scrambled random number to a value different from the first random number when the first jitter signal is a second value. For example, when the first jitter signal is the second value, the scrambled random number is set to the reciprocal of the first random number.

[0020] The device may also include a first jitter generator for generating the first jitter signal. Optionally, the first jitter generator may include another random number generator configured to generate another random number, wherein the first jitter generator is configured to use the other random number to generate the first jitter signal. Further optionally, the first jitter generator may also include a first pseudo-random number generator configured to use the other random number as a seed to generate the first jitter signal, wherein the first jitter signal is a pseudo-random number output by the first pseudo-random number generator. Additionally or alternatively, the first jitter generator may also include an entropy correction circuit configured to generate the first jitter signal based on another random number. For example, the entropy correction circuit may be a von Neumann corrector.

[0021] The device may also include multiple random number generators, including the first random number generator, wherein the multiple random number generators are configured to generate a corresponding multiple random numbers; and the device may also include a first jitter generator, configured to generate the first jitter signal, wherein the scrambling circuit is configured to receive the multiple random numbers and the first jitter signal, and use the multiple random numbers and the first jitter signal to generate a corresponding multiple scrambled random numbers.

[0022] The plurality of random number generators and the first jitter generator may be implemented in an integrated chip and spatially arranged in rows / columns.

[0023] Optionally, the scrambling circuit may be configured to scramble at least two of the plurality of random numbers using a first jitter signal, wherein the at least two random numbers are generated by two random number generators that are spatially non-adjacent in the row. The first jitter generator may occupy a position in the row that is spatially non-adjacent to the two random number generators that generate the at least two random numbers.

[0024] The device may also include: a second jitter generator configured to generate a second jitter signal, wherein the scrambling circuit is configured to receive the second jitter information, and generate a first group of scrambled random numbers using the first group of random numbers and the first jitter signal, and generate a second group of scrambled random numbers using the second group of random numbers and the second jitter signal, wherein the multiple random numbers include the first group of random numbers and the second group of random numbers, and wherein the multiple scrambled random numbers include the first group of scrambled random numbers and the second group of scrambled random numbers to generate the second group of scrambled random numbers.

[0025] The scrambling circuit may also be configured to: receive one or more additional jitter signals; and generate a scrambled random number based on the first random number, the first jitter signal, and the one or more additional jitter signals. Optionally, the scrambling circuit may also be configured to: generate an intermediate jitter signal using the first jitter signal and the one or more additional jitter signals; and generate a scrambled random number using the first random number and the scrambled jitter signal.

[0026] In a fourth aspect, a method for generating a scrambled random number is provided, comprising: generating a first random number; and generating a scrambled random number based on the first random number and the first jitter signal, wherein the first jitter signal is a random value signal or a pseudo-random value signal.

[0027] In a fifth aspect, a system is provided, comprising: a plurality of random number generators configured to generate a corresponding plurality of random numbers; and a multi-bit random number unit configured to: receive at least two of the random numbers generated by the plurality of random number generators; and generate a multi-bit random number using the at least two received random numbers, wherein the plurality of random number generators are configured to operate in parallel so that the plurality of random numbers are generated in parallel.

[0028] The plurality of random number generators may include a first group consisting of at least two random number generators that provide random numbers to a multi-bit random number unit, wherein each of the first group of random number generators includes a scrambling circuit configured to scramble the random number output to the multi-bit random number unit; and wherein the plurality of random number generators also include a second group of random number generators that output random numbers to the first group of random number generators for scrambling their output random numbers.

[0029] Alternatively, multiple random number generators may be implemented in an integrated chip and arranged as a series of adjacent columns / rows.The first random number generator whose output random numbers are used by the second random number generator for scrambling purposes may be spatially separated from the second random number generator.

[0030] The multi-bit random number unit may be configured to generate a multi-bit random number by concatenating at least two received random numbers, wherein the order of the concatenation changes each time a new multi-bit random number is generated. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] By way of example only, aspects of the present disclosure are described with reference to the following drawings, in which:

[0032] Figure 1 An example schematic diagram of a random number generation device / system according to one aspect of the present disclosure is shown;

[0033] Figure 2A An example representation of an RC filter circuit used to help explain kTC noise generation is shown;

[0034] Figure 2B shows an example representation of a basic switched capacitor arrangement for generating kTC noise;

[0035] Figures 3A to 3G Shows Figure 1 Example implementation of a noise generator circuit for a random number generation device;

[0036] Figure 4 Shows Figure 1 An example process by which a random number generating device may determine a random number;

[0037] Figure 5 Shows Figure 1 Example implementation of a determination unit of a random number generation device;

[0038] Figure 6 Shows Figure 1 An example implementation of a random number generator for ;

[0039] Figures 7A to 7E Shows Figure 1 Further example implementation details of the random number generator;

[0040] Figure 8 Another example schematic diagram of a random number generation device / system configured to generate scrambled random numbers is shown;

[0041] Fig.9A Another example schematic diagram of a random number generation device / system configured to generate scrambled random numbers is shown;

[0042] Fig. 9B shows an example implementation of a jitter generator;

[0043] Fig.10 Another example schematic diagram of a random number generation device / system configured to generate scrambled random numbers is shown;

[0044] Fig.11 Another example schematic diagram of a random number generation device / system configured to generate scrambled random numbers is shown;

[0045] Fig.12 Another example schematic diagram of a random number generation device / system configured to generate scrambled random numbers is shown;

[0046] Fig.13 Another example schematic diagram of a random number generating device / system is shown;

[0047] Figures 14A-14D Details of another example random number generation device / system configured to generate a plurality of scrambled random numbers are shown;

[0048] Fig.15 Another example schematic diagram of a random number generation device / system configured to generate a plurality of scrambled random numbers is shown;

[0049] Fig.16 An example process for generating scrambled random numbers is shown. DETAILED DESCRIPTION

[0050] The present disclosure includes multiple different implementations of a random number generation device configured to generate random numbers, wherein each time a new random number is generated, the probability that the random number has any of its possible values ​​is equal or substantially equal. In some implementations, the random number is generated based on random kTC noise generated by one or more capacitors. The kTC noise can be read from the capacitor, but the inventors have recognized that in addition to the kTC noise, the readout signal will also include other components, such as low-frequency noise, kTC noise generation circuits, and / or signal offsets / biases in the readout circuit. These other components mean that the random number generated directly from the readout kTC noise signal may be biased.

[0051] However, the inventors have realized that if they create two consecutive kTC noise events and read the kTC noise from each event, the two readout signals should have the same or substantially the same low frequency noise and signal offset / bias.

[0052] Therefore, subtracting one signal from the other (i.e. finding the difference) should substantially eliminate the non-kTC noise in the signal, leaving only the kTC noise. Thus, improved random numbers can be generated.

[0053] Also disclosed is an implementation of a random number generation device that uses scrambling to improve random numbers. In particular, the random number can be scrambled by a scrambling circuit using one or more random or pseudo-random dithering signals. In this way, regardless of how the random number is generated, the entropy of the scrambled random number should be the same as or greater than the entropy value of the random number, thereby improving the scrambled random number (i.e., it has less or no deviation for any possible value).

[0054] Figure 1 An example schematic diagram of a random number generating device / system 100 according to one aspect of the present disclosure is shown. It includes a random number generator 102, which includes a noise generator circuit 110 and a determination unit 120. In some example implementations, the random number generating device / system 100 will include more than one random number generator 102, but for simplicity, a single random number generator 102 will be described initially. The noise generator circuit 110 is configured to generate a buffer voltage 115, which is output to the determination unit 120. The determination unit 120 is configured to generate a random number 125 using the output buffer voltage 115.

[0055] In some implementations, the first noise generator circuit 110 can include a capacitor configured to generate random kTC noise, wherein the random buffered voltage 115 includes the kTC noise generated by the capacitor.

[0056] Figure 2A An example representation of an RC filter circuit is shown to help explain the kTC noise that a capacitor can generate. The RC filter circuit has a resistor, R, and a capacitor, C. The thermal noise v in the signal VOUT n It can be expressed as:

[0057]

[0058] in

[0059] T = Temperature

[0060] k B = Boltzmann constant

[0061] Thermal noise v nThis is often referred to as kTC noise, and this is how the rest of this disclosure will refer to it. kTC noise is random and follows a Gaussian distribution, where is the sigma of the Gaussian distribution.

[0062] In one example, at a temperature of 27°C (300K), the kTC noise of capacitor C is:

[0063]

[0064] Figure 2B An example representation of a basic switched capacitor arrangement for generating kTC noise is shown. The switch SW can be modeled as a variable resistor that depends on the switch state. The kTC noise generated by this circuit is similar to Figure 2A The noise of the RC filter circuit shown is the same. When the switch switches from the on (i.e., closed) state to the off (i.e., open) state, the kTC noise is injected across the capacitor C. Therefore, switching the state of the switch SW from the closed state to the open state can be regarded as generating a capacitor voltage VOUT including the kTC noise.

[0065] The inventors have realized that since the generated kTC noise is random, it can be used to generate random numbers. To this end, it is best to make the noise as large as possible. As shown in the table above, the kTC noise can be increased by reducing the capacitance of capacitor C. However, a smaller capacitor has less energy, which makes it more difficult to read and use the signal VOUT.

[0066] The inventors realize that by buffering the capacitor voltage VOUT, the buffer can be used to read a very small capacitor voltage VOUT. By doing so, the capacitance of the capacitor C can be set to a very small value, so that the kTC noise component of the capacitor voltage VOUT is relatively large. By maximizing the contribution of kTC noise in the capacitor voltage VOUT, the randomness of any random number generated using the capacitor voltage VOUT can be improved. However, using a buffer to read out the capacitor voltage VOUT introduces additional challenges. For example, it may be desirable to use a buffer with a low input capacitance because the buffer input capacitance may contribute to the capacitance of the switched capacitor circuit. Since it is desirable to have a very small capacitance to maximize the kTC noise, any additional capacitance from the buffer input may be undesirable. However, buffers with relatively small input capacitance tend to have relatively large offset errors, which may reduce the randomness of the buffer voltage output by the buffer, and therefore also reduce the randomness of any random number generated based on the buffer voltage.

[0067] In the face of all these challenges and considerations, the inventors have configured the device 100 such that the noise generator circuit 110 generates a first buffered output voltage 115 including a first kTC noise, and the determination unit 120 reads the first buffered output voltage 115. Subsequently, the noise generator circuit 110 generates a second buffered output voltage including a second kTC noise, and the determination unit 120 reads the second buffered output voltage 115. The determination unit 120 can then generate a random number 125 based on a comparison of the first and second buffered output voltages. By performing this two-step process of kTC noise generation, the compared signal may have a lower level of undesirable, persistent components such as DC bias, low-frequency noise, and buffer offset (i.e., non-random components that reduce the randomness of the random number), so that the random number generated using the comparison result should have improved randomness.

[0068] Furthermore, since the buffer offset can be reduced or eliminated by using two buffered output voltages, a buffer with a small input capacitance can be used, thereby increasing the magnitude of the kTC noise component in the buffered output voltage.

[0069] Figure 3A 1 shows an example implementation of the noise generator circuit 110. The noise generator circuit 110 includes a switch 310 and a capacitor 320 and is arranged such that when the state of the switch 310 changes from closed to open, the bias voltage V BIAS The kTC noise is sampled on capacitor 320. The bias voltage V BIAS V may be set to any voltage including positive voltage, negative voltage or 0V. Switch 310 may be any suitable type of controllable switch, such as a transistor, such as a MOS transistor, which may be p-type or n-type, depending on V BIAS The noise generator circuit 110 also includes a buffer 330, which is configured to buffer the capacitor voltage V C to generate a buffered voltage 115. The buffer may be of any suitable type, such as a source follower.

[0070] Figure 3B Another example implementation of the noise generator circuit 110 is shown. Its design is similar to Figure 3A1 is the same as shown except that it has a different type of buffer 340. In this example, buffer 340 is a differential amplifier with negative feedback, and can be of any suitable type, such as an operational amplifier. Both buffer 330 and buffer 340 provide the function of isolating the low capacitance circuit before the buffer from the potentially relatively high input capacitance at the input of determination unit 120 (described in more detail later). Therefore, it helps to keep the capacitance that generates kTC noise small, thereby increasing the size of the kTC noise generated. In addition, both buffer 330 and buffer 340 provide the function of increasing the drive strength of the kTC noise signal (i.e., the drive strength of the buffer voltage 115 is greater than the capacitor voltage V C ), which makes it easier for the determination unit 120 to use kTC noise when generating random numbers. The main difference between the two buffers 330 and 340 is that the buffer 330 can have a larger offset voltage than the buffer 340, but this offset voltage should be largely or completely eliminated by the double sampling of the capacitor 320 and the operation of the determination unit 120, as described later.

[0071] Figure 3C and 3D A further example implementation of the noise generator circuit 110 is shown. Figure 3C In the implementation of , a single-ended amplifier 350 (of any suitable type, such as a straightforward single-stage common-source amplifier) ​​is used. Figure 3D In the implementation of , a differential amplifier 340 is used. In both implementations, the noise generator circuit 110 is configured so that the buffered output voltage 115 is a gained version of the capacitor voltage (including kTC noise), where the gain is equal to the ratio of the input capacitance of amplifiers 340 / 350 to the capacitance of capacitor 320.

[0072] Figure 3E , 3F 3G show further example implementations of the noise generator circuit 110. These implementations are similar to Figure 3C and 3D The implementations of are very similar except that they also include an additional capacitor 360 having a relatively large capacitance compared to the capacitor 320 used for kTC noise generation. In all three implementations, the noise generator circuit 110 is configured such that the buffered output voltage 115 is a gained version of the capacitor voltage (including the kTC noise), where the gain is equal to the ratio of the capacitance of capacitor 360 to the capacitance of capacitor 320.

[0073] all Figure 3A , 3B The voltages in 3D, 3E, 3F, and 3G are shown relative to ground, but the circuits can be configured to use any other suitable reference voltage.

[0074] Figure 4 An example diagram showing a process by which the random number generation device 100 may determine a random number.

[0075] In step S410, at a first point in time, the noise generator circuit 110 generates a first capacitor voltage across the capacitor 320, wherein the voltage of the first capacitor includes a first kTC noise. A first buffered voltage, which is a buffered version of the first capacitor voltage, is output from the noise generator circuit 110. The noise generator circuit 110 can achieve this by controlling the state of the switch 310 from a closed state to an open state. For example, the control can be performed by a control unit, which can be part of the determination unit 120, or can be external to the determination unit (for example, if the random number generation device is configured to have multiple random number generators 102, a central controller that controls the operation of multiple random number sources 102, as described later). The control unit can take any suitable form that can be well understood by those skilled in the art, for example, it can be implemented by dedicated circuits / logic, FPGAs, microcontrollers or processors, or any other type of logic configured to control the state of the switch 310.

[0076] In step S420, the determination unit 120 reads a first buffer voltage from the noise generator circuit 110. As explained in more detail below, the first buffer voltage may be sampled by the determination unit 120 or otherwise saved / stored for later use in generating random numbers.

[0077] In step S430, at a second time point after the first time point, the noise generator circuit 110 generates a second capacitor voltage across the capacitor 320, wherein the second capacitor voltage includes a second kTC noise. A second buffered voltage, which is a buffered version of the second capacitor voltage, is output from the noise generator circuit 110. The noise generator circuit 110 can be controlled by first restoring the state of the switch 310 to a closed state and then changing the switch 310 from the closed state to an open state at a second time point. Again, as described above, such control can be performed in any suitable manner.

[0078] In step S440, the determination unit 120 reads the second buffer voltage from the noise generator circuit 110. As explained in more detail below, the second buffer voltage may be sampled by the determination unit 120 or otherwise saved / stored for later use in generating random numbers.

[0079] In step S450, the random number generation device may generate a random number 125 based on the first buffer voltage and the second buffer voltage. For example, the first buffer voltage and the second buffer voltage may be compared to generate the random number 125. In one example, the comparison may determine the value of a single bit of the random number 125, such as randomly setting a single bit to 0 or 1. In particular, for example, if the first buffer voltage is greater than the second buffer voltage, the random number may be set to 0 (or optionally 1), and if the first buffer voltage is less than the second buffer voltage, the random number may be set to 1 (or optionally 0). In some examples, the determination unit 120 itself may perform this step and output the random number 125, such as Figure 1 However, alternatively, this step may be performed elsewhere in the random number generation device, wherein the determination unit 120 outputs the values ​​indicative of the first and second buffer voltages to some other unit / module within the random number generation device 100 , where the random number 125 is then determined.

[0080] Figure 5 1 shows an example implementation when the determination unit 120 is configured to generate a random number 125. In this example, a controller 550 is shown for controlling the operation timing of the noise generator 110, the sampling circuit 510 and the ADC 520 to perform the above reference Figure 4 The controller 550 may optionally be a part of the random number generating device 100 (for simplicity, Figure 4 If the random number generating device 100 includes more than one random number generator, the controller 550 may also be used to control the operation timing of one or more other random number generators 102 in the random number generating device 100. In an alternative, the controller 550 may be part of the random number generator 102, such as part of the determination unit 120 (e.g., it may form part of the random number calculation circuit 530).

[0081] The determination unit 120 includes a sampling circuit 510, which is configured to sample the first buffer voltage at step S420. The sampling circuit 510 can be implemented in any common manner that will be well understood by those skilled in the art. The sampled voltage is then converted to a digital value by an analog-to-digital converter (ADC) 520 and then received by a random number calculation circuit 530. The ADC 520 can be any suitable type of ADC 520, such as a flash ADC, a SAR AC, a ∑-Δ ADC, a ramp ADC, etc. The random number calculation circuit 530 can then store the digital value indicating the first buffer voltage in a memory 540. Similarly, the memory 540 can be of any suitable type, such as volatile or non-volatile. Although the memory 540 is shown as part of the determination unit 120, it can also be located anywhere in the random number generation device 100, such as shared by multiple random number generators 102.

[0082] Subsequently, the sampling circuit 510 may reset and sample the second buffer voltage at step S440 , and then the ADC 520 may digitally convert it. Optionally, the random number calculation circuit 530 may store the digital value in the memory 540 .

[0083] Finally, random number calculation circuit 530 may use the first stored digital value and the second digital value to determine random number 125, such as by setting random number 125 to 0 or 1 (as described above) depending on which digital value is greater. In the event that the two digital values ​​are equal to each other, random number calculation circuit 530 may be configured to behave in a variety of different ways. For example, it may repeat Figure 4 until the two numbers are not equal, at which point a random number 125 is generated. Alternatively, it can be configured to pseudo-randomly assign the random number 125 to be 0 or 1 whenever the digital values ​​are equal, for example using a received pseudo-random dithering signal.

[0084] The random number calculation circuit 530 can be configured in any suitable manner to perform this function. For example, it can be implemented in hardware, such as a dedicated circuit or FPGA, or it can be implemented by software executed on logic, such as on one or more processors, such as a microprocessor or microcontroller.

[0085] Although the random number calculation circuit 530 is shown as part of the determination unit 120, it may also be located elsewhere on the random number generating device 100, for example shared by one or more other random number generators 102 in the case where the device 100 includes multiple random number generators 102. In this case, the determination unit 120 will not generate the random number 125. Instead, the first and second digital values ​​will be output from the determination unit 120 to the random number calculation circuit 530, and the random number 125 will be generated there.

[0086] In an alternative, the determination unit 120 may be configured to compare two sampled voltages in the analog domain. For example, the determination unit 120 may include a circuit having a first and a second sampling capacitor, wherein the determination unit 120 is configured to sample a first buffered voltage on the first sampling capacitor in step S420 and to sample a second sampled voltage in step S440. The differential ADC may then generate a multi-bit digital representation of the difference between the first buffered voltage and the second buffered voltage, and if the output of the ADC shows that the second buffered voltage is greater than the first buffered voltage, a random number 125 may be generated based on the value (e.g., if the output of the ADC shows that the first buffered voltage is greater than the second buffered voltage, the random number may be set to 0 (or 1), and may be set to 1 (or 0)). In an alternative, the determination unit may not include a multi-bit ADC, but may include a comparator configured to compare the two sampled voltages and output a single-bit digital representation of the comparison, which is set to 0 or 1 depending on the comparison (e.g., the single-bit representation may show whether the first buffered voltage is greater than or less than the second buffered voltage). The output of the comparator may be single-ended or differential. In this example, the output of the comparator will be the random number 125.

[0087] In each of the above examples, the random number generator 102 has a single noise generator circuit 110 (or "first noise generator"), so that the signal received at and used by the determination unit 120 is a single-ended signal. However, in another implementation, the random number generator 102 may include two noise generator circuits, each circuit outputting a buffered voltage that together form a differential signal. The determination unit 120 then receives the differential signal and uses it to generate the random number 125. In this case, as described in more detail below, the determination unit 120 may be similar to Figure 5 to configure.

[0088] Alternatively, the determination unit 120 may not have an ADC 520 configured to digitally convert the first buffered differential voltage and digitally convert the second buffered differential signal, wherein the difference between the two is then determined in the digital domain. Instead, the determination unit 120 may be configured to determine the difference between the first buffered differential voltage and the second buffered differential current in the analog domain. The difference may then be converted to a digital representation, which may be a multi-bit digital representation of the difference or a single-bit representation of the difference (e.g., a single-bit representation showing whether the kTC noise generated by the first noise generator is greater or less than the kTC noise generated by the second noise generator).

[0089] Figure 6An example implementation of a random number generator 102 is shown having a first noise generator circuit 1101 and a second noise generator circuit 1102. The first and second noise generator circuits may have the same design and may be implemented in any of the ways described previously, e.g. Figures 3A-3F Refer to the reference above. Figure 4 In the process, in step S410, at a first time point, by controlling their respective capacitor switches, the first noise generator circuit 1101 can generate a first capacitor voltage across its capacitor 3201 (wherein the voltage of the first capacitor includes the first kTC noise), and the second noise generator circuit 1102 can generate a third capacitor voltage across its capacitor 3202 (wherein the third capacitor voltage includes the third kTC noise), as described above. The first buffered voltage 1151 is output from the first noise generator circuit 1101, and the third buffered voltage 1152 is output from the second noise generator circuit 1102. The two buffered voltage signals together form a first differential signal. The term "differential" is used in this disclosure to include true differential or full differential (wherein the signals constituting the differential signal are all generated by a single structure centered on a common voltage) and pseudo differential (wherein each of the two signals constituting the differential information is generated by a differential structure that is not necessarily centered on a common mode voltage, but where the two structures are designed to have the same DC bias, such as Figure 6 ).

[0090] In step S420, the determination unit 120 reads the first differential signal from the first and second noise generator circuits. The first differential signal may be sampled or otherwise saved / stored for later use in generating random numbers. For example, if the determination unit 120 is as described above with reference to Figure 5 In the implementation, the sampling circuit 510 may sample the differential signal in any suitable manner, and the ADC 520 may be configured to receive a single-ended or differential signal to convert the sampled value, depending on the configuration of the sampling circuit 510 .

[0091] Alternatively, the determination unit 120 may not have the ADC 520 but may use a comparator, an example of which will be described later.

[0092] In step S430, at a second time point after the first time point, as described above, by controlling their respective capacitor switches, the first noise generator circuit 1101 generates a second capacitor voltage (wherein the second capacitor voltage includes the second kTC noise) across its capacitor 3201, and the second noise generator circuit 1102 generates a fourth capacitor voltage (wherein the fourth capacitor voltage includes the fourth kTC noise) across its capacitor 3202. The second buffered voltage 1151 is output from the first noise generator circuit 1101, and the fourth buffered voltage 1152 is output from the second noise generator circuit 1102. The two buffered voltage signals together form a second differential signal.

[0093] In step S440, the determination unit 120 reads the second differential signal from the first and second noise generator circuits. Alternatively, the determination unit 120 may sample or otherwise hold / store the second differential signal.

[0094] In step S450, the random number generation device 100 may generate a random number 125 based on the first differential signal and the second differential signal. For example, the difference between the first differential signal and the second differential signal may be found to generate the random number 125 in the same manner as described above and further described below.

[0095] Fig. 7A An example implementation of the first and second noise generators 1101 and 1102 is shown, but it should be understood that any other suitable configuration may be used for each noise generator in which a capacitor voltage containing kTC noise and a buffered signal output (e.g. Figures 3A-3F, or any other suitable implementation). The switch 310 of each noise generator is implemented using a FET, the state of which is controlled by a control signal SW (which can be controlled using a controller that is part of the random number generator 102, or is located anywhere else in the random number generating device 100, or is indeed located outside the random number generator 100). The buffer of each noise generator is implemented using corresponding current sources I1 and I2 and corresponding FETs MP1 and MP2. Differences in the components of each noise generator may result in undesirable signal components within the buffered voltages 1151 and 1152, which may reduce the randomness of the numbers generated using the buffered voltages 1151 and 1152. For example, due to differences in switches 3101 and 3102 and / or differences in capacitors 3201 and 3202, each generated capacitor voltage may have a slightly different DC offset, which will be passed to the buffered output voltages 1151 and 1152. In addition, or alternatively, due to component differences, each buffer may have a different offset, which will result in an offset between the buffered output voltages 1151 and 1152. However, since the differential signal at the first time point (first differential signal) is compared with the differentiated signal at the signal time point (second differentiated signal) in order to generate a random number, and each of these differential signals should have the same or very similar offset components, these unwanted signals may be significantly reduced or completely eliminated, leaving only the kTC noise that can be used for random number generation.

[0096] In all Figure 6 , 7A , 7B, 7C and 7E, the two noise generating circuits 1101 and 1102 are represented as differential structures that are not necessarily centered on the common mode voltage, so that the signals 1151 and 1152 together form a pseudo differential signal. However, they can also be configured so that the signals 1151 and 1152 together form a true / full differential signal. For example, a single differential buffer can be used instead of using a separate buffer for each kTC capacitor 320, wherein the capacitor voltage (including kTC noise) of each of the capacitors 3201 and 3202 is received at the corresponding input of the differential buffer. Those skilled in the art will readily understand the various types of suitable differential buffers that can be used. In this case, the first noise generator circuit and the second noise generator circuit can be considered together to include a first capacitor 3201 and a second capacitor 3202 and a differential buffer, and the differential buffer is configured to output a differential signal based on the capacitor voltage of the first capacitor 3201 and the second resistor 3202.

[0097] Figure 7B Shows Fig. 7A An example implementation of the determination unit 120 is shown in FIG. Figure 7C Shows Fig. 7A Another example implementation of the determination unit 120 is shown in FIG.

[0098] from Figure 7B Initially, sampling circuit 710 receives and samples differential signals 1151 and 1152, and ADC 720 receives and converts the sampled differential signals 7151 and 7152. The operation of this example implementation is similar to that described above with reference to Figure 4 and Figure 5 The operations described above are the same. Specifically, in step S410, a first differential signal is output from the first noise generator circuit 1101 and the second noise generator circuit 1102. In step S420, the determination unit 120 reads the first differential information from the first and second noise generator circuits by sampling the first differential signal in any suitable manner, which will be well understood by those skilled in the art. Optionally, the sampling circuit 710 may also include a gain or amplifier circuit, such as a preamplifier. Then, the ADC 720 performs a digital conversion on the sampled first differential signal, and the digital output of the ADC 720 is converted by the random number calculation circuit 530 to the same as the above reference. Figure 5 The first differential signal converted by the ADC 720 includes the difference between the kTC noise generated by the first noise generator circuit 1101 and the kTC-noise generated by the second noise generator circuit 1102 in the first switching event of the noise generator capacitor, and any DC offset between the two signals constituting the differential signal (e.g., caused by one or more of low-frequency noise, an offset in the driving voltage of the noise generator circuit, an offset caused by a noise generator circuit buffer, an amplifier offset if the sampling circuit 710 includes a preamplifier, etc.).

[0099] Subsequently, the sampling circuit 710 is reset, and in step S430, the second differential signal is output from the first noise generator circuit 1101 and the second noise generator circuit 1102. In step S440, the determination unit 120 reads the second differential value signal from the first and second noise generator circuits by sampling the second differential signal. Then, the ADC 720 performs digital conversion on the sampled second differential signal, and the digital output of the ADC 720 is converted by the random number calculation circuit 530 to the same as the above reference. Figure 5 The second differential signal converted by ADC 720 includes the difference between the kTC noise generated by the first noise generator circuit 1101 and the kTC-noise generated by the second noise generator circuit 1102 in the second switching event of the noise generator capacitor, and the DC offset between the two signals constituting the differential signal.

[0100] Finally, in step S450, the random number generation device 100 generates a random number 125 based on the first and second digital outputs of the ADC 720. For example, the random number calculation circuit 520 can compare the first and second digital values ​​and set the random number 125 to 0 or 1 depending on whether the difference between the first and second digital values ​​is positive or negative, as described above with reference to Figure 5 By comparing the two digital values ​​(eg, subtracting one from the other), the DC offset in the signal can be cancelled out, leaving only the random kTC noise, based on which the random number 125 is generated.

[0101] exist Figure 7C In the alternative shown, the sampling circuit is implemented as an auto-zero sampling preamplifier, including a gain stage 730, an auto-zero switch AZ1, and sampling capacitors Cla and Clb. Gain stage 730 can be any suitable type of differential amplifier gain stage as will be well understood by those skilled in the art. If the differential signal formed by 1151 and 1152 is a pseudo differential signal (such as Figure 7C ), the auto-zero sampling preamplifier (including gain stage 730) may alternatively be implemented as a pseudo-differential auto-zero sampling preamplifier. For example, it may be Figure 7C , but instead of differential gain stage 730, two single-ended gain stages may be used, corresponding to signals 1151 and 1152, whose outputs will form pseudo differential signals that are then input to comparator 740. Sampling capacitors Cla and Clb may have a capacitance that is larger (possibly significantly larger, e.g., at least an order of magnitude larger) than the capacitance of kTC capacitor 320 of the noise generator circuit. In this example, the sampling circuit is a single-stage auto-zero preamplifier, although Fig. 7E As shown, it can also be a multi-stage auto-zero preamplifier.

[0102] Fig.7D Shows the representation Figure 7C Timing diagram of example operation of the circuit. Initially, in step S410, the auto-zero switch AZ1 is closed in the auto-zero state, and the switches of the noise generators 1101 and 1102 are closed to couple the first buffered differential signal to the auto-zero preamplifier. In step S420, the switch signal SW then goes low, causing the first buffered differential signal to be sampled by capacitors Cla and Clb. Example differential signals 1151 and 1152 and vin1 and vin2 are shown in FIG. Fig.7DAs shown. It should be understood that these are just one example and their amplitudes and relative polarities may vary depending on the kTC noise in the signal output by the noise generator circuit. The sampled first differential signal includes the difference between the kTC noise generated by the first noise generator circuit 1101 and the kTC noise generated by the second noise generator circuit 1102 in the first switching event of the noise generator capacitor, as well as any DC offset between the two signals making up the differential signal (e.g., caused by one or more of low frequency noise, offset in the drive voltage of the noise generator circuit, offset caused by the buffer of the noise generator line, etc.).

[0103] Subsequently, the auto-zero state is terminated by opening the auto-zero switch AZ1, and the noise generator circuit is reset by closing the switch controlled by the signal SW and then opening it again at steps S430 and S440, so that a second switching event occurs in the noise generator circuit, new kTC noise is generated in its capacitor, and a second buffered differential voltage is output from the noise generator circuit. The second buffered differential voltage includes the difference between the kTC noise generated by the first noise generator circuit 1101 and the kTC noise generated by the second noise generator circuit 1102 in the second switching event of the noise generator capacitor, and any DC offset between the two signals constituting the differential signal. The second buffered differential signal is sampled onto capacitors Cla and Clb. Therefore, since both the first and second buffered differential signals are sampled onto capacitors Cla and Clb without any reset of capacitors Cla and Clb, and both sampled signals include the same (or substantially the same) DC component, the differential signal at the input of the comparator 740 represents the difference between the first buffered differential voltage and the second buffered differential voltage. Therefore, the signal at the input of comparator 740 includes the difference between the total kTC noise generated by the first noise generator circuit in the first and second switching events and the total kTC noise of the second noise generator circuit. The output of comparator 740 indicates the polarity of the differential signal at its input, which in turn indicates whether the combined kTC noise generated by the first noise generator 1151 through its two switched capacitor kTC events is greater than or less than the combined kTC noise generated by the second noise generator 1152 through its two switched capacitor kTC events. Therefore, the output of comparator 740 will be randomly 0 or 1. At step S450, comparator 740 is latched so that its output Comp_out remains at the output. In this case, Comp_out is a random number 125.

[0104] By performing auto-zeroing in this manner, the residual offset of the preamplifier and the offset voltage between the two buffers of the two noise generating circuits can be significantly reduced. This may help reduce any bias in the random number 125, thereby improving the randomness of the number. In addition, auto-zeroing in this manner also helps reduce 1 / f noise in the signal at the input of the comparator 740.

[0105] In reference Figure 6 7 , at least some of the DC components in signals 1151 and 1152 should be canceled by considering a differential voltage signal comprised of the outputs of two identical noise generating circuits such that the differential signal includes the kTC noise and any offset between the buffers of the noise generator circuits (which is then canceled by determining two kTC noise events based on a random number from each noise generator circuit, i.e., by determining the random number using the first and second differential signals).

[0106] Alternatively, comparator 740 may not be a latching comparator, such that its output is simply set based on a comparison of its then-current input voltages. Additionally or alternatively, determination unit 120 may include a set / reset (SR) latch at the output of comparator 740 to maintain the value of the comparator 740 output at output 125. Furthermore, the output of comparator 740 may be single-ended or differential.

[0107] Fig. 7E Shows Figure 7C Another implementation of the determination unit 120 is that instead of having a single-stage sampling preamplifier, a multi-stage sampling preamplifier is provided. In this example, there are two amplifier stages, but any number of stages may be used, such as three, four, etc.

[0108] The determination unit 120 is similar to the determination unit 120 in addition to comprising a second gain stage 735 having a second auto-zero switch AZ2 and second sampling capacitors C2a and C2b. Figure 7C The control method of the second automatic zeroing switch AZ2 can be the same as that of the above reference Fig.7D The first auto-zero switch AZ1 is identical (optionally with a small timing offset so that AZ1 and AZ2 do not open and close at exactly the same time).

[0109] Using multiple stages of preamplifiers may slightly increase the cost and size of the determination unit 120, but may have the benefit of improving noise immunity and reducing mismatches between charge injections caused by auto-zero switches.

[0110] So this might help improve the randomness of the output number 125.

[0111] exist Figure 1 and Figure 5In the example of , there is a single noise generator 110. However, in an alternative, there may be two or more noise generators, and the output of any one of them may be received and used by the determination unit 120. For example, the circuit may include a multiplexer that receives an output 115 from each of the plurality of noise generators and passes any one of the outputs 115 to the determination unit 120.

[0112] Thus, the noise generator used by the determination unit 120 may be changed periodically or intermittently, so that for different random numbers generated by the device 100, a different noise generator may be used. In this way, if there is any problem associated with a particular noise generator 110, such as a residual bias in the signal 115 output by the particular noise generator 110, it should not affect all random numbers generated by the device 100. This arrangement is also applicable to differential implementations of the apparatus 100, such as Figure 6 and 7A 7E. In these examples, there may be three or more noise generators, and the determination unit 120 may be configured to receive the outputs 115 of any two of them. Similarly, a multiplexer may be used to receive three or more signals 115 and pass any two of them to the determination unit 120, so that the selected two signals may be changed periodically or intermittently.

[0113] Optionally, Figure 7C and 7E The determination units shown in may form part of any other circuit, for example, they may be part of a SAR ADC or a slope ADC or a serial interface coupled to the noise generator 110 for generating the random number 125 .

[0114] Optionally, the random number generating device 100 may further include one or more scrambling circuits configured to generate scrambled random numbers.

[0115] Figure 8 An example random number generating device 100 is shown that also includes a scrambling circuit 810. The random number generator 102 can be implemented in any manner described previously, and can generate random numbers 125 in the same manner as described above. However, in this example implementation, and in all examples described below where the random number 125 is scrambled, the random number generator 102 can be implemented in any alternative manner that will be well understood by those skilled in the art to generate the random number 125. Therefore, the random number generator 102 in this example and all subsequent examples is not limited to the kTC capacitor implementation described previously, and can also generate random numbers 125 in any manner known to those skilled in the art, including techniques / systems that do not use kTC noise.

[0116] The scrambling circuit 810 receives the random number 125 and also receives a random or pseudo-random jitter signal 815. For simplicity, from now on, the signal 815 will be referred to as the jitter signal 815. The jitter signal 815 can be a single-bit or multi-bit random number. The scrambling circuit 810 is configured to generate a scrambled random number 825 by scrambling the random number 125 using the jitter signal 815. For example, when the jitter signal 815 has a first value, the scrambling circuit 810 can set the scrambled random number 825 to have the same value as the random number 125, and when the jitter signal 815 has a second value, the scrambled random number 825 can be set to a value different from the value of the internal random number 125. For example, the scrambling circuit 810 can be an XOR gate or an XNOR gate, or a circuit / logic having the function of an XOR gate or an XNOR gate, wherein the internal random number 125 and the jitter signal 815 are inputs and the scrambled random number 825 is output. Therefore, the scrambled random number 825 can be set as follows:

[0117] Internal random number 125 Jitter signal 815 Scrambled random number 825 0 0 0 0 1 1 1 0 1 1 1 0

[0118] Alternatively, the scrambling circuit 810 may be any other form of circuit / logic configured to generate the scrambled random number 825 by scrambling the internal random number 125 according to the dithering signal 815 .

[0119] In one example, the dithering signal 815 may be generated by a second random number generator having the same design as the random number generator 102 .

[0120] Fig.9A An example is shown in which the random number 1252 generated by the second random number generator 1022 is used as a dithering signal for the scrambling circuit 810 of the first random number generator 1021.

[0121] In an alternative, the dither signal may be generated by a pseudo-random number generator.In another alternative, the dither signal may be generated by a pseudo-random number generator seeded by the output of another random number generator 1022 of the same design as the first random number generator 1021 .

[0122] Fig. 9BA non-limiting example implementation of a jitter generator 805 is shown, which includes a random number generator 102 and an entropy correction circuit 806. The random number generator 102 outputs a random number 125 to the entropy correction circuit 806, which uses the random number 125 to generate a jitter signal 815. The entropy correction circuit 806 can be configured to generate the jitter signal 815 in such a way that it reduces or corrects any entropy problems in the random number 125 that would cause the random number to not have an equal probability for each of its possible values. In one example, the entropy correction circuit 806 can be a Von Newmann corrector that is configured to operate according to the Von Neumann principle of removing 0 / 1 bias from the random number. In particular, it can be configured to receive two consecutive values ​​from the random number generator 102. If the two consecutive values ​​from the random number generator 102 are "01", the jitter signal 815 is set to 0 (or 1). If two consecutive values ​​from the random number generator 102 are "10", the dithering signal 815 is set to 1 (or 0). If two consecutive values ​​from the random number generator 102 are "00" or "11", the correction circuit 806 has no output (i.e., the dithering signal 815 has no value), and the process is repeated until the dithering signal 815 is set to a value. Therefore, for each new value of the dithering signal 815, the random number generator 102 needs to generate at least two random values. However, this means that the dithering signal 815 should not be biased towards 1 or 0, which will improve the randomness of the scrambled random number 825.

[0123] In an alternative, the jitter generator 805 may not have the entropy correction circuit 806, but output the random number 102 as the jitter signal 815. In another alternative, the jitter generator 805 may also include a pseudo-random number generator configured to be seeded by the random number 102 and output the pseudo-random number as the jitter signal 815. In another alternative, it may be implemented in any other way known to those skilled in the art.

[0124] exist Figure 8 and 9A In the example of , the scrambling circuit 810 uses only two inputs to generate the scrambled random number 825. Therefore, it may only include one scrambler, such as an XOR or XNOR gate, to perform one-step scrambling. However, in an alternative, a more complex scrambler circuit may be used to generate the scrambled random number 825.

[0125] Fig.10An example of a more complex scrambling circuit 1010 is shown, which is configured to generate a scrambled random number 825 using the random number 125 and two or more dithering signals 1008. In this example, the scrambling circuit 1010 performs cyclic scrambling using two or more scramblers (each of which may be configured to have an XOR or XNOR function, as described above).

[0126] The random number generating device includes a random number generator 102 and two jitter generators 10051 and 10052 for generating two jitter signals 10051 and 10052. The jitter generator 1005 can be referred to above. Figure 8 The scrambling circuit 1010 includes three scramblers 10201, 10202, and 1030 (e.g., three XOR or XNOR gates). The first intermediate scrambler 10201 generates a first intermediate jitter signal 10251 by scrambling the random number 125 using the first jitter signal 10151, in the same manner as described above with reference to FIG. Figure 8 The second intermediate scrambler 10202 then scrambles the second jitter signal 10152 by using the first intermediate scrambled jitter signal 10251 to be consistent with the above reference Figure 8 The second intermediate encrypted jitter signal 10252 is generated in the same manner as described in FIG9. Finally, the final scrambler 1030 generates a scrambled random number 825 by scrambling the random number 125 using the second intermediate scrambled jitter signal 10252, in the same manner as described above with reference to FIG9. Figure 8 The same method as described in FIG. 9 .

[0127] It should be understood that in this example, two dither signals 1015 and three scramblers are used. However, the principles of the circuit can be extended to any number of dither signals 1015 and scramblers 1020.

[0128] Fig.11 Another example scrambling circuit 1110 is shown that includes multiple scramblers to perform more complex scrambling. In this example, the scrambling circuit 1110 is configured to perform two-step scrambling. The two-step scrambling is very similar to the above-described cyclic scrambling, except that the first intermediate scrambler 10201 scrambles the first and second jitter signals 10151 and 10152 to generate a first intermediate jitter signal 10251. The final scrambler 1030 then generates a scrambled random number 825 by scrambling the random number 125 using the first intermediate jitter signal 10251 in the same manner as described above with reference to FIG. Figure 8 The same method as described in FIG. 9 .

[0129] Fig.12 Another example scrambling circuit 1210 is shown, which is similar to Fig.11is very similar, except that it is configured to perform three-step scrambling. It should be understood that Fig.11 and Fig.12 Multi-step scrambling is shown, which can be extended to any number of scrambling steps, such as two, three, four, etc.

[0130] Generating and using one or more intermediate jitter signals in the above manner can increase the entropy of the jitter signal, and finally the scrambler 1030 uses the entropy to scramble the random number 125 and generate the scrambled random number 825. Figure 8 Compared to the example of FIG. 9 , the scrambled random number 825 may have improved entropy and therefore be a more random number (ie, having a more equal likelihood of each possible value, such as a closer to 50:50 likelihood of being 0 or 1).

[0131] In each of these examples, each scrambler within the scrambling circuit 1110 generates a scrambled output signal using two input signals. However, in an alternative, at least one scrambler may use three or more inputs to generate a scrambled output (e.g., it may be a 3+ input XOR or XNOR gate, or have the functionality of a 3+ input XOR gate or XNOR gate). For example, considering Fig.11 In an implementation, a single three-input scrambler may be used instead of two scramblers, where the random number 125, the first jitter signal 10151 and the second jitter signal 10152 are used to generate the scrambled random number.

[0132] Reference to the above Figures 8 to 12 Using a scrambling circuit in any of the described ways, as well as in any other ways described below, may be beneficial in hiding the power signature of the random number generation device 100, thereby reducing the opportunity for a malicious external party to learn the operation of the device from external operation. This can reduce the chance of the generated random number being leaked by a malicious external party. In addition, scrambling causes the scrambled random number 825 to have an increased entropy compared to the random number 125. Therefore, if there is any residual bias in the random number 125 such that the output does not have a 50:50 chance of 0 or 1, the bias should be reduced or eliminated in the scrambled random number 825 so that the scrambled random number that is ultimately generated and output has a probability that is closer to 50:50 (0 or 1). The random number generation device 100 can then output the scrambled random number 825 to any device / entity that requires a random number. The random number 125 is scrambled using an intermediate jitter signal, such as Figures 10 to 12 As shown in any one of the above, the entropy of the scrambled random number 825 can be further improved, thereby further improving its randomness.

[0133] Fig.13 The system includes a plurality of random number generators 102. nIn this example, there are N random number generators, numbered 1021 to 102 N Each random number generator 102 n The device also includes a multi-bit random number unit 1310, which receives the random number generated by the random number generator 102. n The generated random number is 125 n The multi-bit random number unit 1310 may be implemented in any suitable manner to perform the functions described below, such as in hardware such as fixed circuits or logic, or in software executed on one or more processors such as a microprocessor or microcontroller.

[0134] The multi-bit random number generator 1310 may be configured to generate a random number based on the received random number 125. n At least some of the random numbers 1315 are generated by using a plurality of different random number generators 102 n The generated random number is 125 n To generate the multi-bit random number 1315, the entropy of the multi-bit random number 1315 can be increased, thereby reducing or eliminating any random number 125 from the multi-bit random number 1315. n any systematic deviations in the

[0135] The multi-bit random number generator 1310 can generate the multi-bit random number 1315 in a number of different ways. For example, it can simply concatenate at least some of the received random numbers 125 n In this case, each time a new multi-digit random number 1315 is generated, the newly generated random number 125 n The random numbers 125 may always be connected in the same order, or the order may change for each new multi-digit random number 1315. In another example, the random numbers 125 received may be connected in the same order. n A more complex operation is performed to generate a multi-bit random number 1315, such as XOR or hashing, etc. In one example, only some of the received random numbers 125 n Can be used to generate multi-bit random numbers 1315 and optionally change which random number 125 is used for each new multi-bit random number 1315 n . In the cascade order changes and / or random number 125 n Where contributions to the multi-bit random number 1315 vary, these variations may be random or pseudo-random. For example, one or more random number generators 125 n The output of may not be used for the multi-bit random number 1315, but may be used to randomize the variations.

[0136] In some examples, the multi-bit random number 1315 can be selected from a set of random numbers 102n In another example, the multi-bit random number generator 1310 may store random numbers 102 over time. n The values ​​of at least some of the random numbers in the random number generator 1310 are then used to generate the multi-bit random number 1315. In this way, the length of the multi-bit random number 1315 can be longer than the random number generator 102 output by the multi-bit random number generator 1310. n The number is long.

[0137] At least some random number generator 102 n Can be operated in parallel so that they each generate a new random number 125 at the same time n For example, this can increase the speed of generating the multi-bit random number 1315 compared to using a single random number generator to generate the multi-bit random number 1315. In addition, it can be used to disguise the random number generator 102 n The power characteristics and / or current footprint of device 100 are used to improve the security of device 100, thereby reducing the possibility of side channel attacks that may compromise the random numbers generated and output by device 100.

[0138] exist Fig.13 In the example of FIG. 1 , the multi-bit random number generator 1310 uses a plurality of random numbers 125 n Generate a multi-digit random number 1315.

[0139] However, in an alternative scheme, a scrambling circuit may be used to scramble the random number 125. n Scrambling is performed, and the multi-bit random number generator 1310 generates a multi-bit random number 1315 using the scrambled random number.

[0140] Figures 14A to 14D Shows the number of random numbers 125 n Scramble and generate multiple scrambled random numbers 825 n In this example, there are multiple scramblers 1420 n , each scrambler is configured to encrypt the corresponding random number 125 n In this example, the random number generator 102 n The apparatus 100 further includes a plurality of jitter generators 1005 (four in this example, but may be any number, such as one, two, three, five, etc.), which are configured to output a jitter signal 1015. The jitter generator 1005 also serves as a random number generator 102. n Parts of the row are included, although they are not necessarily random number generators. For example, random number generator 102 nand jitter generator 1005 can be implemented in the same integrated circuit (IC) and arranged in a row in space, such as Figures 14A to 14D It should be clear that in this example (as in all scrambling examples disclosed herein), the random number generator 102 n The jitter generator 1005 may be implemented in any manner known to those skilled in the art, including (but not limited to) those described herein with reference to Figure 1 To the manner described in Figure 7.

[0141] The device 100 is configured such that the first jitter signal 1015 A Used by multiple scramblers 1420 to scramble their respective random numbers 125, where the random number generators 102 that generate these random numbers 125 are spatially separated (i.e., they are in the random number generator 102 n The random numbers 1251, 1255, 1259, etc. are not spatially adjacent to each other in the rows / columns of FIG. 14201, such that there is at least one other random number generator 102 between them in the rows / columns. For example, the random numbers 1251, 1255, 1259, etc. are generated by the scramblers 14201, 14205, 14209, etc. using the first jitter signal 1015. A Similarly, if Fig. 14B As shown, the second jitter signal 1015 B is used by other scramblers 1420 to scramble their respective random numbers 125, wherein the random number generator 102 that generates these random numbers 125 n are spatially separated (i.e., they are in the random number generator 102 n For example, the random numbers 1252, 1256, 125 1- etc. by scramblers 14202, 14206, 1420 10 etc. using the second jitter signal 1015 B Similarly, if Fig. 14C As shown, the third jitter signal 1015 C He Ru Fig.14D The fourth jitter signal 1015 is shown D The same is true.

[0142] In addition, the jitter generator 1005 occupies the same row as the random number generator 102. n At spatially non-adjacent locations, the output of the random number generator is scrambled using a dither signal generated by a dither generator.

[0143] Performing scrambling using signals generated by cells / elements that are not adjacent to each other in a row can help improve the scrambled random number 825 NFor example, there may be a manufacturing defect in one area of ​​the IC, which may cause a deviation in the random numbers generated in that area. By scrambling with random numbers / signals generated in non-adjacent locations in the row, and thus generated in different areas of the IC, any deviation caused by defects in a particular part of the IC should be reduced or eliminated. Additionally or alternatively, the correlation between the dithering signal and the random numbers scrambled by the dithering signal should be reduced or eliminated, but this is due to reducing / preventing capacitive coupling between the unit / element generating the dithering signal and the random numbers.

[0144] Figures 14A-14D shows a straightforward form of scrambling, similar to Figure 8 and Figure 9. However, in another case, a method similar to that described above can be used. Figures 10 to 12 A more complex scrambling of the example described.

[0145] Fig.15 An example is shown in which the scrambling circuit 1510 includes an intermediate scrambling circuit 1520 (which will include one or more intermediate scramblers 1020, each of which may have two or more sub-inputs and use these two or more sub-inputs to generate their intermediate dithered signals) and multiple final scramblers 1420 N The intermediate scrambling circuit 1520 is configured to receive a plurality of dithering signals 1015 (in this example, four dithering signals 1015 A to 1015 D , although it may be any other number), and generates one or more intermediate jitter signals 1515 (in this example, four intermediate jitter signals 1515 A To 1515 D , although it could be any other number). The intermediate dithered signal 1515 can then be processed by the final scrambler 1420 N 14 is used in the same manner as the scrambler 1420 of FIG. N Use the jitter signal 1015 A to 1015 D in the same manner (i.e., spatially adjacent random number generators 102 can have their random numbers 125 scrambled by different intermediate jitter signals 1515, or in other words, each intermediate jitter signal 1515 can be used to scramble two or more random numbers 125 output by spatially non-adjacent random number generators 102). Fig.15 shows that the fourth intermediate jitter signal 1515 can be used D Example way, this is the same as Fig.14D The fourth jitter signal 1015 is used D It should be understood that the other intermediate jitter signal 1515 can be in the same manner as Figures 14A to 14CThe dither signals shown in are used in the same way and are not shown in the drawings merely for the sake of clarity and simplicity.

[0146] The intermediate scrambling circuit 1520 can perform a one-step scrambling to generate the intermediate dithered signal 1515, similar to Fig.11 , or perform multi-step scrambling, similar to Table 12. For example, in an intermediate step scrambling implementation (similar to Fig.11 ), the first intermediate jitter signal 1515 A The first jitter signal 1015 may be used by the first intermediate scrambler A and the second jitter signal 1015 B To generate the second jitter signal 1515 B The second dithered signal 1015 may be used by the second intermediate scrambler B and the third jitter signal 1015 C Generate a third jitter signal 1515 C The third dithered signal 1015 may be used by the third intermediate scrambler C and the fourth jitter signal 1015 D Generate a fourth jitter signal 1515 D The fourth dithered signal 1015 may be used by the fourth intermediate scrambler D and the first jitter signal 1015 A Additionally or alternatively, the intermediate scrambling circuit 1520 may include one or more scramblers having 3+ inputs, for example, to generate the intermediate dithered signal based on at least three dithered signals 1015. Regardless of the number of scrambling steps taken by the intermediate scrambling circuit 1520 to generate the intermediate dithered signal 1515, the scrambler 1420 N As each random number 125 N The final scrambler is therefore performed with Fig.11 and Fig.12 The final scrambler 1030 in FIG.

[0147] Fig.16 Shows the use of the above reference Figure 8 to Figure 1 4. In step S1410, a first random number is generated. In step S1420, a scrambled random number is generated based on the first random number and a first jitter signal, wherein the first jitter signal is a random value signal or a pseudo-random value signal.

[0148] It will be easily understood by those skilled in the art that various changes or modifications may be made to the above-mentioned aspects of the present disclosure without departing from the scope of the present disclosure.

[0149] The term "coupling" as used herein includes both a direct electrical connection between two components and an indirect electrical connection, in which two components are electrically connected to each other through one or more intermediate components. For example, in each of the above examples, the buffered voltage output 115 of each noise generator 110 is directly connected to the determination unit 120. However, in an alternative, the buffered voltage output 115 of each noise generator 110 can first pass through one or more amplifiers so that the signal received at the input of the determination unit 120 (e.g., received by the sampling circuit at the input of the determination unit 120) is an amplified version of the buffered voltage 115 output by the noise generator 110.

[0150] Although not shown in the figure, Figure 6 and Figures 7A to 7E The differential implementation of may optionally include means (e.g., a chopping circuit, a shuffling circuit, or a multiplexer, etc.) for exchanging the coupling of the noise generator with the determination unit 120. In this way, the coupling of the two noise generators 1101 and 1102 with the positive input and the negative input of the determination unit 120 may be periodically or intermittently exchanged. For example, in Figure 7C In the arrangement, the first noise generator 1101 is coupled to the positive input terminal and the second noise generator 1102 is coupled to the negative input terminal. If a device for switching is included, the device can be used periodically or intermittently to switch the coupling so that the first noise generator 1101 is coupled to the negative input and the second noise generator 1102 is coupled to the positive input. There may be many reasons for doing this. In one example, after the device is used to generate a random number (e.g., 0 or 1), the switching device can be used to switch the input before the circuit is used to generate the next random number. Once the random number is generated, the switching device can be used to switch the input back before the circuit is used to generate the next random number, etc. By alternating in this way, if there is any residual bias in the signal 115 output by the noise generator 110, its effect can be reduced or eliminated on the multiple random numbers generated. This is because of the generated random numbers, about half will be based on the deviation in one direction, and about half will be based on the inverse of the deviation (i.e., the deviation in the other direction), thereby reducing or eliminating the deviation on average. This may be particularly effective in the case where multiple consecutively generated random numbers are combined together to form a multi-bit random number. While in this example the coupling is swapped on alternating random numbers, it could be swapped with any other frequency, resulting in approximately half of a set of generated random numbers having one coupling and the other half having the other coupling (e.g., swapping after every two or three etc. random numbers).

[0151] In each of the example implementations of the noise generator circuit 110 described above, the capacitor 320 that generates kTC noise is represented as a separate component. However, in an alternative, the capacitor in the noise generator circuit 110 can be a parasitic capacitance at any junction, gate, or metal overlap of the buffer in the noise generator circuit 110. Therefore, the noise generator circuit 110 does not necessarily include an explicit capacitor component, but can include a buffer with parasitic capacitance that effectively forms a capacitor. This may have the advantage that the capacitor 320 has a very small capacitance (because parasitic capacitance tends to be very small), which contributes to the generation of kTC noise without the need to include a capacitor component in the noise generator circuit 110.

[0152] Public Aspects

[0153] Some non-limiting aspects of the present disclosure are listed in the following numbered clauses:

[0154] 1. A device for generating a scrambled random number, the device comprising:

[0155] a first random number generator configured to generate a first random number; a scrambling circuit configured to receive the first random number and a first jitter signal, and generate a scrambled random number based on the first random number and the first jitter signal,

[0156] The first jitter signal is a random value signal or a pseudo-random value signal.

[0157] 2. A device according to clause 1, wherein the scrambling circuit is configured to set the scrambling random number to a value equal to the first random number when the first jitter signal is a first value, and to set the scrambling random number to a value different from the first random number when the first jitter signal is a second value.

[0158] 3. The apparatus of clause 2, wherein when the first dithering signal is the second value, the scrambled random number is set to the inverse of the first random number.

[0159] 4. The apparatus according to any one of clauses 1 to 3, further comprising:

[0160] The first jitter generator is used to generate the first jitter signal.

[0161] 5. The apparatus of clause 4, wherein the first jitter generator comprises a further random number generator configured to generate a further random number, wherein the first jitter generator is configured to generate the first jitter signal using the further random number.

[0162] 6. The apparatus of clause 5, wherein the first jitter generator further comprises a first pseudo-random number generator configured to generate the first jitter signal using the further random number as a seed, wherein the first jitter signal is a pseudo-random number output by the first pseudo-random number generator.

[0163] 7. The apparatus of clause 5, wherein the first dither generator further comprises an entropy correction circuit configured to generate the first dither signal based on the further random number.

[0164] 8. The apparatus of clause 7, wherein the entropy correction circuit is a von Neumann corrector.

[0165] 9. The apparatus according to any one of clauses 1 to 8, further comprising:

[0166] a plurality of random number generators, including the first random number generator, wherein the plurality of random number generators are configured to generate a corresponding plurality of random numbers; and

[0167] A first jitter generator is configured to generate the first jitter signal, and wherein the scrambling circuit is configured to receive the plurality of random numbers and the first jitter signal, and generate a corresponding plurality of scrambled random numbers using the plurality of random numbers and the first jitter signal.

[0168] 10. The apparatus of clause 9, wherein the plurality of random number generators and the first jitter generator are implemented in an integrated chip and are spatially arranged in a row.

[0169] 11. The apparatus of clause 10, wherein the scrambling circuit is configured to scramble at least two of the plurality of random numbers using the first dithering signal, wherein the at least two random numbers are generated by two random number generators that are not spatially adjacent in a row.

[0170] 12. The apparatus of clause 11, wherein the first jitter generator occupies a position in the row that is not spatially adjacent to the two random number generators that generate the at least two random numbers.

[0171] 13. The apparatus according to any one of clauses 9 to 12, further comprising:

[0172] a second jitter generator configured to generate a second jitter signal, wherein the scrambling circuit is configured to receive the second jitter information and generate a first set of scrambled random numbers using a first set of random numbers and the first jitter signal, and generate a second set of scrambled random numbers using a second set of random numbers and the second jitter signal, wherein the plurality of random numbers include the first set of random numbers and the second set of random numbers, and

[0173] The plurality of scrambled random numbers include the first group of scrambled random numbers and the second group of scrambled random numbers.

[0174] 14. An apparatus according to any of clauses 1 to 13, wherein the scrambling circuit is further configured to:

[0175] receiving one or more additional dithered signals; and

[0176] The scrambled random number is generated based on the first random number, the first dithering signal and the one or more further dithering signals.

[0177] 15. The apparatus of clause 14, wherein the scrambling circuit is configured to:

[0178] generating an intermediate dithered signal using the first dithered signal and the one or more further dithered signals; and

[0179] A scrambled random number is generated using the first random number and the scrambled dither signal.

Claims

1. A random number generating device, comprising a first random number generator, wherein the first random number generator comprises: A first noise generator circuit comprising: A first capacitor for generating kTC noise; and a first buffer coupled to the first capacitor to buffer a capacitor voltage including kTC noise generated by the first capacitor and output a buffered voltage; and Determine the unit, which is configured as: reading a first buffered voltage from the output of the first buffer, wherein the first buffered voltage is a buffered version of a first capacitor voltage including first kTC noise generated by the first capacitor at a first time; and reading a second buffered voltage from the output of the first buffer, wherein the second buffered voltage is a buffered version of a second capacitor voltage including second kTC noise generated by the first capacitor at a second time, Wherein the random number generating device is configured to generate a random number based on the first buffer voltage and the second buffer voltage.

2. The random number generation device according to claim 1, wherein the noise generator circuit further comprises: A first switch is coupled to the first capacitor to form a first switched capacitor arrangement such that changing the state of the first capacitor from closed to open generates a capacitor voltage at the first capacitor that includes kTC noise. 3 . The random number generating device according to claim 1 , wherein the first buffer is configured to apply a gain to the capacitor voltage to generate the buffered voltage.

4. The random number generating device according to any one of the preceding claims, wherein the determining unit comprises: The sampling circuit is configured to sample the first buffer voltage. 5 . The random number generation device of claim 4 , wherein the sampling circuit comprises an amplifier, the amplifier comprises at least one capacitor, wherein the sampling circuit is configured to sample the first buffer voltage using the at least one capacitor. The random number generating device according to claim 5 , wherein the amplifier is an auto-zero amplifier.

7. The random number generating device according to any one of claims 4 to 6, wherein the determining unit comprises: A comparator is configured to compare the sampled first buffer voltage with the second buffer voltage, wherein the generation of the random number is based on an output of the comparator.

8. The random number generating device according to any one of the preceding claims, wherein the first random number generator further comprises: A second noise generator circuit comprising: A second capacitor for generating kTC noise; and a second buffer coupled to the second capacitor to buffer a capacitor voltage including kTC noise generated by the second capacitor and output a buffered voltage; The determining unit is further configured to: reading a third buffered voltage from an output of the second buffer, wherein the third buffered voltage is a buffered version of a third capacitor voltage, the third capacitor voltage includes third kTC noise generated by the second capacitor at the first time, and wherein the first buffered voltage and the third buffered voltage together form a first differential signal; and reading a fourth buffered voltage from an output of the second buffer, wherein the fourth buffered voltage is a buffered version of a fourth capacitor voltage, the fourth capacitor voltage includes fourth kTC noise generated by the second capacitor at the second time, and wherein the second buffered voltage and the fourth buffered voltage together form a second differential signal, Wherein the random number generating device is configured to generate a random number based on the first differential signal and the second differential signal.

9. The random number generating device according to claim 8, wherein the determining unit comprises: The auto-zero differential sampling circuit is configured to sample the first differential signal. 10 . The random number generation device according to claim 9 , wherein the determination unit is configured to generate the random number based on determining a difference between the second differential signal and the sampled first differential signal.

11. A random number generating device according to any one of the preceding claims, wherein the random number generating device further comprises a scrambling circuit, the scrambling circuit being configured to receive the random number generated by the first random number generator and a jitter signal which is a random value signal or a pseudo-random value signal, and wherein the scrambling circuit is configured to generate a scrambled random number based on the jitter signal and the random number generated by the first random number generator.

12. The random number generating device according to claim 11, wherein the scrambling circuit is configured to set the scrambled random number equal to the random number generated by the first random number generator when the jitter signal is a first value, and to set the scrambled random number to a value different from the random number generated by the first random number generator when the jitter signal is a second value. 13 . The random number generating device according to claim 12 , wherein when the dither signal is a second value, the scrambled random number is set to a reciprocal of the random number generated by the first random number generator.

14. A method of generating a random number, the method comprising a first noise generator circuit, comprising: generating a first buffered voltage output from a buffer, wherein the first buffered voltage includes a first kTC noise generated by a capacitor at a first time; generating a second buffered voltage output from the buffer, wherein the second buffered voltage includes a second kTC noise generated by the capacitor at a second time; and A random number is generated based on the first buffer voltage and the second buffer voltage.

15. A device for generating a scrambled random number, the device comprising: A first random number generator configured to generate a first random number; a scrambling circuit configured to receive the first random number and a first jitter signal, and generate a scrambled random number based on the first random number and the first jitter signal, The first jitter signal is a random value signal or a pseudo-random value signal.

16. The device of claim 15 , wherein the scrambling circuit is configured to, when the first jitter signal is a first value, set the scrambled random number to a value equal to the first random number, and when the first jitter signal is a second value, set the scrambled random number to a value different from the first random number.

17. The device according to claim 15 or 16, further comprising: A first jitter generator, configured to generate the first jitter signal, wherein the first jitter generator comprises a further random number generator configured to generate a further random number, and Wherein the first jitter generator is configured to generate the first jitter signal using the further random number.

18. The apparatus of claim 17, wherein the first dither generator further comprises an entropy correction circuit configured to generate the first dither signal based on the further random number.

19. The apparatus according to any one of claims 15 to 18, further comprising: a plurality of random number generators, including said first random number generator; wherein the plurality of random number generators are configured to generate a corresponding plurality of random numbers; and A first jitter generator is configured to generate the first jitter signal, and wherein the scrambling circuit is configured to receive the plurality of random numbers and the first jitter signal, and generate a corresponding plurality of scrambled random numbers using the plurality of random numbers and the first jitter signal.

20. The device of claim 19, wherein a plurality of random number generators and the first jitter generator are implemented in an integrated chip and are spatially arranged in rows / columns, and wherein the scrambling circuit is configured to scramble at least two random numbers of the plurality of random numbers using the first jitter signal, and wherein the at least two random numbers are generated by two random numbers; Generators that are not spatially adjacent in the row.

Images