Entropy source, quantum random number generator, and electronic circuit

Abstract

The invention relates to a monolithically integrated entropy source comprising: a photon source that is designed to emit photons, the photon source comprising a first outer shell, said first outer shell being formed by a first base surface, a first top surface, and at least one first side surface connecting the first base surface and the first top surface to one another; and a photon detector that is designed to detect the photons emitted by the photon source, the first base surface of the photon source being arranged so as to face the photon detector.

Description

[0001] Entropy source, quantum random number generator and electronic circuit

[0002] The present disclosure relates, among other things, to an entropy source, a quantum random number generator, and an electronic circuit comprising the entropy source and / or the quantum random number generator.

[0003] In many areas of science and technology, random events and the determination of probabilities play a particularly prominent role. For example, Monte Carlo simulations, the customization of transmitters and / or components, bus addressing methods, and secure encryption methods rely heavily on the provision of random numbers. A general distinction is made between so-called pseudo-random numbers and true random numbers.

[0004] While pseudo-random numbers are generated using deterministic formulas by pseudo-random number generators (PRNGs), and are therefore not absolutely random, non-deterministic random number generators (TRNGs) for generating true random numbers are generally based on real, unpredictable processes, such as thermal or atmospheric noise, rather than on artificially generated patterns of deterministic algorithms. However, even the results of such non-deterministic random number generators based on external parameters can, depending on the underlying random element, still tend slightly toward higher or even numbers due to weak correlations, for example, thus enabling at least partial predictability of the random numbers generated in this way.Such random number generators for truly random numbers (TRNGs) can also be manipulated from the outside if they are inadequately designed, for example, in the case of thermal entropy sources for the random numbers. Quantum random number generators (QRNGs), a special subgroup of TRNGs, are based on fundamental quantum processes for random number generation and are therefore, at least theoretically, not linked to other external factors and effects that influence statistics. Thus, they do not have a so-called side channel that allows the random number generation process to be influenced.

[0005] Quantum random number generators can be realized using the random properties of photons (as photonic quantum random number generators). A conventional concept for generating random numbers is based on the use of random photon arrival times at a photon detector. This distribution effect, based on intrinsic, fundamentally non-deterministically computable photon statistics of the photons of a corresponding photon source, can be used to generate truly random numbers. The arrival times of photons at a single-photon detector generally exhibit an exponential distribution.

[0006] EP 3 529 694 relates to a (quantum) random number generator comprising a photon source, one or more photon detectors configured to detect at least one photon belonging to a flux of detected photons generated by the photon source, and electronic sampling means operatively connected to the photon detectors and configured to implement a logical method for extracting a binary sequence based on the arrival time of each of the detected photons. In the random number generator, the photon source and the photon detectors are arranged side by side and integrated into a single semiconductor substrate.

[0007] WO 2016 / 016741 A1 relates to a (quantum) random number generator comprising a photon source and one or more SPAD-type photon detectors configured to detect a photon flux equal to 1, wherein the photons are generated by the photon source. The random number generator further comprises electronic sampling means. These electronic sampling means are configured to record the arrival time t of a photon incident on each SPAD photon detector for each of the observation windows Tw, and they are also configured to convert the arrival time t into a binary sequence. The photon source and the electronic sampling means are configured such that the product 1 * Tw is less than or equal to 0.01.

[0008] An optional object of the present disclosure can be seen in providing a device and / or a method which is / are suitable for enriching the state of the art.

[0009] One possible concrete task could be to specify an entropy source or a quantum random generator that has a high degree of security. A possible concrete task could be, additionally or alternatively, to specify an entropy source or a quantum random generator that has a low area requirement.

[0010] This problem is solved according to the disclosure by the features of the respective independent claims. Optional developments of the disclosed solution are specified in the dependent claims.

[0011] According to this, the problem is solved by a monolithically integrated entropy source, optionally for a quantum random number generator. The entropy source comprises a non-deterministic photon source configured to emit photons. The photon source comprises a first outer shell, wherein the first outer shell is formed by a first base surface, a first top surface, and at least one first side surface connecting the first base surface and the first top surface. The entropy source comprises a photon detector configured to detect the photons emitted by the photon source. The first base surface of the photon source is arranged facing the photon detector.

[0012] The photon detector may comprise a second outer shell, wherein the second outer shell is formed by a second base surface, a second cover surface, and at least one second side surface connecting the first base surface and the first cover surface. The first base surface of the photon source may be arranged facing the second base surface of the photon detector.

[0013] Additionally, or alternatively, the object is achieved by a monolithically integrated entropy source, optionally for a quantum random number generator, wherein the entropy source comprises a photon source configured to emit photons. The entropy source comprises a photon detector configured to detect the photons emitted by the photon source. The photon detector comprises a second outer shell, wherein the second outer shell is formed by a second base surface, a second top surface, and at least one second side surface connecting the second base surface and the second top surface. The second base surface of the photon detector is arranged facing the photon source.

[0014] This means that an entropy source can be provided which is implemented in one piece on a semiconductor substrate having a surface. This can be a vertical entropy source with at least one photon source and at least one photon detector. The surface of the semiconductor substrate can be defined as a horizontal plane with a first direction in the plane (1st plane vector) and a second direction in the plane (2nd plane vector) which is different from the first direction in the plane. The photon source and the photon detector can be arranged in the semiconductor substrate in a direction vertical to the first and second directions in the plane, relative to the first and second directions in the horizontal plane of the surface of the semiconductor substrate. This means that the photon source can be arranged between the surface and the photon detector.It would also be conceivable for the photon detector to be located between the surface and the photon source. It is conceivable for the entropy source to be part of a quantum-process-based (random number) generator for truly random numbers, configured to generate one or more random bits depending on an output signal from the entropy source.

[0015] A monolithically integrated entropy source can be understood as an entropy source whose photon source and whose photon detector are formed in a semiconductor substrate, optionally comprising one, two or more inseparably connected layers.

[0016] An entropy source can be understood as a physical information source whose output is random or non-deterministic. This can be achieved, among other things, by including a non-deterministic photon source in the entropy source. Thus, an entropy source is proposed whose output signal is non-deterministic.

[0017] It is conceivable that an entropy source with a non-deterministic output signal is understood to be an entropy source that meets the (approximately fifteen statistical) tests listed by the National Institute of Standards and Technology (NIST) in its NIST SP 800-22 Rev. 1 guideline of April 2010. These tests can be used to determine whether an entropy source and / or a random number generator comprising the entropy source has a sufficient degree of entropy (or not), i.e., is non-deterministic.

[0018] A photon source can be understood as a physical unit that is designed to emit photons during its operation.

[0019] A non-deterministic photon source can be understood as a photon source for which a prediction of the time at which it will emit one (or more) photons is not possible or not exactly predictable. In other words, the exact time at which photons are emitted is random. However, it is still conceivable that a probability can be estimated for a number of photons emitted within a predetermined period of time, e.g., depending on environmental influences (such as temperature).

[0020] A photon detector can be understood as a physical unit that is designed to detect or measurably record photons during its operation.

[0021] The outer shell of the photon detector or photon source can be understood as those (surface) surfaces which are in contact with the environment of the photon detector or photon source, for example the semiconductor substrate.

[0022] The photon detector and / or the photon source can have a substantially cylindrical shape. A cylinder has a round base and a round top surface, which are arranged opposite one another. The side or lateral surface extends along the entire height of the cylinder and thus connects the top and base surfaces to form a closed body. The height of the cylinder corresponds to a (vertical) distance between the top surface and the base surface. The radius of the base surface can be larger than the height of the cylinder.

[0023] The photon detector and / or the photon source can essentially have the shape of a cuboid. A cuboid has a rectangular base and a rectangular top surface, which are arranged opposite one another. The lateral surface consists of several, more precisely four, side surfaces and extends along the entire height of the cuboid, thus connecting the top and base surfaces to form a closed body. The height of the cuboid corresponds to a (vertical) distance between the top surface and the base surface. The diagonal of the base surface can be greater than the height of the cuboid.

[0024] The photon source can be configured to emit photons across its base surface. The photon detector can be configured to detect photons incident on its base surface.

[0025] As explained above, the base surface of the photon source can face the photon detector. This means that, regardless of the three-dimensional shape of the photon source, the base surface of the photon source can be formed essentially in a two-dimensional plane, with a normal vector perpendicular to the plane and thus to the base surface pointing toward the photon detector. In the case of a cuboid-shaped photon source, the base surface can be the surface of the photon source that has the largest area and, after the top surface, the second largest area.

[0026] As explained above, the base surface of the photon detector can face the photon source. This means that, regardless of the three-dimensional shape of the photon detector, the base surface of the photon detector can be formed essentially in a two-dimensional plane, with a normal vector perpendicular to the plane and thus to the base surface pointing toward the photon source. In the case of a cuboid-shaped photon source, the base surface can be the surface of the photon source that has the largest area and, after the top surface, the second largest area.

[0027] This means that the two base surfaces can also be arranged facing each other.

[0028] The design of the entropy source, according to which the base surfaces of the photon source are arranged facing the photon detector, offers the advantage that the photons emitted via the base surface of the photon source are emitted in the direction of the photon source, therefore with a high probability hit the photon detector and in turn are detected by it.

[0029] The design of the entropy source, according to which the base surfaces of the photon detector are arranged facing the photon source, offers the advantage that the photons emitted by the photon source hit the photon detector, in particular the base surface of the photon detector, with a high probability and are in turn detected by it.

[0030] If the two base surfaces are arranged facing each other, the two effects described above occur in combination.

[0031] In any case, a high number of emitted photons can be detected by the photon detector, and thus a high entropy of the output signal of the entropy source can be achieved.

[0032] The photon source can be a single-photon source.

[0033] A single-photon source can be a light source or photon source that essentially never emits two or more photons simultaneously. It is also conceivable that the single-photon source is a photon source that emits only a few photons at a time.

[0034] The photon source can be an avalanche Zener diode. The avalanche Zener diode can have a breakdown voltage of less than or equal to 10 V, optionally a breakdown voltage of less than or equal to 8 V, and further optionally a breakdown voltage of less than or equal to 7 V. Avalanche Zener diodes allow a high single-photon rate at a relatively low operating voltage (even below and in the range of the (Zener) breakdown voltage). Avalanche Zener diodes also allow a construction or can be designed such that the photons emitted by the photon source are emitted or released with a high probability via the base area of ​​the photon source, since this has a larger surface area than the side surfaces.

[0035] The photon detector may comprise a single-photon detector, optionally a single-photon avalanche diode (SPAD).

[0036] A single-photon detector can be understood as a detector that is designed to individually capture or detect photons emitted by the single-photon source.

[0037] The single-photon avalanche diode may comprise a first pn junction formed from a first p-layer and a first n-layer, wherein the first p-layer and the first n-layer are in contact with each other.

[0038] The p-layer and the n-layer can each be obtained by doping. In semiconductor technology, doping refers to the introduction of foreign atoms into a layer or into the base material of an integrated circuit. In a p-doped substrate (p for the freely movable positive charge), trivalent elements, called acceptors, can be introduced into a silicon lattice and replace tetravalent silicon atoms. With n-doping (n for the freely movable negative charge), pentavalent elements, called donors, can be introduced into the silicon lattice and replace the tetravalent silicon atoms.

[0039] The single-photon avalanche diode may comprise an absorption region configured and arranged to absorb the photons emitted by the photon source such that the absorption region generates, optionally exactly, one electron-hole pair per photon. The absorption region may be in contact with the first pn junction, and the first pn junction may be configured to generate a charge avalanche due to the generated electron-hole pair. The photon detector may be configured to detect the respective photon emitted by the photon source based on the generated charge avalanche.

[0040] This means that when the single-photon avalanche diode is excited by individual photons, an electron-hole pair can be generated in a sensor-active region or absorption region for each exciting photon (optionally in each case). The excited electrons are drawn to a cathode by electric fields, and the excited holes are drawn to an anode. In a single-photon avalanche diode, the charge carriers can drift through a so-called avalanche region formed by the pn junction, within which a charge avalanche is generated by impact ionization. Single-photon avalanche diodes can thus be highly sensitive photon-receiving elements that, when activated by a photon, can provide a high amount of charge (approximately 105 - 106 electrons) with high temporal resolution.

[0041] The single-photon avalanche diode can be operated in Geiger mode above the breakdown voltage, whereby a single photon can be detected via the generated charge avalanche and subsequently recorded as a single event. To reduce the dead time during recording, active or passive suppression or quenching of further charge carrier amplification can be performed immediately after the onset of the avalanche formation.

[0042] An integrated circuit can be provided that, in addition to the single-photon avalanche diode, also includes a so-called single-photon counter (SPC). Instead of directly outputting a single detector pulse, a direct statistical evaluation of the temporal distribution of the individual detected single-photon events can then be performed. The absorption region can comprise or consist of a p-doped substrate that completely covers a surface of the first pn junction facing the photon source.

[0043] The absorption region may comprise a p-doped substrate which only partially covers a surface of the first pn junction facing the photon source and forms a channel extending from this surface of the first pn junction in the direction of the photon source, which channel is laterally delimited by an n-doped substrate.

[0044] The absorption region may comprise or consist of an n-doped substrate that completely covers a surface of the first pn junction facing the photon source.

[0045] The absorption region can be in contact with the photon source, optionally a p-doped substrate of the photon source.

[0046] The single-photon avalanche diode may comprise a second pn junction formed from a second p-layer and the first n-layer, wherein the second p-layer and the first n-layer are in contact with each other.

[0047] It is conceivable that the second pn junction could be used as an additional photon detector to monitor for external attacks. The additional pn junction could, for example, be used to detect photons introduced into the entropy source from outside or externally. This would allow external attacks to be detected.

[0048] It is conceivable that the second pn junction is arranged between the first pn junction and a rear side of the semiconductor substrate, which is opposite the above-defined surface of the semiconductor substrate. This allows, in particular, an attack from the rear side of the semiconductor substrate to be detected. The entropy source can comprise a metal layer, optionally together with an internal silicide layer, wherein the metal layer shields the entropy source from the outside.

[0049] The metal layer can be used to shield against external photons (“shading”) and / or to increase efficiency by reflecting back the photons generated by the associated photon source.

[0050] The entropy source can have at least two anodes for the photon source and the photon detector, which are conductively connected to each other via the metal layer.

[0051] The photon source and / or the photon detector, optionally the entropy source as a whole, may be rotationally symmetrical along an axis perpendicular to the first and / or second base surface.

[0052] It is conceivable that the axis is perpendicular to the above-defined surface of the semiconductor substrate and / or the rear side arranged opposite it.

[0053] The entropy source can be designed using bipolar CMOS-DMOS technology (BCD technology) or manufactured according to BCD technology.

[0054] Bipolar CMOS technology (BiCMOS technology) is a semiconductor manufacturing method that combines two originally separate circuit technologies, namely bipolar transistor (BJT) and CMOS logic gates (complementary metal-oxide-semiconductor) based on metal-oxide-semiconductor field-effect transistors (MOSFETs), in a single integrated circuit.

[0055] BCD technology can allow effective and optimized integration of a SPAD, optionally with a variety of additional functional groups, such as digital and / or analog circuit components, particularly energy-efficient digital memory and switching elements, general power and driver electronics, as well as detector and sensor components.

[0056] The entropy source may comprise a substrate having a carrier substrate and an epitaxial layer, wherein the epitaxial layer may comprise the first pn junction and the carrier substrate may comprise the second pn junction.

[0057] It is conceivable that the epitaxial layer is an epitaxial layer grown on the carrier substrate. The first pn junction can be located in the epitaxial layer (e.g., introduced by diffusion of dopants introduced via the surface of the carrier substrate below the epitaxial layer), in which case it can be a deep pn junction.

[0058] The carrier substrate can be a p-type substrate. However, n-type or intrinsic substrates can also be used. The (semiconductor) substrate material can be silicon. A dopant for forming a p-type region is, for example, boron. Phosphorus (P), arsenic (As), and / or antimony (Sb) can be used to form an n-type region. In silicon, for example, boron diffuses significantly further as a dopant than the heavy donors (P, As, or Sb). It can also be seen that the n-type regions created are largely dominant due to the higher doses used, i.e., an n-type region already doped with phosphorus can retain its existing conductivity type even after additional boron is added. To create the deep pn junctions, additional masking, lithography, and epitaxy steps in the conventional BCD process can sometimes be dispensed with.

[0059] The first and second dopant can have different diffusion properties in the carrier substrate and / or in the epitaxial layer. The second dopant can have higher mobility in the carrier substrate and / or in the epitaxial layer than the first dopant. The introduction of the first dopant and / or the second dopant can be carried out maskless or via a mask process. For maskless introduction, a direct ion beam writing process, for example, can be used. In a mask process, the introduction can be carried out using a previously provided mask, wherein the introduction takes place, for example, via a chemical or physical deposition process or also by means of an ion beam writing process.It is conceivable that the first region or the second region completely overlie the other region immediately after the introduction of the second dopant (in a plan view of the above-defined surface of the carrier substrate). The first region can be a (deep-lying) n-type layer (NBL layer) and the second region a (deep-lying) p-type layer (PBL layer).

[0060] A top and / or bottom side of the substrate can be mirrored at least in the region of the photon source and / or the photon detector and / or comprise a light-blocking layer.

[0061] The substrate may have a combination of at least one element each of metal covers, sidewall contacts and vias on its surface and / or backside or on its top and / or bottom side.

[0062] The entropy source described above can offer, among other advantages, that the entropy source (and optionally a quantum random generator comprising the entropy source) is protected against external attacks while maintaining high efficiency and low substrate losses. This entropy source can optionally comprise a stacked Zener aV LED and a SPAD in a common semiconductor substrate, thus providing a compact and secure entropy source.

[0063] Furthermore, a method for operating an entropy source described above can be provided. The method comprises emitting the photons by means of the photon source such that the photons exit the photon source via its first base surface toward the photon detector, and / or receiving the photons emitted by the photon source at the second base surface of the photon detector.

[0064] Furthermore, a quantum random number generator can be provided. The quantum random number generator comprises the entropy source described above and an electronic circuit configured to generate a random bit as a function of an output signal from the entropy source and optionally output the generated random bit. A characteristic of the output signal from the entropy source depends on a temporal frequency of the photons detected by the photon detector.

[0065] The generated random bit can be part of a random bit data stream. This means that the quantum random number generator can be configured to continuously generate random bits and optionally output them in the form of a random bit data stream. The random bit data stream can then be considered random if it passes the following NIST test:

[0066] Smid, Elaine Barker, et al. "A statistical test suite for random and pseudorandom number generators for cryptographic applications." (2010). Downloadable from https: / / www.researchgate.net / profile / Salam- lsmaeel / post / ls_there_any_program_or_software_to_check_strength_of_cryptogr aphy_algorithm2 / attachment / 59d61 de479197b807797be4a / AS%3A27382331051 6224%401442295972158 / download / NIST.pdf

[0067] The NIST Test Suite software can be downloaded from the following URL (as of the filing date): https: / / csrc.nist.gov / CSRC / media / Projects / Random-Bit-Generation / documents / sts- 2_1_2.zip

[0068] The quantum random number generator may comprise a pseudorandom number generator configured to generate a digital output signal based on the output signal of the entropy source and an optionally predetermined or adjustable generator polynomial.

[0069] The quantum random number generator may comprise a random bit generation unit configured to generate the random bit based on the digital output signal of the pseudorandom number generator.

[0070] The random bit generation unit can generate the random bit by determining a first value and a second value of the digital output signal. The random bit generation unit can generate the random bit by setting a value of an output of the random bit generation unit to a first logical value if the first value of the digital output signal is smaller than the second value of the digital output signal and the difference between the first value of the digital output signal and the second value of the digital output signal is greater than a minimum difference.The random bit generation unit may generate the random bit by setting the value of the output of the random bit generation unit to a second logical value when the first value of the digital output signal is greater than the second value of the digital output signal and the difference between the first value of the digital output signal and the second value of the digital output signal is greater than the minimum difference.

[0071] The random bit generation unit may be configured to discard the first value of the digital output signal and the second value of the digital output signal of the digital signal if a difference between the first and the second value is smaller than a predetermined minimum difference.

[0072] The quantum random number generator may include a monitoring unit or watchdog configured to monitor the output of the random bit generation unit. It is conceivable that the monitoring unit detects a malfunction of the quantum random number generator if the number of discarded values ​​of the random bit generation unit exceeds a predetermined limit.

[0073] Furthermore, the disclosure relates to an integrated electronic circuit, wherein the circuit comprises the above-described monolithically integrated entropy source and / or the above-described quantum random number generator (200). The integrated electronic circuit can be a microelectronic integrated circuit.

[0074] The features described herein and the features in the figures are not only disclosed in the explicitly described embodiments and combinations. Therefore, other technically possible combinations as well as the isolated features are also encompassed by the disclosure. Optional embodiments and specific examples are described below with reference to the figures to illustrate the disclosure, without limiting the disclosure to the embodiments or examples described or shown in the figures.

[0075] Figure 1 shows a schematic representation of a BCD substrate provided by a method for providing deep pn junctions in a BCD process and a TCAD representation of the resulting dopant distribution;

[0076] Figure 2 shows a schematic representation of an exemplary first embodiment of an entropy source in a cross-sectional view;

[0077] Figure 3 shows a schematic representation of an exemplary second embodiment of the entropy source in a cross-sectional view;

[0078] Figure 4 shows a schematic representation of an exemplary third embodiment of the entropy source in a cross-sectional view; Figure 5 shows a graphical representation of the dependence of a) the SPAD current and b) the ratio between SPAD current and Zener current as a function of the Zener blocking voltage at various SPAD blocking voltages (less than, equal to, or greater than the breakdown voltage) within the entropy source from Figures 2 to 4;

[0079] Figure 6 shows a schematic representation of a quantum random generator with the entropy source from Figures 2 to 4;

[0080] Figure 7 shows a schematic representation of an exemplary layout of an integrated electronic circuit with the entropy source from Figures 2 to 4 and / or the quantum random generator from Figure 6 in a plan view;

[0081] Figure 8 shows a schematic representation of a system with the entropy source from Figures 2 to 4 and / or the quantum random generator from Figure 6 and a crypto engine, optionally at least partially designed in the form of the microelectronic integrated circuit 500 from Figure 7; and

[0082] The reference symbols are used consistently throughout the figures, ie the same reference symbols in the figures refer to the same objects.

[0083] Figure 1 shows a schematic representation of a (BCD) substrate 110 provided with a method for providing deep pn junctions 50 and 52 in a BCD process and a TCAD representation of the resulting dopant distribution.

[0084] The method for producing deep pn junctions 50 and 52 in a BCD process may include providing a carrier substrate 49. The method may include introducing a first dopant to form a first region 22 (e.g., NBL) of the first conductivity type (negative for NBL) into a surface S of the carrier substrate 49.

[0085] The method may comprise introducing a second dopant to form a second region 32 (e.g., PBL) of the second conductivity type (positive for PBL) into the surface S of the carrier substrate 49, wherein the first region 22 (NBL) and the second region 32 (PBL) at least partially overlap.

[0086] The method may comprise growing an epitaxial layer 48 on the surface S of the carrier substrate 49, wherein the first region 22 (NBL) and the second region 32 (PBL) spread by diffusion of the first dopant and the second dopant in the epitaxial layer 48 and thereby form a (first) pn junction 50 located in the epitaxial layer 48.

[0087] In the illustration, the first region 22 is a deep NBL layer, and the second region 32 is a deep PBL layer. However, the order can be reversed, so that the first region 22 can also be a deep PBL layer, and the second region 32 can be a deep NBL layer.

[0088] By appropriately adjusting the diffusion lengths of the individual dopants, the layer sequence of the pn junctions 50 and 52 can also be reversed; for example, in Figure 1, the NBL and PBL layers at the pn junction 50 and 52 could also be swapped.

[0089] The method can offer the advantage that the first region 22 (NBL) and the second region 32 (PBL) at least partially overlap. Optionally, immediately after the introduction of the second dopant, in a plan view of the surface S of the carrier substrate 49, the first region 22 or the second region 32 can completely overlap the other region 32, 22. Therefore, in the embodiment shown, immediately after the introduction of the second dopant to form the second region 32 (PBL), the second region 32 (PBL) lies completely in the first region 22 (NBL) in a plan view of the surface S of the carrier substrate 49. In order to form a pn junction 50 located in the epitaxial layer, the first and second dopants can have different diffusion properties in the carrier substrate 49 and / or in the epitaxial layer 48.Optionally, the second dopant in the second region 32 (PBL), as shown, may have a higher diffusion mobility (and thus diffusion length) in the carrier substrate 49 and in the epitaxial layer 48 than the first dopant in the first region 22 (NBL).

[0090] To enhance diffusion, the carrier substrate 49 can be heated after the introduction of the first dopant and / or the second dopant. After the growth of the epitaxial layer 48, the carrier substrate 49 can be heated to enhance dopant diffusion.

[0091] In the presented method, the first dopant and / or the second dopant can be introduced either maskless or using a mask process. In the BCD wafer shown, a complete overlap of the first region 22 (NBL) with a single second region 32 (PBL) can be assumed. Conventionally, however, the first and second regions 22 and 32 are formed spatially separated from one another. In particular, their distance is generally chosen to be at least large enough that no overlapping regions are created even after the individual dopants have diffused out.

[0092] The TCAD (Technology Computer-Aided Design, TCAD) representation shown below the schematic diagram shows, by way of example, a dopant distribution within the contacted substrate 110 for simulating a corresponding integrated diode structure. Due to the double structure shown in this embodiment, with an upper pn junction 50 in the epitaxial layer 48 and a lower (second) pn junction 52 in the carrier substrate 49, the side view shown shows an effective constriction of the n-type region (NBL) enclosed in the area of ​​the pn junctions 50 and 52 by the two p-type regions (PBL) surrounding this n-type region (NBL). Both pn junctions 50, 52 can be configured to provide mutually independent SPADs with a doping density and field strength distribution suitable for generating an avalanche effect.

[0093] Using appropriate (semiconductor) substrates 110 suitable for use in BCD technologies, particularly deep-lying SPADs ("deepSPADs") can thus be produced. Sufficient installation space remains above the provided SPADs for the integration of additional optoelectronic components. Therefore, a Zener avLED formed above the deep-lying SPAD can be used to realize a particularly compact, vertically constructed entropy source 401, in which individual photons 58 are emitted by the Zener avLED as photon sources 55 in the direction of the upper pn junction 50, optionally vertically downwards, and are thus made available for detection by a SPAD formed as a single-photon detector directly below the Zener avLED as a photon detector 54 at the upper pn junction 50 (see Figures 2 to 4 with the associated figure description).

[0094] Figure 2 shows a schematic representation of an exemplary first embodiment of a (vertical) monolithically integrated entropy source 401.

[0095] The entropy source 401 may include a substrate 110 with a carrier substrate 49 and an epitaxial layer 48. The epitaxial layer 48 may include a first pn junction 50 and / or a third pn junction 554. The carrier substrate 49 may include a second pn junction 52.

[0096] The entropy source 401 comprises a photon source 55 configured to emit photons 58. For this purpose, the photon source 55 comprises a third pn junction 554 formed from a third p-layer 46 and a third n-layer 45, wherein the third p-layer 46 and the third n-layer 45 are in contact with one another. The photon source 55, or more precisely its pn junction 554, comprises a first outer shell, wherein the first outer shell is formed by a first base surface 551, a first cover surface 552, and at least one first side surface 553 connecting the first base surface 551 and the first cover surface 552. The first base surface 551 can have the same surface area as the first cover surface 552. The first base surface 551 can have a larger or smaller surface area than the first cover surface 552. A vertically standing on the first base surface 551

[0097] The normal vector can be parallel to a normal vector perpendicular to the first top surface 552. The third pn junction 554 can have a cylindrical shape. A height of the cylinder can be parallel to the normal vectors. The height of the cylinder can be smaller, optionally by a multiple, than a radius of the first base surface 551 and / or the first top surface 552. The third pn junction 554 can be a thin layer.

[0098] The entropy source 401 comprises a photon detector 54 configured to detect the photons 58 emitted by the photon source 55. For this purpose, the photon detector 54 comprises a first pn junction 50 formed from a first p-layer 32 and a first n-layer 22, wherein the first p-layer 32 and the first n-layer 22 are in contact with one another. The photon detector 54, more precisely its first pn junction 50, comprises a second outer shell, wherein the second outer shell is formed by a second base surface 541, a second cover surface 542, and at least one second side surface 543 connecting the second base surface 541 and the second cover surface 542. The second base surface 541 can have the same surface area as the second cover surface 542. The second base surface 541 may have a larger or smaller surface area than the first cover surface 542.A normal vector perpendicular to the second base surface 541 can be parallel to a normal vector perpendicular to the second cover surface 542. The first pn junction 50 can have a cylindrical shape. A height of the cylinder can be parallel to the normal vectors. The height of the cylinder can be smaller, optionally by a multiple, than a radius of the second base surface 541 and / or the second cover surface 542. The first pn junction 50 can be a thin layer.

[0099] The first base surface 541 of the third pn junction 554 of the photon source 55 is arranged facing the second base surface 541 of the first pn junction of the photon detector 55. This means that the normal vector perpendicular to the second base surface 541 is parallel to the normal vector perpendicular to the first base surface 551. A distance between the first base surface 551 and the second base surface 541 is shorter than a distance between the first cover surface 552 and the second base surface 541.

[0100] The photon source 55 may be a silicon LED and / or a single photon source, optionally a SPAD or an avalanche Zener diode, wherein the avalanche Zener diode optionally has a breakdown voltage of less than 10 V.

[0101] The photon detector 55 comprises an absorption region 10, 47 configured and arranged to absorb the photons 58 emitted by the photon source 55 such that the absorption region 10, 47 generates, optionally exactly, one electron-hole pair for each photon 58. The absorption region 10, 47 is in contact with the first pn junction 50 (and the third pn junction 554). The first pn junction 50 is configured to generate a charge avalanche due to the generated electron-hole pair. The photon detector 54 is configured to detect the respective photon 58 emitted by the photon source 55 based on the generated charge avalanche.

[0102] The photon detector 54 may comprise a single-photon detector, optionally a single-photon avalanche diode, optionally a SPAD. The absorption region 10, 47 comprises or consists of a p-doped substrate that completely covers the surface facing the photon source 55, i.e., the second base area 541, of the first pn junction 50.

[0103] The absorption region 10, 47 is in contact with the photon source 55, here the p-doped substrate 46 of the third pn junction 554 of the photon source 55.

[0104] The photon detector 55 comprises a second pn junction 52 formed from a second p-layer 32 and the first n-layer 22, wherein the second p-layer 32 and the first n-layer 22 are in contact with each other.

[0105] The entropy source 401 comprises a metal layer 53, optionally together with an internal silicide layer or a silicide layer facing towards a surface 0, which shields the entropy source 401 from the outside.

[0106] The entropy source 401 may comprise at least two anodes 124, 134 for the photon source 55 and the photon detector 54, which may be conductively connected to one another via the metal layer 53.

[0107] The photon source 55 and / or the photon detector 54, optionally the entropy source 401 as a whole, can be rotationally symmetrical along an axis. The axis can run parallel to the above-described normal vectors, which are perpendicular to the first and / or second base surfaces 541, 551 and / or perpendicular to the surface O.

[0108] The entropy source 401 can be manufactured using BCD technology.

[0109] A top and / or bottom side of the entropy source 401 can be mirrored and / or comprise a light-blocking layer, at least in the region of the photon source 55 and / or the photon detector 54. During operation of the entropy source 401, photons 58 can be emitted at the third pn junction 554 of the photon source 55 at random time intervals, so that the photons 58 leave the third pn junction 554 of the photon source 55 via its first base area 551 toward the second base area 541 of the first pn junction of the photon detector 54, form an electron-hole pair in the absorption region 10, 47, and trigger a charge avalanche at the first pn junction 50.

[0110] In detail, the vertical entropy source 401, as defined in the document presented here, can be characterized by a vertical arrangement of the photon source 55 relative to the photon detector 54. The horizontal is defined by the surface O of the semiconductor substrate 110 with the epitaxial layer 48. The connecting line of the centers of gravity of the vertical arrangement of the photon source 55 and the photon detector 54 is thus arranged vertically relative to the surface O of the substrate 49 with the epitaxial layer 48, whereby "vertical" can be understood here as a relatively soft angle of more than 30°, optimally 90°, of this line relative to the surface O. The monolithically integrated entropy source 401 shown comprises the photon source 55 and the photon detector 54, wherein the photon source 55 and the photon detector 54 can be arranged vertically one above the other in a common substrate 110 made of a semiconductor material.Optionally, the photon source 55 is a single-photon source configured to provide only a single photon or a few photons 58 at a time (so-called single-photon source). Optionally, the photon source 55 is a light-emitting avalanche Zener diode (Zener-avLED) operating at an operating point below or near the breakdown voltage. Optionally, the photon detector 54 is a single-photon detector, such as a single-photon avalanche diode.

[0111] The entropy source 401 can be formed in a (BCD) substrate 110 using BCD technology. The substrate 110 can comprise the carrier substrate 49 and the epitaxial layer 48 grown on the carrier substrate 49. The pn junctions 50, 52 can be arranged as described with reference to Figure 1. The photon detector 55 can be a

[0112] 50 of the photon detector 54 and an absorption region 10, 47 with a high-voltage p-type well 10 and a p-type well 47 for converting photons into electron-hole pairs, wherein the absorption region 10, 47 can be directly adjacent to the regions 22, 32 forming the deep pn junction 50. The fully developed high-voltage p-type well 10 can enable optimal connection of the deep pn junction 50 from the anode 124, 134.

[0113] The upper deep pn junction 50 of the photon detector 54 can be formed between a deep n-layer 22, which serves or acts as a cathode 132, and a deep p-layer 32 directly adjacent to the deep n-layer 22. The absorption region 10, 47 can directly adjoin the deep p-layer 32 and is essentially formed as a p-region (optionally comprising an intrinsic region). The anode 46 (p-) of the uppermost or third pn junction 554 can be connected via the p-region 47 to a p+ region 51, wherein the anode 32 of the middle or second pn junction 50 is also connected via the region 10 and the region 47 to the p+ region.

[0114] 51 can be connected.

[0115] In the illustrated embodiment, the respective anodes 124, 134 of the photon source 55 and the photon detector 54 are combined. These can then be electrically contacted, for example, via the shared metallization 53 on the surface O of the substrate 110. A shared and continuous metallization 53 can also provide shielding against the radiation of electromagnetic waves from above. The associated cathodes 122, 132 are each designed individually, for example, and can be electrically contacted via a first, associated, further metallization 141. The entropy source 401 can be configured as a circular structure (corresponding to a spatial rotation of the illustrated plane around an imaginary central axis in the vertical direction). However, other configurations of the entropy source 401 are also possible.

[0116] Figure 3 shows a schematic representation of an exemplary second embodiment of the entropy source 401. The embodiment shown in Figure 3 largely corresponds to the first embodiment shown in Figure 2 and described above. The reference numerals and their respective assignment to individual features therefore apply accordingly.

[0117] In the second embodiment, the absorption region 10, 47, which has the p-doped substrate, is designed such that it only partially covers the surface or second base area 541 of the first pn junction 50 facing in the direction of the photon source 55 and forms a channel extending from this second base area 541 of the first pn junction 50 in the direction of the photon source 55, which channel is laterally delimited by an n-doped substrate 29.

[0118] This means that, compared to the first embodiment, the high-voltage p-well 10 is structurally tapered, and a (lightly) n-doped region 29 is additionally provided. The high-voltage p-well 10 of the absorption region 10, 47 forms a channel between the upper p-well 47, also shown in Figure 2, and the (deep-lying) p-layer 32 of the second pn junction 50. The area surrounding the channel is defined by the (lightly) n-doped region 29. Through the channel, the deep-lying upper pn junction 50 is electrically connected to the upper pn junction 45, 46 without an additional punch through the n-doped region 29 and is irradiated with photons 58 by the photon source 54.

[0119] Figure 4 shows a schematic representation of an exemplary third embodiment of the entropy source 401. The third embodiment shown largely corresponds to the first and second embodiments shown in Figures 2 and 3 and described above. The reference numerals and their respective assignment to individual features therefore apply accordingly.

[0120] However, the absorption region 10, 47 has (or consists of) an n-doped substrate 29 which completely covers the base area 541 of the first pn junction 50 facing the photon source 55.

[0121] In comparison to the second embodiment, the third embodiment does not include a channel-shaped high-voltage p-well 10 in the absorption region 10, 47. The weakly n-doped region 29 formed in the epitaxial layer 48 extends over the entire lower region between the second pn junction 50 and the photon source 54. In this respect, compared to the second embodiment, the high-voltage p-well 10 in this region has been structurally replaced by the (weakly) n-doped region 29. The deep upper pn junction 50 is thus connected to the photon source 54 only after an additional punch through the weakly n-doped region 29, which results in a decoupling of possibly several entropy sources 401 arranged side by side in parallel.

[0122] Figure 5 shows a graphical representation of the dependence of a) the SPAD current and b) the ratio between SPAD current and Zener current as a function of the Zener reverse voltage at various SPAD reverse voltages (less than, equal to, or greater than the breakdown voltage) within the entropy source 401. The dependence shown under a) clearly shows that the SPAD current increases exponentially with the Zener reverse voltage in the range from 5.6 V to 6.6 V. This applies to all operating modes of the SPAD, i.e. below its own breakdown voltage (< VBD, linear range), close to the breakdown voltage (~ VBD, avalanche range) as well as above the breakdown voltage (> VBD) and thus also in Geiger operation. The lower curve shown under b) (< VBD) shows that the measured current ratio between the SPAD current and the Zener current for various Zener blocking voltages in the range 5.8 to 6.6 V is approximately 1:4000.In the SPAD breakdown voltage range (~VBD), the ratio increases to values ​​around 1:10. This is due to the so-called multiplication factor of the SPAD, which leaves the linear range in the breakdown voltage range. The upper curve shows the corresponding ratio for a SPAD operated above the corresponding breakdown voltage (>VBD) (approximately 1:1). This means that when a SPAD is operated above the corresponding breakdown voltage (>VBD), the generated photocurrent and the Zener current of the Zener avLED are approximately equal, and a clear measurement signal can be measured by coupling photons to the SPAD.

[0123] Figure 6 shows a schematic representation of a quantum random number generator 400 for generating and outputting a digital random number sequence, e.g. in the form of a random bit stream ZBS (see also Figure 8) and / or, optionally by means of a finite state machine 404.8, a random bit data word 418.

[0124] The quantum random generator 400 is described in further detail below.

[0125] The quantum random number generator 400 includes the entropy source 401 described above. The entropy source 401 of the quantum random number generator 400 can be supplied with a voltage relative to a reference potential on a reference potential line GND via a supply voltage line VENT, which can be connected to a voltage converter 408.

[0126] An output signal or voltage signal 405 generated by the entropy source 401 can first be digitized in an analog-to-digital converter (ADC) 403, which can optionally be supplied via a reference voltage line VREF, and then passed as a digital output signal 407 to a pulse extension circuit 406. The output signal 405 of the entropy source 401 can be obtained, for example, by positively biasing region 45 relative to region 51 (via breakdown voltage). This enables the third pn junction 554 to emit photons 58. Region 22 is positively biased relative to region 32 (in the reverse direction). If the third pn junction 554 emits a photon 58 and this photon 58 is detected by the second pn junction 50, then a current pulse can be tapped at the cathode 132, which in turn can be converted into a voltage pulse.This voltage pulse may correspond to the output signal 405 of the entropy source 401.

[0127] The supply voltage line VENT and / or the reference voltage line VREF can be monitored via a voltage monitor 413, wherein the voltage converter 408 and / or the voltage monitor 413 can be supplied with voltage via a positive supply voltage line VDD relative to the reference potential on the reference potential line GND. The voltage converter 408 can be connected to the voltage monitor 413 via a voltage converter line 421.

[0128] Pulse extension circuit 406 may be a monostable multivibrator (MF). The monostable multivibrator can be used to extend a pulse on the digital output signal line 407 of ADC 403 depending on a specific predefined system clock, for example, to a time length of at least one clock period of the system clock.

[0129] A synchronized voltage signal 415, e.g., a pulse with a specific minimum length, can be output by the pulse extension circuit 406 and optionally passed to a pseudorandom number generator 404.3. The pseudorandom number generator 404.3 can be a time-to-pseudorandom number converter (TPRC). This can have a single-stage or multi-stage design. For example, the TPRC can comprise an analog instrument, a time-to-analog converter (TAC), and / or an analog-to-pseudorandom number converter (APRC). The TPRC can comprise a feedback shift register which, depending on its design, shifts its values ​​one place to the left or right with each clock pulse of the system clock and feeds the feedback value of a given feedback polynomial back into the released bit.The feedback polynomial can be a simple primitive feedback polynomial. An advantage of such a TPRC is its speed and small chip area, as well as the fact that an attacker can hardly measure its success. Instead of the TPRC, a time-to-digital converter (TDC) can also be used. This is typically a binary start-stop counter that is started with a first pulse of the synchronized voltage signal 415 and stopped with a second pulse of the synchronized voltage signal 415. The pseudorandom number generator 404.3 can be connected (optionally directly) to an internal data bus 419. An output signal 410 of the pseudorandom number generator 404.3 can also be fed to an entropy extraction circuit 404.4.

[0130] To generate the output signal 410 of the pseudorandom number generator 404.3, starting with a starting value (a so-called seed value) of the pseudorandom number generator 404.3, exactly one pseudorandom number of the pseudorandom number generator 404.3 can be assigned (bijectively) to each clock pulse of the system clock starting from a falling edge of the synchronized voltage signal 415. This means that the value of the pseudorandom number can then be used to determine the temporal position of the relevant clock pulse of the system clock after the falling edge of the synchronized voltage signal 415. Thus, a pseudorandom number generator 404.3 can be used. One advantage of this can be that even if an attacker successfully introduces a disturbance into the synchronized voltage signal 415, the randomness of the quantum random bit at the output 411 of the entropy extraction 404.4 is only marginally disrupted, since the attacker would have to know the corresponding feedback polynomial of the pseudorandom number generator 404.3. The feedback polynomial can, for example, be randomly selected from a multitude of possibilities. The same applies to the seed value of the pseudorandom number generator 404.3, which an attacker would then also have to determine. A further advantage of a pseudorandom number generator 404.3 instead of a simple digital counter is the smaller space requirement of the feedback logic using a simple-primitive feedback polynomial compared to a binary counter. If the linear feedback shift register of the pseudorandom number generator is long enough, each clock pulse between two pulses of the voltage signal 405 generated by the entropy source 401 is typically assigned a unique pseudorandom number.

[0131] Entropy extraction 404.4 can be used to determine an error (i.e., an undesired state) in the output signal 410 of pseudorandom number generator 404.3. For this purpose, entropy extraction 404.4 can have two linear feedback shift registers that can be compared with each other via a comparator. Conventional binary counters can therefore be dispensed with here as well. Depending on the register depth, feedback can also be achieved via simple primitive polynomials as generator polynomials or feedback polynomials. The length of the linear feedback shift registers can be freely adjustable. Long shift registers generally have good random statistics or random distribution. Shorter shift registers allow a high data rate. The use of shift registers here can have the advantage that few gates are required, the logical depth of the circuits can be small, and thus the clock rate can be high.This reduces the probability of two identical numbers occurring and increases the random bit rate. A corresponding entropy extraction method can provide for two values ​​of the output signal 410 of the pseudorandom number generator to be initially calculated.

[0132] 404.3 and stored in the shift register of the entropy extraction 404.4. If two values ​​are stored in the shift register of the entropy extraction 404.4, the entropy extraction 404.4 can compare these two values. The values ​​in the shift registers of the entropy extraction 404.4 thus comprise a first value and a second value, both of which the pseudorandom number generator

[0133] 404.3 has determined. The entropy extraction 404.4 can then evaluate the two values. If the first value is smaller than the second value and the difference between the first value and the second value is greater than a minimum difference e, the entropy extraction 404.4 can set the value of its output 411 to a first logical value. If the first value is greater than the second value and the difference between the first value and the second value is greater than the minimum difference e, the entropy extraction 404.4 can set its output 411 to a second logical value that is different from the first logical value. If the difference between the first value and the second value is smaller than the minimum difference e, the entropy extraction 404.4 can discard the first value and the second value. In such a case, the entropy extraction 404.4 can cause a so-called watchdog 404.5 to increment an error counter by a first error counter increment.The first error counter step size can be negative. Conversely, the entropy extraction can be negative.

[0134] 404.4 decrements the error counter of the watchdog 404.5 by a second error counter increment if the difference between the first value and the second value is greater than the minimum difference e. The second error counter increment can be equal to the first error counter increment. The respective logical value (e.g., 0 or 1) to which the entropy extraction 404.4 sets its output 411 corresponds to a random number. Since the entropy extraction 404.4 continuously outputs random numbers via its output, this creates a random number stream ZBS. This random number stream ZBS can be used for a crypto engine 800, as described in more detail later. The watchdog 404.5 can be connected to the internal data bus 419 as a transport medium for the random bit stream ZBS. The internal data bus 419 can, for example, be connected to a crypto engine 800 and / or one or more memories and / or one or more CPUs (see also description of Figure 8).The watchdog 404.5 can be connected to the voltage monitor 413 via one or more, optionally digital input / output signal lines 414. The watchdog 404.5 can monitor voltage values ​​determined by the voltage monitor 413. The voltage monitor 413 can be configured to determine and / or monitor one or more voltages in the quantum random number generator 400, and optionally also one or more voltages within a respective application circuit, such as the crypto engine 800 and / or a system 1000. The voltage monitor 413 can be, for example, an ADC.

[0135] One task of watchdog 404.5 can be to monitor the entropy quality of the random numbers at the output 411 of entropy extraction 404.4, which form the random bit stream ZBS. Watchdog 404.5 can be configured to detect at least three defined error cases. Watchdog 404.5 can forward valid quantum random bits 411, generating a seed value S, via a line 412 to a (backup) pseudo-random number generator (PRNG) 404.6, which can have another linear feedback shift register. Watchdog 404.5 can prevent the use of the valid quantum random bits by a finite state machine 404.8. This is connected here, for example, to the internal data bus 419. If an error occurs, the Watchdog 404.5 can set certain error bits for further evaluation, which another bus participant (e.g.a microcontroller (MCU)) can read and / or write via an external data bus DB, a data bus interface DBIF, and the internal data bus 419. If, for example, the watchdog 404.5 detects an error in the quantum random number generator 400, it can, for example, put the quantum random number generator 400 into an emergency mode. To do this, the watchdog 404.5 can, for example, B. set a selection signal 416 of a signal multiplexer 404.7 arranged downstream of the random number generation in such a way that the signal multiplexer 404.7 applies the pseudorandom number PRN of the optional PRNG 404.6 in the form of a stream of pseudorandom bits via a pseudorandom signal line 417 to the input of the finite state machine 404.8 instead of the random numbers RN at the output 411 of the entropy extraction 404.4 as a replacement for the at least potentially erroneous random number RN of the output 411 of the entropy extraction 404.4.

[0136] The optional additional linear feedback shift register of the PRNG 404.6 can be configured to generate pseudorandom numbers PRN. The seed value S can comprise the last valid quantum random bits of the output 411 of the entropy extraction 404.4. The watchdog 404.5 can then apply or output these last valid quantum random bits 411 to the input of the optional PRNG 404.6. The seed value S can thus be used as a random, secure starting value for a generator polynomial of the feedback of the optional additional linear feedback shift register of the PRNG 404.6 for generating the pseudorandom number PRN and signaling it via the pseudorandom signal line 417. The generator polynomial and the degree of the generator polynomial can be freely selected. The optional backup pseudo-random number generator 404.6 can enable the provision of secure random numbers, at least temporarily, in the event of an error.

[0137] The finite-state machine 404.8 can be configured to receive the random numbers forming the random bit stream ZBS or, optionally, the pseudorandom number PRN (optionally at the output of the signal multiplexer 404.7) and, based thereon, to generate at least one quantum random data word 418. Optionally, via a pseudorandom signal line 417, the quantum random data word 418 can be written by the machine 404.8 into a memory 404.9, optionally a volatile memory (RAM) or a FIFO (First In - First Out) memory. It is conceivable that the machine 404.8 sets a finish flag 404.10 via the internal data bus 419 as soon as the quantum random data word 418 has been written into the memory 404.9. A processor (MCU) can then, for example, access memory 404.9 and read out the quantum random data word 418 and use it, for example, for encryption.This means that, in addition to or as an alternative to the random bit data stream ZBS, the crypto engine 800 (see Figure 8) can also use the quantum random data word 418 for encryption. The description below with reference to the random bit data stream ZBS therefore applies analogously to the quantum random data word 418.

[0138] Figure 7 shows a schematic representation of an exemplary layout of an integrated electronic circuit 500 with the quantum random number generator 400 with the entropy source 401 in a pad frame 503 in a top view.

[0139] The integrated electronic circuit 500, for example, a microcontroller with a CPU, may have an inner region 505. Subcircuits of the integrated electronic circuit 500 may be located in the inner region 505.

[0140] The inner region 505 may be surrounded by a wiring region 504. Supply voltage lines, data bus lines, and / or other lines may be routed or located in the wiring region 504.

[0141] The wiring region 504 and the inner region 505 of the integrated electronic circuit 500 may be surrounded by a pad frame 503 (also referred to as a pad edge). The pad frame 503 may include connection pads 502 (optionally for electrical bonds and / or other electrical connections).

[0142] The entropy source 401 and / or the quantum random number generator 400 can be arranged entirely or at least substantially in the pad frame 503, more precisely between at least two connection pads 502. This may be possible because gaps between the individual connection pads 502 cannot be filled with electronic circuit components. However, these gaps must still be processed during the manufacture of the integrated electronic circuit 500 and can therefore incur manufacturing costs. Placing the entropy source 401 and / or the quantum random number generator 400 entirely or at least substantially in the pad frame 503 can therefore reduce the additional costs for their provision.

[0143] At least the photon source 55 and / or the photon detector 54 can be placed or arranged in the pad frame 503 (optionally between two connection pads 502). Furthermore, the ADC 403, the voltage converter 408 for supplying power to the entropy source 403, the pulse extension circuit 406, and / or other analog components of the quantum random generator 400 can be placed in the pad frame 503 (optionally between two connection pads 502).

[0144] Figure 8 shows a schematic representation of a system for encrypted communication 1000 with a quantum random number generator, optionally the quantum random number generator 400 described above, a crypto engine 800 and a data interface 600.

[0145] The system 1000 is connected to an external data processing device or an external computer system 700, optionally a microprocessor or an MCU, via the data interface 600 and a data bus 601.

[0146] The quantum random number generator 400 has at least the entropy source 401 described above. The quantum random number generator 400 can be the quantum random number generator 400 described above, i.e., the quantum random number generator 400 can comprise, in addition to the entropy source 401, one or more of the units described above with reference to Figure 5. The above description therefore also applies analogously to the system 1000. Insofar as individual units of the quantum random number generator 400 are described again below with reference to Figure 8, this description also applies to the quantum random number generator 400 described above.

[0147] The quantum random number generator 400 is configured to output the random bit data stream ZBS generated as described above to the crypto engine 800.

[0148] The crypto engine 800 can be configured to encrypt a first random bit portion of the random bit data stream ZBS into an encrypted random bit data stream VZS. For this purpose, the crypto engine 800 can use a key that can be stored in a memory 801 of the crypto engine 800.

[0149] The MCU 700 may be configured to retrieve encrypted random bits as encrypted random numbers via the data bus 601 and the data interface 600.

[0150] The crypto engine 800 may be configured to decrypt encrypted commands from the external computer system 700 to the system 1000, which the MCU 700 outputs to the system 1000 via the data bus 601 and the interface 600.

[0151] The crypto engine 800 can be configured to output the decrypted commands to the system 1000 or to use them itself if the crypto engine 800 itself is the recipient of such a decrypted command. This allows the MCU 700 to securely control the system 1000.

[0152] The watchdog 404.5 or a similar device may be configured to monitor an entropy of the random bit stream ZBS, an operating voltage of the entropy source 401 and / or the voltage converter 408, which provides the supply voltage VSUP for the entropy source 401, an externally applied supply voltage and / or a supply voltage device CLV for supply voltage of the digital device parts for correct function or correct values.

[0153] Further monitoring circuits 1001 may be configured to detect further anomalies.

[0154] A voltage pre-regulator 1002 may be configured to supply further voltage regulators with electrical energy and to keep the current constant (to exclude side channels via the power consumption).

[0155] A test interface 1003 can enable a manufacturing test.

[0156] That is, Figure 8 shows a schematic representation of a system for encrypted communication 1000 with a quantum random number generator, optionally the quantum random number generator 400 described above, a crypto engine 800, and a data interface 600. The system 100 is connected to an external data processing device, optionally a microprocessor or MCU 700, via the data interface 600 and a data bus 601. The quantum random number generator 400 has at least the entropy source 401 described above.

[0157] In detail, the quantum random number generator 400 generates a random bit stream ZBS of random bits that are used in the crypto engine 800 for key generation and / or other cryptographic operations. The entropy source 401 described above enables a high random bit rate in the random bit stream ZBS, which improves the security of the cryptographic operations of the crypto engine 800.

[0158] The quantum random number generator 400 can enable a high random bit rate, which can form the basis for secure cryptographic operations. This high random bit rate can significantly increase security against quantum attacks. The high random bit rate can ensure high security and efficiency by forming the basis for fast and secure key generation and encryption operations.

[0159] The crypto engine 800 may include an encryption unit 801 configured to generate at least one cryptographic key based on a first random bit portion of the random bit stream ZBS. The encryption unit 801 may be configured to encrypt data that the system 1000 sends to other bus users via a data bus 600 in the form of an output data stream VZS based on the generated key. Encryption in the crypto engine 800 may be performed using a computer- and / or machine-implemented algorithm.

[0160] The crypto engine 800 can optionally be realized entirely as a computer-implemented device.

[0161] The crypto engine 800 may include a memory 802. The computer-implemented encryption algorithm, more precisely the program code, may be stored in the memory 801, at least temporarily.

[0162] The crypto engine 800 may include a CPU 803. When executing the computer-implemented algorithm, the CPU 803 may execute the algorithm's program code stored in memory 802. This may produce a technical effect in the form of secure encryption of data that the system 1000 sends to another bus participant (e.g., the MCU 700) via the data bus 601. The CPU 803 is not exclusively to be understood as a component of the crypto engine 800, but may also be a component of the system 1000 and / or the quantum random number generator 400.

[0163] The data sent or output by system 1000 may include a second random bit portion of random bit stream ZBS. The intersection of the first set of the first random bit portion of random bit stream ZBS and the second set of the second random bit portion of random bit stream ZBS may be empty or zero, so that no random bits are sent from system 1000 to other bus devices (e.g., MCU 700) of data bus 601 that system 1000 used to encrypt the data.

[0164] The quantum random number generator 400 can have an entropy module—also called a watchdog 404.5—which can be configured to monitor the entropy of the random bits of the random bit stream ZBS generated by the quantum random number generator 400 or of random data derived therefrom. The entropy module 404.5 can be configured to determine and / or monitor a measured value for a predetermined parameter of the entropy of the random bits of the random bit stream ZBS. Such measured values ​​can be, for example, a mean value, a standard deviation, etc. The entropy module 404.5 can be configured to compare the measured value with a permissible value range and to take a predetermined countermeasure if the measured value lies outside the permissible value range. In this way, the entropy module 404.5 ensure that sufficient randomness is present to guarantee secure cryptographic operations using the random bits of the random bit stream ZBS. If necessary, the entropy module 404.5 can also require reasonable deviations from randomness from a security-practical perspective. For example, it can invert the random bit stream ZBS for the subsequent random bits of the random bit stream ZBS whenever the quantum random number generator 400 has generated a predetermined number of consecutive random bits in the random bit stream ZBS with the same logical content. Optionally, this function of deliberately deviating from an ideal random bit stream ZBS can be switched on and off via the data interface 601 of the system 1000 by means of an encrypted write command to a register or a flag of the quantum random number generator 400 or one of its device components. The entropy module 404.5 can perform this monitoring using a computer- and / or machine-implemented algorithm. The program code of the computer-implemented algorithm can be stored in a memory 404.9 of the quantum random number generator 400. The program code can be executed by a CPU of the quantum random number generator 400 or the system 1000. The use of an entropy module 404.5 can provide the advantage of increased security of the cryptographic processes of the crypto engine 800 and improved usability of the random bits of the random bit stream ZBS of the quantum random number generator 400.

[0165] The quantum random number generator 400 can include a filter module—also referred to as entropy extraction 404.4. The filter module 404.4 of the quantum random number generator 400 can be configured to improve the statistical properties of the random bits of the random bit stream ZBS by removing systematic patterns and / or ensuring the uniform distribution of the random bits. A computer- and / or machine-implemented algorithm can also be used here (whereby the above description with reference to the algorithms applies analogously). Optionally, the filter module is part of a control logic. The filter module 404.4 can offer the advantage of optimizing the random bits of the random bit stream ZBS for cryptographic applications. Optionally, the filter module 404.5 comprise a digital high-pass filter which limits the ideal white noise of an ideal random bit data stream towards low frequencies, which has the effect of avoiding too many consecutive random bits in the random bit stream ZBS of the same logical content.

[0166] The system 100 may include an interface unit - also known as a data bus interface

[0167] 600 - which can be designed to enable encrypted communication of the system 1000, more precisely the crypto engine 800, with an external system, which as a bus participant on a common data bus

[0168] 601 are connected. The interface unit 600 can be configured to support at least one or more different communication protocols. This can enable the use of the system 1000 in different networks. Optionally, the interface unit 600 can be configured for this purpose via a voltage level at designated external terminals and / or via special cryptographic commands. The interface unit 600 can ensure that encrypted data VZS can be securely transmitted by the system 1000 and thus by the crypto engine 800. The control of the communication protocols can comprise a computer- and / or machine-implemented algorithm (whereby the above description with reference to the algorithms applies analogously) and / or software programs (unless explicitly stated otherwise herein, computer-implemented also means machine-implemented).In this way, secure data transmission between quantum random number generator 400 and / or crypto engine 800 and / or other bus participants (e.g., MCU 700) of the shared data bus 601 can be achieved. The data that the system 1000 and / or the crypto engine 800 transmits as part of the system 1000 to other bus participants 700 of the data bus 601 can again comprise the said second random bit portion of the random bits of the random bit stream ZBS of the quantum random number generator 400 and / or status information of the quantum random number generator 400 and / or its device parts and / or status information of the crypto engine 800 and / or status information of other device parts of the system 1000. The data that the system 1000 and / or the crypto engine 800 receives from other bus participants (e.g.,MCU 700) via the data bus 601, again comprising said control data for configuring the quantum random number generator 400 and / or the crypto engine 800.

[0169] The system 1000 and / or the crypto engine 800 and / or the quantum random number generator 400 may include one or more CPU cores and / or one or more memories in which program code for a computer- and / or machine-implemented emulation of device parts of the system 1000 and / or the crypto engine 800 and / or the quantum random number generator 400 and / or other device parts of the system 1000 is stored, at least temporarily.

[0170] During operation of the system 1000, the quantum random number generator 400 can continuously generate random bits of the random bit stream ZBS. The generated random bits can be monitored by the entropy module 404.5 to ensure that they actually have sufficient entropy.

[0171] The monitored random bits may be filtered by the filter module 404.4, optionally to ensure that they do not contain any systematic patterns, are evenly distributed and / or do not include any random structures that could ultimately result in the random sending of messages in plaintext over a period of time.

[0172] The first random bit portion of the filtered random bits can be supplied to the encryption unit 801 of the crypto engine 800, which uses the random bits of the first filtered random bit portion to generate cryptographic keys and / or to encrypt data of the system 1000.

[0173] The interface unit 600 can ensure the secure transmission of the encrypted data to external systems or other bus participants (e.g. MCU 700) of the external data bus 601.

[0174] The cooperation of these device parts can ensure high security of the system 1000 and the crypto engine 800 because the generated random bits are highly random and the cryptographic operations are therefore very difficult to compromise.

[0175] The crypto engine 800 may include a key management unit 804. The key management unit 804 may be configured to manage the generated cryptographic keys, store them, and / or make them available to the required processes or units that require them. This has the advantage of securely managing the keys of the crypto engine 800.

[0176] The system 1000 may include a line control unit that may be configured to monitor signals on communication lines running between the various modules of the system 1000 and / or the crypto engine 800. This may ensure that data integrity is maintained.

[0177] The performance control unit can be part of a so-called watchdog of the system 1000, which monitors the correct functioning of the system 1000 (health check) and, if necessary, detects attacks or measures the probability of an attack currently taking place and, if necessary, determines a corresponding measured value.

[0178] It is conceivable that the crypto engine 800 is implemented as a post-quantum crypto engine or includes one. The crypto engine 800 can thus be protected against attacks by quantum computers and, possibly, modern artificial intelligence algorithms.

[0179] The crypto engine 800 and / or the system 1000 can include a post-quantum coprocessor 805. The post-quantum coprocessor PQK can be defined as a special processor designed to execute computer- and / or machine-implemented post-quantum cryptography algorithms. Optionally, the post-quantum coprocessor 805 is a device part of the crypto engine 800. The post-quantum coprocessor 805 can also be a device part of the system 100 and interact with the crypto engine 800. This allows for increased resistance to quantum attacks.

[0180] The Crypto Engine 800 and / or the System 1000 may use one or more of the following methods for PQC encryption:

[0181] ’BIKE1 -L1 -CPA’, ’BIKE1 -L3-CPA’, ’BIKE1 -L1 -FO’, ’BIKE1 -L3-FO’, ’Kyber512’, ’Kyber768’, ’Kyber1024’, ’Kyber512-90s’, ’Kyber768-90s’, ’Kyber1024-90s’, ’LEDAcryptKEM-LT12’, ’LEDAcrypt-KEM-LT32’, ’LEDAcryptKEM-LT52’, ’NewHope-512-CCA’, ’NewHope-1024-CCA’, ’NTRU-HPS-2048-509’, ’NTRU-HPS- 2048-677’, ’NTRU-HPS-4096-82T, ’NTRU-HRSS-701 ’, ’LightSaber-KEM’, ’Saber- KEM’, ’FireSaber-KEM’, ’BabyBear’, ’BabyBearEphem’, ’Mama-Bear’, ’MamaBearEphem’, ’PapaBear’, ’PapaBearEphem’, ,FrodoKEM-640-AES’, ’FrodoKEM-640-SHAKE’, ’FrodoKEM-976-AES’, ’FrodoKEM-976-SHAKE’, ’FrodoKEM-1344-AES’, ’FrodoKEM-1344-SHAKE’, ’SIDH-p434’, ’SIDH-p503’, ’SIDH-p610’, ,SIDH-p75T, ’SIDH-p434-compressed’, ’SIDH-p503-compressed’, ’SIDH-p610-compressed’, ’SIDH-p751 -compressed’, ’SIKE-p434’, ’SIKE-p503’, ’SIKE-p610’, ’SIKE-p75T, ’SIKE-p434-compressed’, ’SIKE-p503-compressed’, ’SIKE-p610-compressed’, ’SIKE-p751 -compressed’.

[0182] The Crypto Engine 800 and / or the System 1000 may use one or more of the following PQC signature methods for signing data messages:

[0183] 'DILITHIUM_2', 'DILITHIUM_3', 'DILITHIUM_4', 'MQDSS-31 -48', MQDSS-31 -64', SPHINCS+-Haraka-128f-robust', SPHINCS+-Haraka-128f-simple', 'SPHINCS+- Haraka-128s-robust', 'SPHINCS+-Haraka-128s-simple', 'SPHINCS+-Haraka-192f- robust', 'SPHINCS+-Haraka-192f-simple', 'SPHINCS+-Haraka-192s-robust',

[0184] 'SPHINCS+-Haraka-192s-simple', 'SPHINCS+-Haraka-256f-robust', 'SPHINCS+- Haraka-256f-simple', 'SPHINCS+-Haraka-256s-robust', 'SPHINCS+-Haraka-256s- simple', 'SPHINCS+-SHA256-128f-robust', 'SPHINCS+-SHA256-128f-simple', 'SPHINCS+-SHA256-128s-robust', 'SPHINCS+-SHA256-128s-simple',

[0185] ’SPHINCS+-SHA256-192f-robust’, ’SPHINCS+-SHA256-192f-simple’, ’SPHINCS+- SHA256-192s-robust’, ’SPHINCS+-SHA256-192s-simple’, ’SPHINCS+-SHA256- 256f-robust’, ’SPHINCS+-SHA256-256f-simple’, ’SPHINCS+-SHA256-256s- robust’, ’SPHINCS+-SHA256-256ssimple’, ’SPHINCS+-SHAKE256-128f-robust’,

[0186] SPHINCS+-SHAKE256-128f-simple’, ’SPHINCS+-SHAKE256-128s-robust :

[0187] SPHINCS+-SHAKE256-128s-simple’, ’SPHINCS+-SHAKE256-192f-robusf

[0188] SPHINCS+-SHAKE256-192fsimple’, ’SPHINCS+-SHAKE256-192s-robust :

[0189] SPHINCS+-SHAKE256-192s-simple’, ’SPHINCS+-SHAKE256-256f-robust :

[0190] SPHINCS+-SHAKE256-256fsimple’, ’SPHINCS+-SHAKE256-256s-robust :

[0191] ’SPHINCS+-SHAKE256-256s-simple’,m’picnic_L1_FS’, ’picnic_L1_UR’,

[0192] 'picnic_L3_FS', 'picnic_L3_UR', 'picnic_L5_FS', 'picnic_L5_UR', 'picnic2_L1_FS', 'picnic2_L3_FS', 'picnic2_L5_FS', 'qTesla-p-l', 'qTesla-p-IH'.

[0193] The second random bit portion of the random bit stream ZBS can be used to generate the respective signatures and keys. The crypto engine 800 and / or the system 1000 can comprise a (quantum-resistant) key generator 806. This key generator 806 is optionally part of the crypto engine 800 and / or the system 1000 and can be configured to generate a key that is (according to the current state of the art) resistant to quantum attacks. The quantum-resistant key generator 806 can achieve this by using random bits from the first random bit portion of the random bit stream ZBS to generate the key. This allows secure, quantum-resistant keys to be generated.

[0194] The quantum random number generator can be designed to provide a random bit rate of the random bit stream ZBS that is high enough to generate quantum-resistant keys.

[0195] These keys can be generated by the quantum-resistant key generator 806 and then used by the post-quantum coprocessor 805 to encrypt the data transmitted by the system 1000 and / or its crypto engine 800 and / or its device components.

[0196] The interface unit 600 may be configured to ensure that the quantum-resistant keys are transmitted securely.

[0197] This ensures the security of data transmission to and from System 1000.

[0198] The system 1000 may be designed for applications that require high computing power, such as high-frequency trading systems or other time-critical applications.

[0199] The system 1000 and / or the crypto engine 800 may include a parallel encryption processor 807. This parallel encryption processor 807 may enable the crypto engine 800 to perform multiple encryption operations simultaneously to minimize processing time. The system may include more than one CPU and / or more than one quantum random number generator 400 to operate or perform the encryption operations, optionally implemented as algorithms. This may have the advantage of enabling the system 1000 to process data more quickly.

[0200] System 1000 may include a (fast) clock line 808 (or a clock line 808 that operates at a higher frequency than the other clock lines). Clock line 808 may be configured to synchronize operations of parallel encryption processor 807 with the other modules of crypto engine 800 and / or system 1000. This may prevent delays. This may result in desired synchronization.

[0201] The quantum random number generator 400 can provide the required random bits at a high random bit rate, which are forwarded directly to the parallel encryption processor 807. The parallel encryption processor 808 can be configured to use these random bits to perform parallel encryption operations. The clock line 808 can be configured to ensure that the operations of the device components of the system 1000 are synchronized. Performing the parallel encryption by the parallel encryption processor 807 can have the advantage of providing the system 1000 with increased processing speed. This can provide high computing power and enable the simultaneous execution of multiple cryptographic operations, which can be advantageous in time-critical applications.

[0202] An energy-efficient crypto engine 800 can be provided, e.g., for use in a mobile device (e.g., smartphone, tablet, etc.) and / or an IoT system. The crypto engine 800 and / or the system 1000 can have an energy-saving module 809. This energy-saving module 809 can be configured to monitor and / or regulate energy consumption of the system 1000 and / or the crypto engine 800. It is conceivable that the energy-saving module 809 is configured to deactivate unused modules of the system 1000 and / or the crypto engine 800 and / or reduce their power. This can achieve a desired energy saving.

[0203] It is conceivable that system 1000 receives encrypted commands via data bus 601 that restrict and / or stop the generation of random bits. System 1000 may also have, for example, a power-down pin to reduce energy consumption. This can be advantageous, among other things, because entropy source 401 may require increased voltages. This, in turn, can optimize energy consumption.

[0204] The crypto engine 800 and / or the system 1000 may include a (low-power) clock line 810, i.e., a dedicated clock line operating at a (lower) frequency (or a frequency that is low or small compared to the other frequencies used). This may reduce power consumption.

[0205] Function and interaction: The internal random number generator (RNG) operates either in a low-power mode with lower power consumption and typically a lower random bit rate (which can then be zero) or in a normal operating mode with increased power consumption and a higher random bit rate. The low-power clock line ensures that only the necessary random bits are generated. The low-power clock line synchronizes the operations of the RNG and the crypto engine (KE) at low power consumption. The technical effect of this variant is a significant reduction in power consumption while maintaining the security of the cryptographic operations. Advantages: This variant is particularly suitable for use in battery-operated devices, as it minimizes power consumption.

[0206] Disadvantages: The reduced performance may not be sufficient in applications that require high computing power.

[0207] A security-focused crypto engine 800 can be deployed. The crypto engine 800 can meet the highest security requirements.

[0208] The crypto engine 800 and / or the system 1000 may include a security monitor 811. The security monitor 811 may be configured to continuously monitor a state of the quantum random number generator 400, the crypto engine 800 and / or the other device parts of the system 1000. The security monitor 811 may be configured to shut down and / or reconfigure the quantum random number generator 400, the crypto engine 800 and / or other device parts of the system 1000 in the event of a (detected) attack and / or error and / or to put them into a predetermined secure mode and / or an emergency mode. The security module 811 may be configured to provide one or more bus participants (e.g.The security monitor 811 can be part of the above-described watchdog 404.5, which carries out the health check. The security monitor 811 can be implemented entirely or at least substantially in hardware to reduce its vulnerability to manipulation.

[0209] The crypto engine 800 and / or the system 1000 may include a (secure) communication unit 812, which may be configured to ensure encrypted and / or tap-proof communication via the interface 600, optionally all external interfaces of the system 1000. Secure communication can thereby be achieved.

[0210] Encrypted or secure communications can refer to the use of technologies and procedures that ensure the confidentiality and integrity of information during transmission. Such communication technologies protect messages from unauthorized access, interception, and / or tampering by third parties.

[0211] Encryption can be understood as the process by which a message (plaintext) is converted into unreadable text (ciphertext) using an algorithm. An unauthorized third party who intercepts the message cannot read it without the appropriate decryption key. Examples of encryption methods include symmetric encryption (e.g., AES) and / or asymmetric encryption (e.g., RSA).

[0212] The quantum random number generator 400 can continuously supply random bits, which can be monitored for their integrity by the security monitor 811. The communication unit 812 can ensure that (all external) data transmissions via the data bus 601 are encrypted and / or protected against eavesdropping attempts. A high level of security of the crypto engine 800 and the system 1000 can be achieved through computer- and / or machine-implemented monitoring algorithms of the security monitor 811 and / or encryption software of the communication unit 812.

[0213] Each of the modules can be implemented in hardware and / or software. One, several, or all of the modules described herein can be controlled by one or more computer- and / or machine-implemented algorithms. A CPU of the quantum random number generator 400, the crypto engine 800, and / or the CPU of the system 1000 can be configured to execute a respective program code of the algorithm(s). The algorithm(s) can be stored in a memory of the quantum random number generator 400, the crypto engine 800, and / or the CPU of the system 1000. Control is also understood to mean pure regulation, i.e., control with feedback.

[0214] Several optional uses of the products or devices described above are described below as examples.

[0215] It is conceivable that the system 1000 described above and / or the quantum random number generator 400 described above are used in a robot or a device for the automated control of a system. This can be, for example, a driver assistance system of a motor vehicle. It is conceivable that the driver assistance system is designed to control the lateral and / or longitudinal guidance of a motor vehicle based on the random bit data stream ZBS generated by the quantum random number generator 400.

[0216] It is conceivable that the system 1000 described above and / or the quantum random number generator 400 described above is used in a mobile device (e.g., a smartphone, tablet, etc.) and / or an IoT system. Integration of the system 1000 and / or the quantum random number generator 400 into a security chip for smartphones or other handheld or mobile devices or data processing devices, such as laptops, is conceivable. This chip can enable cryptographic key generation. Additionally, or alternatively, this chip can also offer a high degree of tamper resistance. The keys can, for example, be generated on-site or on-demand using the entropy source 401, so that even if the device is compromised, no keys are stored and / or are present that can be stolen.Additionally or alternatively, an integration of the system 1000 and / or the quantum random number generator 400 for cryptographically securing data transactions across different mobile applications is conceivable. For this purpose, a software layer can be provided that interacts with the system 1000 and / or the quantum random number generator 400 to obtain keys used for encrypting and decrypting application data. This can ensure consistent data security for various applications on the mobile device or the IoT system. A communication protocol that uses the keys generated as described above to establish and / or maintain secure communication connections is also conceivable.In other words, the system 1000 and / or the quantum random number generator 400 can be seamlessly integrated into (optionally existing) mobile communication protocols to create quantum-safe communication networks. A blockchain system on the smartphone that uses the output data of the system 1000 and / or the quantum random number generator 400 is also conceivable. This can significantly improve the security and resilience against attacks on the blockchain and further secure the transactions and data stored there. The random numbers generated by the quantum random number generator can be used as cryptographic keys to secure the blockchain, making blockchain technology even more suitable for applications such as cryptocurrencies, contract tracing, etc. on mobile devices.

[0217] It is conceivable that the system 1000 described above and / or the quantum random number generator 400 described above is / are used in a connector.

[0218] Reference symbol

[0219] 10 p doped substrate

[0220] 29 n area (HVNW / NEPI)

[0221] 22 first area (e.g. NBL)

[0222] 32 second area (e.g. PBL)

[0223] 45 n+ area (N+)

[0224] 46 p+ area (PBODY)

[0225] 47 Absorption area

[0226] 48 epitaxial layer

[0227] 49 Carrier substrate

[0228] 51 p+ area (P+)

[0229] 50 first pn junction

[0230] 52 second pn junction

[0231] 53 Metallization or metal layer

[0232] 54 photon detector

[0233] 541 floor space

[0234] 542 deck area

[0235] 543 Side surface / Shell surface

[0236] 55 Photon source

[0237] 551 floor space

[0238] 552 deck area

[0239] 553 Side surface / Shell surface

[0240] 554 third pn junction

[0241] 58 photons

[0242] 110 Substrat

[0243] 122 Cathode photon source

[0244] 132 Cathode photon detector

[0245] 124, 134 anode

[0246] 141 Metallization

[0247] 142 Metallization Quantum Random Number Generator

[0248] Entropy source

[0249] Analog-to-digital converter

[0250] Pseudorandom number generator

[0251] Entropy extraction or filter module

[0252] (Backup) pseudo-random number generators

[0253] Signal multiplexer finite state machine

[0254] memory

[0255] Finish Flag 404.10

[0256] Output signal entropy source

[0257] Pulse extension circuit

[0258] Output signal analog-to-digital converter

[0259] Voltage converter

[0260] Output signal of the pseudorandom number generator

[0261] Output entropy extraction or filter module

[0262] Management of WatchdogZ (backup) pseudo-random number generators

[0263] Voltage monitor

[0264] Input / output signal lines synchronized voltage signal

[0265] selection signal

[0266] Quantum random data word internal data bus

[0267] Voltage converter line integrated electronic circuit

[0268] Frame / outer edge

[0269] Connection pad

[0270] Pad frame

[0271] Wiring area inner area 600 data interface

[0272] 601 external data bus

[0273] 700 external data processing device

[0274] 800 Crypto Engine

[0275] 801 Crypto Engine Memory

[0276] 802 memory

[0277] 803 CPU

[0278] 804 Key management unit

[0279] 805 Post-Quantum Coprocessor

[0280] 806 (quantum-resistant) key generator

[0281] 807 (parallel) encryption processor

[0282] 808 (fast) clock line

[0283] 809 Energy saving module

[0284] 810 (low-power) clock line

[0285] 811 Security Monitor

[0286] 812 (secure) communication unit

[0287] 1000 system for encrypted communication

[0288] 1001 monitoring circuits

[0289] 1002 voltage pre-regulator

[0290] 1003 test interface

[0291] VDD supply voltage line

[0292] VENT supply voltage line

[0293] VREF reference voltage line

[0294] GND reference potential line

[0295] ZBS random bit (data) stream

[0296] VZS encrypted random bit data stream 0 Surface of the substrate

[0297] S Surface of the carrier substrate

Claims

Claims 1. Monolithically integrated entropy source (401), optionally for a quantum random number generator (400), wherein the entropy source (401) comprises: - a photon source (55) configured to emit photons (58), the photon source (55) comprising: - a first outer shell, wherein the first outer shell is formed by a first base surface (551), a first cover surface (552) and at least one first side surface (553) which connects the first base surface (551) and the first cover surface (552) to one another, and - a photon detector (54) configured to detect the photons (58) emitted by the photon source (55), characterized in that the first base surface of the photon source (55) is arranged facing the photon detector (54).

2. Entropy source (401) according to claim 1, characterized in that the photon detector (54) comprises: - a second outer shell, wherein the second outer shell is formed by a second base surface (541), a second cover surface (542) and at least one second side surface (543) connecting the second base surface (541) and the second cover surface (542), - wherein the first base surface (541) of the photon source (55) is arranged facing the second base surface (541) of the photon detector (55).

3. Monolithically integrated entropy source (401), optionally for a quantum random number generator (400), wherein the entropy source (401) comprises: - a photon source (55) designed to emit photons (58), and - a photon detector (54) configured to detect the photons (58) emitted by the photon source (55), the photon detector (54) comprising: - a second outer shell, wherein the second outer shell is formed by a second base surface (541), a second cover surface (542) and at least one second side surface (543) which connects the second base surface (541) and the second cover surface (542) to one another, characterized in that - the second base surface (541) of the photon detector (54) is arranged facing the photon source (55).

4. Entropy source (401) according to one of the preceding claims, characterized in that the photon source (55) is a silicon LED and / or a single photon source, optionally a SPAD or an avalanche Zener diode, wherein the avalanche Zener diode optionally has a breakdown voltage of less than 10 V.

5. Entropy source (401) according to one of the preceding claims, characterized in that the photon source (55) comprises: - a third pn junction (554) formed from a third p-layer (46) and a third n-layer (45), - wherein the third p-layer (46) and the third n-layer (45) are optionally in contact with each other.

6. Entropy source (401) according to one of claims 1 to 5, characterized in that the photon detector (54) comprises a single-photon detector, optionally a single-photon avalanche diode, optionally a SPAD.

7. Entropy source (401) according to one of claims 1 to 6, characterized in that the photon detector (55) comprises: - a first pn junction (50) formed from a first p-layer (32) and a first n-layer (22), - wherein the first p-layer (32) and the first n-layer (22) are optionally in contact with each other.

8. Entropy source (401) according to claim 7, characterized in that the photon detector (55) comprises: - an absorption region (47) designed and arranged to absorb the photons (58) emitted by the photon source (55) such that the absorption region (47) generates, optionally exactly, one electron-hole pair per photon (58), - wherein the absorption region (47) is in contact with the first pn junction (50) and the first pn junction (50) is designed to generate a charge avalanche due to the generated electron-hole pair, and - the photon detector (54) is designed to detect the respective photon (58) emitted by the photon source (55) based on the generated charge avalanche.

9. Entropy source (401) according to claim 8, characterized in that the absorption region (47) has or consists of a p-doped substrate (10) which completely covers a surface of the first pn junction (50) facing in the direction of the photon source (55).

10. Entropy source (401) according to claim 8, characterized in that the absorption region (47) has a p-doped substrate (10) which only partially covers a surface of the first pn junction (50) facing the photon source (55) and a surface extending from this surface of the first pn junction (50) in the direction of the photon source (55) extending channel which is laterally delimited by an n-doped substrate (29).

11. Entropy source (401) according to claim 8, characterized in that the absorption region (47) has or consists of an n-doped substrate (29) which completely covers a surface of the first pn junction (50) facing in the direction of the photon source (55).

12. Entropy source (401) according to one of claims 8 to 11, characterized in that the absorption region (47) is in contact with the photon source (55), optionally a p-doped substrate (46) of the photon source (55).

13. Entropy source (401) according to one of claims 1 to 12, characterized in that the photon detector (55) comprises: - a second pn junction (52) formed from a second p-layer (32) and a further or the first n-layer (22), - wherein the second p-layer (32) and the further or the first n-layer (22) are optionally in contact with each other.

14. Entropy source (401) according to one of claims 1 to 13, characterized in that the entropy source (401) has a metal layer (53), optionally together with an internal silicide layer, which shields the entropy source (401) from the outside.

15. Entropy source (401) according to claim 14, characterized in that the entropy source (401) has at least two anodes (124, 134) for the photon source (55) and the photon detector (54), which are conductively connected to one another via the metal layer (53).

16. Entropy source (401) according to one of the preceding claims, characterized in that the photon source (55) and / or the Photon detector (54), optionally the entropy source (401) as a whole, is rotationally symmetrical along an axis which is perpendicular to the first and / or the second base surface (541, 551).

17. Entropy source (401) according to one of the preceding claims, characterized in that the entropy source (401) is manufactured using BCD technology.

18. Entropy source (401) according to one of claims 1 to 17, characterized in that the entropy source (401) comprises: - a substrate (110) with a carrier substrate (49) and an epitaxial layer (48), - wherein, as far as referring back to any one of claims 7 to 13, the epitaxial layer (48) has the first pn junction (50), and, as far as referring back to claim 13, the carrier substrate (49) has the second pn junction (52).

19. Entropy source (401) according to one of claims 1 to 18, characterized in that an upper and / or lower side of the entropy source (401) is mirrored at least in the region of the photon source (55) and / or the photon detector (54) and / or comprises a light-blocking layer.

20. A method for operating an entropy source (401) according to any one of claims 1 to 19, characterized in that the method comprises: - Emitting the photons (58) by means of the photon source (55) so that the photons (58) leave the photon source (55) via its first base surface (551) in the direction of the photon detector (54), and / or - receiving the photons (58) emitted by the photon source (55) at the second base surface of the photon detector.

21. Quantum random number generator (400), characterized in that the quantum random number generator (400) comprises: - the entropy source (401) according to one of the preceding claims, and - an electronic circuit configured to generate a random bit (411) in response to an output signal (405) of the entropy source (401), and optionally to output the generated random bit (411), - wherein a characteristic of the output signal (405) of the entropy source (401) depends on a temporal frequency of the photons (58) detected by the photon detector (54).

22. Quantum random number generator (400) according to claim 21, characterized in that the quantum random number generator (400) comprises a pseudorandom number generator (404.3) which is designed to generate a digital output signal (410) based on the output signal (405) of the entropy source (401) and an optionally predetermined or adjustable generator polynomial.

23. Quantum random number generator (400) according to claim 22, characterized in that the quantum random number generator (400) comprises an entropy extraction (404.4) configured to generate the random bit (411) based on the digital output signal (410) of the pseudorandom number generator (404.3).

24. Quantum random number generator (400) according to claim 23, characterized in that the entropy extraction (404.4) is designed to generate the random bit (411) in which: - determines a first value and a second value of the digital output signal (410), - sets a value of an output of the random bit generation unit (404.4) to a first logical value if the first value of the digital output signal (410) is smaller than the second value of the digital output signal (410) and the difference between the first value of the digital output signal (410) and the second value of the digital output signal (410) is greater than a minimum difference (e), - to set the value of the output of the random bit generation unit (404.4) to a second logical value if the first value of the digital output signal (410) is greater than the second value of the digital output signal (410) and the difference between the first value of the digital output signal (410) and the second value of the digital output signal (410) is greater than the minimum difference (e).

25. Quantum random number generator (400) according to claim 24, characterized in that the random bit generation unit (404.4) is designed to discard the first value of the digital output signal (410) and the second value of the digital output signal (410) of the digital signal (410) if a difference between the first and the second value is smaller than a predetermined minimum difference (e).

26. Quantum random number generator (400) according to claim 25, characterized in that the quantum random number generator (400) comprises a monitoring unit (404.5) configured to monitor the output of the random bit generation unit, optionally to detect a malfunction of the quantum random number generator (400) when a number of discarded values ​​of the random bit generation unit (404.4) exceeds a predetermined limit.

27. Integrated electronic circuit (500), characterized in that the circuit (500) comprises a monolithically integrated entropy source (401) according to one of claims 1 to 19 and / or a quantum random number generator (400) according to one of claims 21 to 26, wherein the integrated electronic circuit (500) is optionally a microelectronic integrated circuit.

28. System (1000), characterized in that the system (1000) comprises: - the entropy source (401) according to one of claims 1 to 19, optionally the quantum random number generator (400) according to one of claims 21 to 26, and - a crypto engine (800) configured to encrypt a data stream using the output signal (405) of the entropy source (401), optionally using the random bit generated by the quantum random number generator (400).

29. System (1000) according to claim 28, characterized in that - the quantum random number generator (400) is designed to output a plurality of the random bits in the form of a random bit stream (ZBS), and - the crypto engine (800) is designed to use a first part of the random bit stream (ZBS) for generating keys.

30. System (1000) according to claim 29, characterized in that - the crypto engine (800) is designed to use the generated keys to encrypt a second part of the random bit stream (ZBS) in order to obtain an encrypted random bit data stream (VZB).

Images