DEVICE AND METHOD FOR CONFIGURING A RANDOM NUMBER GENERATOR AND METHOD FOR GENERATING RANDOM NUMBERS

Abstract

According to one embodiment, a data processing device is provided, comprising a setting device configured to specify a number of multi-bit output symbols from a random symbol source to be used for generating a single random number, a determination device configured to determine, for each possible sequence of multi-bit output symbols from the random symbol source of the specified number, a probability that the random symbol source outputs the sequence, using predetermined transition probabilities between two or more output symbols from the random symbol source, and a grouping device configured to group the possible sequences of output symbols from the random symbol source into groups according to the criterion that the total probabilities of the groups are as equal as possible, wherein for each group the total probability is the sum of the determined probabilities.that the random symbol source outputs the sequences belonging to the group, is determined, and an assignment device is set up to assign a random number to each group as a random number to be output by the random number generator for the sequences of random symbols belonging to the group.

Description

[0001] Examples of embodiments generally relate to devices and methods for configuring a random number generator and methods for generating random numbers.

[0002] Random numbers are used in data processing devices for various applications. Typically, it is important that these random numbers have high entropy. This can be achieved by post-processing random symbols, such as those supplied by a random symbol source or "noise source," by combining several random symbols and processing them into a single random number, thereby "condensing" the entropy. Effective and efficiently implementable approaches for this are desirable.

[0003] According to one embodiment, a data processing device is provided, comprising a setting device configured to specify a number of multi-bit output symbols from a random symbol source to be used for generating a single random number, a determination device configured to determine, for each possible sequence of multi-bit output symbols from the random symbol source of the specified number, a probability that the random symbol source outputs the sequence, using predetermined transition probabilities between two or more output symbols from the random symbol source, and a grouping device configured to group the possible sequences of output symbols from the random symbol source into groups according to the criterion that the total probabilities of the groups are as equal as possible, wherein for each group the total probability is the sum of the determined probabilities.that the random symbol source outputs the sequences belonging to the group, is determined, and an assignment device is set up to assign a random number to each group as a random number to be output by the random number generator for the sequences of random symbols belonging to the group.

[0004] According to a further embodiment, a method for configuring a random number generator is provided, comprising specifying a number of multi-bit output symbols of a random symbol source to be used for generating a single random number, determining, for each possible sequence of multi-bit output symbols of the random symbol source of the specified number, a probability that the random symbol source outputs the sequence, using predetermined transition probabilities between two or more output symbols of the random symbol source, grouping the possible sequences of output symbols of the random symbol source into groups according to the criterion that the total probabilities of the groups are as equal as possible, wherein for each group the total probability is determined as the sum of the determined probabilities that the random symbol source outputs the sequences belonging to the group.and assigning a random number to each group as a random number to be output by the random number generator for the sequences of random symbols belonging to the group.

[0005] The figures do not represent the actual proportions but are intended to illustrate the principles of the various embodiments. Several embodiments are described below with reference to the following figures. Fig. Figure 1 shows an example of a data processing device. Fig. Figure 2 shows a hardware implementation of a compression function according to one embodiment. Fig. Figure 3 shows a flowchart illustrating a procedure for configuring a random number generator according to one embodiment.

[0006] The following detailed description refers to the accompanying figures, which show details and embodiments. These embodiments are described in sufficient detail to enable a person skilled in the art to carry out the invention. Other embodiments are also possible, and the embodiments can be modified in structural, logical, and electrical terms without deviating from the subject matter of the invention. The various embodiments are not necessarily mutually exclusive; rather, different embodiments can be combined to create new embodiments. Within the scope of this description, the terms "connected," "connected," and "coupled" are used to describe both direct and indirect connections, direct or indirect connections, and direct or indirect couplings.

[0007] Fig. Figure 1 shows an example of a data processing device 100 with a main processor (CPU) 101, a RAM (Random Access Memory) 102, a non-volatile memory 103 (NVM), and a noise source (or “random (symbol) source”) 104 as a basis for generating random numbers, which are then used, for example, by the CPU 101, e.g., for a cryptographic algorithm or protective measures for such an algorithm, e.g., for generating masks to protect against side-channel attacks.

[0008] A true random number generator (TRNG) typically consists of a physical noise source (NS) 104, which generates noise data (or raw data) 106, and a downstream mathematical post-processing stage, which compresses the generated raw data 106 and thus increases the per-bit entropy of the generated random numbers 107 (compared to the raw data) (i.e., the post-processed random numbers contain more entropy per bit than the raw data).

[0009] Post-processing can be implemented in software. For example, Fig. 1. This is performed by a coprocessor 105, which is specifically designed for this purpose. However, it can also be performed by the CPU 101 itself. The program code for post-processing 103 is stored, for example, in the NVM 103 and is loaded into the main memory 102 for execution.

[0010] The data processing device 100 can be any type of data processing device with at least one programmable processor, such as a computer or a smartphone, a chip card (of any form factor) or a control device (e.g. with a microcontroller) that is used, for example, in a vehicle.

[0011] We now consider a random number generator that outputs one symbol per unit of time (e.g., per clock cycle of CPU 101). The symbols are elements of a finite set M with cardinality |M| = n ≥ 2. These output symbols are usually represented by integers 1, 2, ..., n or by 0, 1, ..., n - 1. Therefore, when referring to both the random number generator and the noise source, the output symbols of the random number generator (to be configured or implemented) will also be called output random numbers (to avoid confusion with the symbols output by the noise source 104). However, a random number (output by the random number generator) can generally be understood as a random symbol (which is typically represented as a bit sequence and thus as a (binary) number). Furthermore, the symbols are sometimes shown in bold in the following text to avoid confusion with the binary numbers 0 and 1.

[0012] In an ideal random number generator, the output symbols are generated independently of each other and with the same probability (this corresponds to 100% entropy). For a real random number generator, both properties are generally violated. That is, the individual symbols are generated with different probabilities. Furthermore, the probability of a symbol appearing (as an output of the random number generator) depends on the values ​​of the symbols previously generated by the random number generator (memory effect).

[0013] The sequence of random variables X1, X2, X3, ..., X t , X t+1 , ..., which represents the sequence of symbols output by the random number generator, defines a stochastic process.

[0014] An important special case arises when the probability Pr(X t+1= j) for the occurrence of the symbol j at time t + 1 is completely determined by the symbol that occurred immediately before it. (All symbols that occurred even earlier can be ignored.) This special case of a stochastic process is called a Markov process. The sequence X1, X2, X3, ... is then called a Markov chain.

[0015] Formally speaking: A stationary (i.e., time-independent) stochastic process X1, X2, X3, ... forms a Markov chain if Pr(Xt+1=j|Xt=i,Xt−1=it−1,...,X2=i2,X1=i1)=Pr(Xt+1=j|Xt=i) for all possible symbols i, j; i1, i2, ... i t-1 ∈ M and for all time points t.

[0016] The probability Pij=Pr(Xt+1=j|Xt=i) This is called the transition probability from state i to state j. (It should be noted that in a stationary process assumed here (i.e., the random number generator does not change its properties over time), the time t is irrelevant: For all values ​​t = 1, 2, ... in the formula above, the same probability P results.) ij .) The property of stationarity is generally fulfilled, namely when the random number generator maintains its statistical behavior over time.

[0017] A stationary Markov process (over an n-element set) is completely defined by the n × n matrix P=(Pij) all transition probabilities P ij defined.

[0018] Example 1a: Let n = 4 and M = {0, 1, 2, 3}. Then the matrix defines P=(P00P01P02P03P10P11P12P13P20P21P22P23P30P31P32P33)=(01001904949112141313112141313) a Markov process.

[0019] The stationary distribution µ of a stationary Markov process is the sequence of probabilities with which the individual symbols occur (over time). The entropy rate R of the stationary Markov process is the average entropy of an output symbol.

[0020] Both quantities, the stationary probability distribution µ and the entropy rate R, can be calculated using the matrix P of transition probabilities.

[0021] Example 1b (continuation of Example 1a): The stationary probability distribution µ = (µ0, µ1, µ2, µ3) is obtained by solving the linear system of equations μP=μ with the constraint µ0 + µ1 + µ2 + µ3 = 1. For the matrix P above (from Example 1a) we obtain μ0=112, μ1=14 and μ2=μ3=13. That is, the symbol 0 occurs with a probability of 1 / 12. The symbol 1 occurs with a probability of 1 / 4. And the symbols 2 and 3 each occur with a probability of 1 / 3.

[0022] The entropy rate R of the Markov process under consideration is given by the formula R=−∑i=0n−1μi∑j=0n−1Pij log2Pij=1.585.

[0023] Since n = 4, meaning there are four possible output symbols, the output symbols of an ideal random number generator would have an entropy of 2 (per symbol). In this case, the entropy rate would also be equal to 2.

[0024] The following statement is used in the following. Theorem 1: Let (a, b, ..., c, d) be an arbitrary sequence of r symbols of a stationary Markov chain X1, X2, .... Then for all t = 1, 2, ... Pr(Xt=a,Xt+1=b,...,Xt+r−2=c,Xt+r−1=d)=Pr(Xt=a)⋅Pr(Xt+1=b|Xt=a)⋯Pr(Xt+r−1=d|Xt+r−2=c).

[0025] The probability Pr(Xt = a) can be taken from the stationary probability distribution. The remaining probabilities can be taken from the matrix P of transition probabilities.

[0026] The following describes a (entropy-compacting) post-processing procedure that is used according to various embodiments for a Markov-type noise source 104.

[0027] An increase in per-symbol entropy (i.e., entropy densification) is only possible through data compression. Let r be the chosen (fixed) compression rate. That is, from each set of r ≥ 2 output symbols σ1, σ2, ..., σ r ∈ M of the noise source, a single random number σ (which is the processed symbol, i.e., the output of the random number generator) is obtained through post-processing. The r symbols σ1, ..., σ rare multi-bit symbols, meaning they consist of or correspond to multiple bits each, and represent the input of the post-processing algorithm ψ, and the random number σ its output. Since all symbols (σ1, σ2, ..., σ) r If both σ and ρ belong to the n-element set M in this example, then ψ (in this example, the general case where σ is from a different set than σ1, σ2, ..., σ) is the general case where σ is from a different set than σ1, σ2, ..., σ r (but it is also possible) a mapping from the set M r into the set M. ψ:(σ1,⋯,σr)∈Mr↦σ∈M.

[0028] Compression functions used for entropy compression are usually balanced functions. Balanced functions have the property that for every σ ∈ M, there are the same number of r-tuples (σ1, ..., σ). r ) ∈ M r There exist that are mapped to the element σ by the function. In other words, each of the n possible output random numbers σ from M has exactly n r-1 Archetypes in Mr .

[0029] Furthermore, compression functions commonly used for entropy compression are mostly linear. Nonsingular linear feedback shift registers and maximum-rank binary matrices are, for example, frequently used linear compression functions. However, a detailed analysis shows that in the case of Markov chains, more entropy can be extracted from the raw data of the noise source using suitable unbalanced and nonlinear compression functions.

[0030] Therefore, according to various embodiments, a nonlinear and unbalanced compression algorithm is used for post-processing output symbols of a noise source of the Markov chain type (i.e., a post-processing algorithm), as described below.

[0031] Post-processing algorithm: 1. Consider all n r possible r-tuple (σ1, ..., σ r ) ∈ M rCalculate the probability that each of these r-tuples is produced by the noise source in r steps. (The noise source outputs one symbol per unit of time (approximately per CPU clock cycle). Thus, an r-tuple is generated in r clock cycles.) The formula from Theorem 1 is used to calculate the probability of occurrence for a specific r-tuple. 2. Divide the set of all r-tuples (σ1, ..., σ) r ) ∈ M r in n pairwise disjoint classes K0, K1, ..., K n-1 A group (i.e., group the (possible) sequences of random symbols that can be output by the noise source). This is done (i.e., according to the criterion) such that the sum of the probabilities of all r-tuples in a class comes as close as possible to the ideal value 1 / n (i.e., they are as equal as possible). The n classes (or "groups") thus have the following properties. ◯ K0 ∪ K1 ∪ ... ∪ K n-1 = M r ; ◯ Ki ∩ = ∅ for 0 ≤ i < j ≤ n-1; ◯ |K0| + |K1| + ... + lK n-1 | = n r . and for all i = 0, 1, ... n - 1, the following holds: ∑(σ1,...,σr)∈Kiμσ1Pσ1σ2Pσ2σ3⋯Pσr−1σr≈1n. 3. The compression function ψ: M r → M is defined as follows: Assign the class number as a function value (as a random number to be output for sequences from this class) to all r-tuples of a class. That is, set ψ((σ1,...,σr))=σ⇔(σ1,...,σr)∈Kσ for σ=0,1,...,n−1.

[0032] Example 1c (continuation of Examples 1a and 1b): M = {0, 1, 2, 3}. Compression ratio r = 2. From Theorem 1 it follows that: The 2-tuple (a, b) ∈ M 2 occurs with the probability Pr(Xt=a)⋅Pr(Xt+1=b|Xt=a)=μaPab on, where µ a the probability distribution µ calculated in Example 1b = (µ0,µ1,µ2,µ3) is taken and P ab the matrix P provided in Example 1a.

[0033] Table 1 lists the 16 possible pairs (a, b) with their corresponding probabilities of occurrence for each pair. Based on these probabilities, the function value ψ(a, b) of the compression function ψ was chosen such that each output random number occurs with the same probability. Table 1: Definition of the compression function ψ a b µ a P ab ψ(a, b) 0 0 112⋅0=0 0 0 1 112⋅1=112 0 0 2 112⋅0=0 0 0 3 112⋅0=0 0 1 0 14⋅19=136 1 1 1 14⋅0=0 0 1 2 14⋅49=19 1 1 3 14⋅49=19 1 2 0 13⋅112=136 2 2 1 13⋅14=112 0 2 2 13⋅13=19 2 2 3 13⋅13=19 2 3 0 13⋅112=136 3 3 1 13⋅14=112 0 3 2 13⋅13=19 3 3 3 13⋅13=19 3

[0034] It applies Pr(ψ(a,b)=0)= Pr((a,b)=(0,0))+Pr((a,b)=(0,1)) +Pr((a,b)=(0,2))+Pr((a,b)=(0,3)) +Pr((a,b)=(1,1))+Pr((a,b)=(2,1)) +Pr((a,b)=(3,1))=0+112+0+0+0+112+112=14; Pr(ψ(a,b)=1)= Pr((a,b)=(1,0))+Pr((a,b)=(1,2)) +Pr((a,b)=(1,3))=136+19+19=14.

[0035] Likewise, one obtains Pr(ψ(a,b)=2)=14 and Pr(ψ(a,b)=3)=14.

[0036] The underlying class classification of M 2 = {0, 1, 2, 3} × {0, 1, 2, 3} is here K0={(0,0), (0,1), (0,2), (0,3), (1,1), (2,1), (3,1)}; K1={(1,0),(1,2),(1,3)}; K2={(2,0),(2,2),(2,3)}; K3={(3,0),(3,2),(3,3)}.

[0037] It holds that |K0| = 7 and |K1| = |K2| = |K3| = 3. Therefore, the compression function ψ is unbalanced.

[0038] The number n of possible output symbols of noise source 104 is typically a power of two. That is, n = 2 m for an integer m ≥ 0. Powers of two are dominant in computer architectures. In the rare cases of noise sources whose symbol set M does not consist of 2 m If the element consists of elements, it can always be achieved by introducing dummy symbols (to which the probability of occurrence is assigned zero) that |M| = 2 m is.

[0039] Therefore, it is assumed in the following that n = |M| = 2 mThen each element σ of the symbol set M can be represented as an m-bitword or, equivalently, as a binary row vector of length m.

[0040] The table of values ​​for the compression function ψ: M r → M is a list of all n r possible input tuple (σ1, ..., σ r ) with the assigned output random numbers σ. By replacing all symbols in the list with m-bit words, a binary version of the table is obtained. This (binary version of the) table contains on the left side (the input side) all binary row vectors of length mr. On the right side of the table (the output side) are the associated function values ​​of the compression function ψ, represented as binary row vectors of length m.

[0041] For each row of the (binary version of the) table: The m-bit long (output) row vector on the right-hand side is a function of mr binary coordinates of the input vector on the left-hand side of the row. Since the output (row) vector on the right-hand side has m coordinates, each of these coordinates is a Boolean function ψ. j the aforementioned mr binary coordinates of the input vector. That is, ψ=(ψ1,…,ψm) with m Boolean functions in mr binary variables. This representation provides the hardware implementation of the compression function ψ.

[0042] Alternatively, the table of values ​​for ψ can be stored in the respective data processing device (e.g., in the NVM 103). The post-processed, entropy-compressed value ψ(a, b) can then be determined (for a software implementation of the compression function ψ) by table lookup. Example 1d (continuation of Example 1c):

[0043] Table 1 from Example 1c is considered. To generate the binary version of this table, the symbol variable a is replaced by the binary variables w and x, and the symbol variable b is replaced by the binary variables y and z. Table 2 is a repetition of Table 1, but in addition to the symbol variables a and b, it also lists the binary variables w, x, y, and z. Table 2: Boolean components of the compression function ψ = (ψ1, ψ2) a b wxyz ψ(a, b) ψ1(w, x, y, z) ψ2(w, x, y, z) 0 0 0000 0 0 0 0 1 0001 0 0 0 0 2 0010 0 0 0 0 3 0011 0 0 0 1 0 0100 1 0 1 1 1 0101 0 0 0 1 2 0110 1 0 1 1 3 0111 1 0 1 2 0 1000 2 1 0 2 1 1001 0 0 0 2 2 1010 2 1 0 2 3 1011 2 1 0 3 0 1100 3 1 1 3 1 1101 0 0 0 3 2 1110 3 1 1 3 3 1111 3 1 1

[0044] The last two columns of Table 2 define the two Boolean functions ψ1 (w, x, y, z) and ψ2 (w, x, y, z), such that ψ(a,b)=(ψ1(w,x,y,z),ψ2(w,x,y,z)).

[0045] The two Boolean functions ψ1(w, x, y, z) and ψ2(w, x, y, z) are given as binary column vectors of length 16. The algebraic normal forms of the Boolean functions are determined from the column vectors as follows: 1. Each 1 in the column vector (of the respective Boolean function) yields a product term of four factors (for the Boolean function). The zeros in the column vector are ignored. 2. Each factor in the product term is either one of the variables w, x, y, z, or the binary complement of such a variable. (The binary complement of the variable u is written as ū and means ū = u + 1.) 3. The variable is binary complemented if and only if it represents a zero in the input vector. For example, the input vector 0110 yields the product term wxyz. 4. The sum of the product terms (for the respective Boolean function) is simplified.

[0046] Using this method, the Boolean functions ψ1 and ψ2 are obtained as polynomials in four variables from the last two columns of Table 2: ψ1(w,x,y,z)=wx¯yz¯+wx¯yz¯+wx¯yz+wxy¯z¯+wxyz¯+wxyz¯=wx¯z¯(y¯+y)+w yz(x¯+x)+wxz¯(y¯+y)=wx¯z¯+wyz+wxz¯=wz¯(x¯+x)+wyz=wz¯+wyz=w(z¯+yz) ψ2(w,x,y,z)=w¯xy¯z¯+w¯xyz¯+w¯xyz+wxy¯z¯+wxyz¯+wxyz=w¯xz¯(y¯+y)+xy z(w¯+w)+wxz¯(y¯+y)=w¯xz¯+xyz+wxz¯=wz¯(w¯+w)+xyz=wz¯+xyz=w(z¯+yz).

[0047] It should be noted that the above Boolean functions ψ1 and ψ2 are non-linear, since the variables w, x, y, z are not only added together, but also multiplied.

[0048] Fig. Figure 2 shows a hardware implementation of the post-processing defined by the Boolean functions ψ1(w, x, y, z) and ψ2(w, x, y, z) derived above.

[0049] A noise source 201 (e.g., corresponding to noise source 100) delivers the two output symbols a and b to a symbol buffer 202. The output symbols a and b correspond, for example, to the noise data 106 of Fig. 1. These are converted into their binary representation wxyz, which is stored in a digital buffer 203. A hardware entropy extractor 204 implements the Boolean functions ψ1 and ψ2 mentioned above. The two bits thus generated, ψ1(w, x, y, z) and ψ2(w, x, y, z), together form the output random number of the random number generator. They correspond, for example, to the random numbers 107 from Fig. 1.

[0050] An important property of the compression function ψ defined in Part 1: M r → M is that the entropy of the output symbols generated by the post-processing can be calculated exactly for them (r ≥ 2 is the compression rate, M is the set of output symbols).

[0051] The sequence X1, X2, X3,... of symbols emitted by the noise source, by assumption, forms a Markov chain with a known transition probability matrix P = (P ijThe sequence Y1, Y2, Y3, ... of the post-processed random symbols, given by Y1=ψ(X1,...,Xr), Y2=ψ(Xr+1,...,X2r), Y3=ψ(X2r+1,...,X3r),... This in turn forms a Markov chain. The transition probabilities Qij=Pr(Yt+1=j|Yt=i) of the Markov chain Y1, Y2, Y3, ... can be derived from the transition probabilities P ij and the known (design-induced) probabilities Pr(ψ(σ1,...,σ r ) = i) can be calculated. It holds that Qij=1Pr(ψ(σ1,..,σr)=i)∑((σ1,..,σr),(τ1,...,τr))∈Ki×Kjμσ1Pσ1σ2Pσ2σ3⋯ ⋯Pσr−1σrPσrτ1Pτ1τ2⋯Pτr−1τr.

[0052] From the transition probability matrix Q = (Q ij ) the entropy rate of the compressed symbol sequence Y1, Y2, Y3, ... can then be calculated.

[0053] Example 1e (continuation of the examples above): Consider Table 1 from Example 1c. The transition probability Q ijThe compressed symbol sequence ψ(a, b) is given by Qij=1Pr(ψ(a,b)=i)∑((a,b),(c,d))∈Ki×KjμaPabPbcPcd for 0 ≤ i,j ≤ 3. In Example 1c it was shown that Pr(ψ(a,b)=i)=14 for ri=0,1,2,3

[0054] In example 1b, the stationary probability distribution was used. μ=(μ0,μ1,μ2,μ3)=(112,14,13,13) the Markov chain of intoxication symbols is determined.

[0055] At the end of Example 1c, the classes K0, K1, K2, K3 were described.

[0056] The transition probabilities P ij The values ​​are taken from matrix P in Example 1a. Applying formula (3) above to these data yields the transition probability matrix. Q=(Q00Q01Q02Q03Q10Q11Q12Q13Q20Q21Q22Q23Q30Q31Q32Q33)=(1301313291329292913292929132929).

[0057] The associated stationary distribution v=(v0,v1,v2,v3)=(14,14,14,14). The entropy rate E of the new Markov chain (at the output of the post-processing) is given by the formula E=−∑i=03vi∑j=03Qij log2 Qij=1.877.

[0058] The entropy value of 1.585 for the original sequence X1, X2, X3, ... has thus increased to 1.877 for the compressed sequence Y1, Y2, Y3,..., from 79.2% to 93.9%. (An entropy value of 2 would correspond to 100% entropy.)

[0059] The noise source 104,201 is implemented, for example, as follows: A measured quantity v(t), derived from the frequency ratio of two ring oscillators, assumes a value in the unit interval with each iteration. The temporal evolution of the measured quantity follows the law v(t+1)=3v(t)+14 mod 1.

[0060] The graph of the function y=3x+14 The modulo 1 induces a division of the unit interval into four subintervals of lengths 1 / 12, 1 / 4, 1 / 3, and 1 / 3. Depending on which subinterval the measured quantity is in at time t, the symbol 0, 1, 2, or 3 is output at time t. From the graph of the function y=3x+14 Mod 1 and from the chaos-theory-implied uniform distribution property of the measured quantity v(t) in the unit interval, the transition probabilities for the output symbols can be calculated. These are precisely the transition probabilities given in the matrix P in (1).

[0061] Noise source 104,201 produces true random numbers, but these are generally not yet ideal true random numbers. Post-processing transforms the (low-entropy) random numbers from the noise source into (high-entropy) random numbers, which then come closer to ideal random numbers.

[0062] In summary, according to various embodiments, a data processing device is provided, comprising a setting device configured to specify a number of multi-bit output symbols from a random symbol source to be used for generating a single random number; a determination device configured to determine, for each possible sequence of multi-bit output symbols from the random symbol source of the specified number, a probability that the random symbol source will output the sequence, using predetermined transition probabilities between two or more output symbols from the random symbol source; and a grouping device configured to group the possible sequences of output symbols from the random symbol source into groups according to the criterion that the total probabilities of the groups are either exactly or approximately equal.wherein for each group the overall probability is determined as the sum of the determined probabilities that the random symbol source outputs the sequences belonging to the group, and an assignment device is set up to assign a random number to each group as a random number to be output by the random number generator for the sequences of random symbols belonging to the group.

[0063] The data processing device can, for example, be the data processing device of Fig. 1 corresponds to, i.e., the various devices (determining device, determining device, grouping device, and assigning device, and possibly other devices) can be implemented, for example, by the CPU 101 and / or the coprocessor 105. However, the data processing device itself does not need to contain the noise source; i.e., the random number generator can be implemented on a different data processing device (which is at least partially configured by the data processing device).

[0064] The various functions (determining function, determining function, grouping function, and allocation function, and possibly other functions) can be performed by one or more computers with one or more data processing units. The term "data processing unit" can be understood as any type of entity that enables the processing of data or signals. The data or signals can, for example, be processed according to at least one (i.e., one or more than one) specific function performed by the data processing unit.A data processing unit may comprise or be composed of an analog circuit, a digital circuit, a logic circuit, a microprocessor, a microcontroller, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), an integrated circuit, a programmable gate array (FPGA), or any combination thereof. Any other means of implementing the respective functions described in more detail herein may also be understood as a data processing unit or logic circuit arrangement. One or more of the procedure steps described in detail herein may be performed (e.g., implemented) by a data processing unit through one or more special functions carried out by the data processing unit.

[0065] According to various embodiments, a method is provided as described in Fig. 3 is illustrated.

[0066] Fig. Figure 3 shows a flowchart 300 illustrating a procedure for configuring a random number generator.

[0067] In 301, a number (denoted above by r) of multi-bit output symbols (denoted above by σ1, σ2, ..., σ) are used. r designated) a random symbol source (also referred to as noise source in the examples above) to be used for generating a single random number (this is equivalent to setting the compression rate in post-processing).

[0068] In 302, for each possible sequence of multi-bit output symbols of the random symbol source of a fixed number, the probability with which the random symbol source outputs the sequence is determined (i.e., P(σ1, σ2, ..., σ). r ), e.g. by P(σ1, σ2, ···,σ r ) = µ σ1 P σ2 P σ2σ3 ... P σr-1σrThis is done using predetermined transition probabilities between two or more output symbols from the random symbol source (i.e., from P). σ1σ2 P σ2σ3 ,···, P σr-1σr ).

[0069] In 303, the possible sequences of output symbols from the random symbol source are grouped according to the criterion that the total probabilities of the groups are as equal as possible (i.e., as close to equality as possible: even when grouping according to the criterion of equality, it is not guaranteed that the total probabilities are exactly equal; however, if possible, grouping can be done so that the total probabilities of the groups are equal, as is the case in the example above), where for each group the total probability is determined as the sum of the determined probabilities that the random symbol source outputs the sequences belonging to the group (i.e., for example, as Σ (σ1,...,σr)∈Kiµ σ1 P σ1σ2 ··· P σr-1σr ) .

[0070] In 304, each group is assigned a random number as the output of the random number generator for the sequences of random symbols belonging to that group (i.e., output from, for example, the same alphabet as the multi-bit output symbols of the random symbol source, or from a different one, e.g., a smaller alphabet (for stronger compression); the number of groups determines how many possible distinct random numbers can be generated). The random number generator is configured to output, for each sequence of random symbols, the random number assigned to the group to which that sequence belongs.

[0071] According to various embodiments, a random number generator is configured to implement entropy compression, in which the random symbols being grouped are not (numerically) balanced, but rather grouped according to the total probabilities of the groups to which they are grouped.

[0072] As described above, the probability that the random symbol source outputs a particular sequence can be determined according to a Markov model for the random symbol source. If multi-step dependencies exist, output symbols can also be combined, so that the Markov property applies again to the resulting larger symbols.

[0073] Furthermore, the random symbol source can itself be configured like the random number generator (using another, i.e., an "original" or "underlying" random symbol source, e.g., a noise source). In other words, the procedure can be applied iteratively, since the generated random numbers can be compressed in the same way to further increase the entropy; that is, a configured random number generator is the random symbol source for another (building upon it) random number generator (in a subsequent iteration). As in the example above, it can be exploited that the output of the random number generator (i.e., the sequence of random numbers or output symbols after compression) can again be viewed as a Markov chain.

[0074] The following are various examples of implementation.

[0075] Exemplary embodiment 1 is a data processing device comprising: • A setting device configured to specify a number of multi-bit output symbols from a random symbol source to be used for generating a single random number; • a determination device designed to determine, for each possible sequence of multi-bit output symbols from the random symbol source of a specified number, a probability that the random symbol source will output the sequence, using predetermined transition probabilities between two or more output symbols from the random symbol source; • a grouping device, configured to group the possible sequences of output symbols from the random symbol source into groups according to the criterion that the total probabilities of the groups are as equal as possible, wherein for each group the total probability is determined as the sum of the determined probabilities that the random symbol source outputs the sequences belonging to the group; and • an allocation device set up to assign a random number to each group as a random number to be output by the random number generator for the sequences of random symbols belonging to the group.

[0076] Exemplary embodiment 2 is a data processing device according to exemplary embodiment 1, comprising a function formation device configured for forming a compression function by forming a Boolean function for each bit position of the random number to be generated, wherein the compression function maps the sequence to the random number assigned to the group to which the sequence belongs for each sequence of possible sequences of multi-bit output symbols of the specified number, and an implementation device configured for implementing the compression function in the random number generator.

[0077] Exemplary embodiment 3 is a data processing device according to exemplary embodiment 2, wherein the implementation device for implementing the compression function is set up in the form of a hardware implementation that implements the Boolean functions as logic gate arrangements.

[0078] Exemplary embodiment 4 is a data processing device according to one of the exemplary embodiments 1 to 3, wherein the determination device is set up to determine, for each possible sequence of multi-bit output symbols of the random symbol source of the specified number, the probability that the random symbol source outputs the sequence, according to a Markov model for the random symbol source.

[0079] Exemplary embodiment 5 is a data processing device according to one of the exemplary embodiments 1 to 4, wherein at least some of the groups contain a different number of possible sequences of output symbols.

[0080] Exemplary embodiment 6 is a data processing device according to one of the exemplary embodiments 1 to 5, comprising a control device configured to control the random number generator for generating one or more random numbers by, for each random number, receiving a sequence of multi-bit output symbols from the random symbol source of the specified number and outputting the random number that is assigned to the group to which the received sequence of output symbols belongs.

[0081] Exemplary embodiment 7 is a data processing device according to exemplary embodiment 2 or 3, comprising a control device configured to control the random number generator for generating one or more random numbers by, for each random number, receiving a sequence of multi-bit output symbols from the random symbol source of a specified number, determining the random number assigned to the group to which the received sequence of output symbols belongs, by applying the compression function to the received sequence of output symbols, and outputting the determined random number.

[0082] Exemplary embodiment 8 is a data processing device according to exemplary embodiment 6 or 7, comprising a configuration device set up to configure the random symbol source as a random number generator according to one of exemplary embodiments 1 to 5.

[0083] Exemplary embodiment 9 is a method for configuring a random number generator, as described above with reference to Fig. 3 described.

[0084] Embodiment 10 is a method according to embodiment 9, comprising forming a compression function by forming a Boolean function for each bit position of the random number to be generated, wherein the compression function maps the sequence to the random number assigned to the group to which the sequence belongs for each sequence of possible sequences of multi-bit output symbols of the specified number, and implementing the compression function in the random number generator.

[0085] Embodiment 11 is a method according to embodiment 10, comprising implementing the compression function in the form of a hardware implementation that implements the Boolean functions as logic gate arrangements.

[0086] Embodiment 12 is a method according to one of embodiments 9 to 11, comprising determining, for each possible sequence of multi-bit output symbols of the random symbol source of the specified number, the probability that the random symbol source outputs the sequence, according to a Markov model for the random symbol source.

[0087] Embodiment 13 is a method according to one of embodiments 9 to 12, wherein at least some of the groups contain a different number of possible sequences of output symbols.

[0088] Embodiment 14 is a method for generating random numbers, comprising configuring a random number generator according to one of embodiments 9 to 13 and generating one or more random numbers by, for each random number, receiving a sequence of multi-bit output symbols from the random symbol source of the specified number and outputting the random number that is assigned to the group to which the received sequence of output symbols belongs.

[0089] Embodiment 15 is a method for generating random numbers, comprising configuring a random number generator according to embodiment 10 or 11 and generating one or more random numbers by, for each random number, receiving a sequence of multi-bit output symbols from the random symbol source of a specified number, determining the random number assigned to the group to which the received sequence of output symbols belongs, by applying the compression function to the received sequence of output symbols and outputting the determined random number.

[0090] Embodiment 16 is a method according to embodiment 14 or 15, comprising configuring the random symbol source as a random number generator according to one of embodiments 9 to 13.

[0091] Exemplary embodiment 17 is a random number generator configured according to one of the exemplary embodiments 9 to 13.

[0092] According to further embodiments, a computer program element and / or a computer-readable storage medium can be provided which contains instructions which, when executed by a processor, cause the processor to perform a procedure according to the above embodiments.

[0093] Although the invention has been shown and described primarily with reference to specific embodiments, those familiar with the field should understand that numerous modifications regarding its design and details can be made without departing from the essence and scope of the invention as defined by the following claims. The scope of the invention is therefore determined by the appended claims, and it is intended that all modifications falling within the literal or equivalent scope of the claims are included. Reference symbol list 100 data processing devices 101 CPU 102 MB RAM 103 NVM 104 Noise source 105 Coprocessor 201 Noise source 202 symbol buffer 203 digital buffer 204 Hardware Entropy Extractor 300 Flowchart 301-304 Process steps

Images