Electronic device for generating random numbers

Abstract

Electronic Device for Random Number Generation This description relates to an electronic device (1) comprising: a first ring oscillator (RO1) and a second ring oscillator (RO2); a synchronous flip-flop (FF); a counter (COUNTER); a first circuit (Nm CTRL) configured to modify a period of at least one of the two oscillators (RO1, RO2) so that an average difference between the periods of the two oscillators is equal to a target difference; and a second circuit (PROCESS) configured to: initialize a value of an integer K, calculate sums (VAL) of K successive values ​​of the counter (COUNTER), calculate an Allan variance (VAR) on the calculated sums (VAL), and set K to its current value if the calculated variance is greater than a first threshold and increment K otherwise. Figure for the abstract: Fig. 1

Description

Title of the invention: Electronic device for generating random numbers. Technical field

[0001] This description relates generally to electronic circuits, and more particularly to the entropy sources implemented in electronic circuits to generate random numbers. Previous technique

[0002] Many electronic circuits implement a True Random Number Generation (TRNG) function. To do this, these circuits have an entropy source from which random information, or randomness, is extracted. This random information, also called, for example, a measurand, is then used to generate random numbers. For example, the random numbers thus obtained are used to generate encryption keys, signatures, etc.

[0003] Known sources of entropy are based on the jitter of a ring oscillator. Ring oscillators are widely used due to their simplicity and the strong understanding of their theoretical models. The uncertainty (or jitter) in the actual period of an output signal from a ring oscillator relative to the theoretical period of that signal is exploited as a source of randomness. This uncertainty increases with the number of accumulated periods (or equivalently, the accumulation time).

[0004] The physical phenomena that cause jitter are well documented in the literature. The model generally used as a theoretical basis is that proposed by Hajimiri et al. in the article "Jitter and phase noise in ring oscillators" in the IEEE Journal of Solid-State Circuits, vol. 34, no. 6, June 1999. This model defines the susceptibility function of the output signal of a ring oscillator to generating phase noise in response to a disturbance. More specifically, only a disturbance occurring during the transient phases (rising or falling) of the output signal is capable of inducing phase noise in that signal. Furthermore, the model describes the effect of different physical sources of noise on accumulated jitter.These phenomena are expressed as thermal noise from thermal agitation and as flicker noise induced by the charging / discharging of gate oxide traps, or, in other words, by the trapping / untrapping of charges in the gate oxide, of metal-oxide semiconductor (MOS) transistors implementing the ring oscillator or by the. carrier diffusion in the channel of these transistors. Indeed, the accumulated jitter has two regions: a region varying linearly with the variance of the jitter, which corresponds to thermal noise, and a region varying quadratically with the variance of the jitter, which corresponds to flicker.

[0005] To use jitter as a source of entropy for the generation of truly random numbers, it is generally accepted that only the thermal component of jitter is of interest because it is the only completely random one, and that the flicker noise component is not of interest because flicker noise is self-correlated and detrimental to the predictability of the generated randomness.

[0006] Thus, in the circuits described above where the source of entropy for generating random numbers is based on the jitter of a ring oscillator, it is desirable to characterize the source of entropy, i.e. the jitter, in order to discriminate the amplitude from the thermal component of the jitter.

[0007] There are embedded methods for characterizing, in a circuit, an entropy source based on the jitter of a first ring oscillator of the circuit by using a second oscillator of the circuit that is identical to the first. For example, the two oscillators are said to be identical to each other when they are identical by design.

[0008] A first method is presented in the article "On the assumption of mutual independence of jitter realizations in P-TRNG stochastic models" by P. Haddad, Y. Teglia, F. Bernard, and V. Fischer, presented at the "Design, Automation & Test in Europe Conference & Exhibition (DATE)" in Dresden in 2014. This first method consists of counting, with a counter, the number of oscillations of the first ROI oscillator during Q oscillations of the second oscillator, the factor Q being obtained by means of a frequency divider receiving the output signal of the second oscillator as its input signal. The counter is incremented by the output signal of the first oscillator and reset every Q periods of the output signal of the second oscillator, using the output signal of the frequency divider by Q. The jitter is then characterized using the Allan variance calculated on the counter outputs.Allan's variance is the variance calculated on the difference between two consecutive values, here two consecutive output values ​​from the counter, and allows us to circumvent problems related to model convergence while respecting a stationarity condition. Allan's variance is plotted against the number Q of accumulation periods and then follows a law (or curve or function) very similar to that of the model proposed by Hajimiri. More precisely, Allan's variance plotted against the factor Q includes a linear component corresponding to thermal noise, a quadratic component corresponding to flicker noise, and a noise floor corresponding to the quantization noise inherent in any data acquisition. By performing a quadratic regression on the plotted curve to approximate it with a function of the type... o(Q)A2 = a0 + al.Q + a2.Q A2, where o(Q) is the variance of Allan as a function of the accumulation Q, it is possible to obtain the coefficients a0, al, and a2, which represent the coefficients for quantization noise, thermal noise, and flicker noise, respectively. Obtaining the coefficients a0, al, and a2 thus amounts to characterizing the entropy source, that is, the jitter of the first oscillator.

[0009] However, this first method has the disadvantage that the contribution of the frequency divider circuit on the final noise is not known.

[0010] Moreover, in this first method, the characterization of the jitter of the first oscillator is implemented by a circuit arranged next to the processing of the entropy source, which requires a significant additional surface area, in particular to implement quadratic regression.

[0011] A second method is presented in the article "Embedded Evaluation of Randomness in Oscillator Based Elementary TRNG" by V. Fischer and D. Lubicz, published in "Advanced Information Systems Engineering", vol. 7908, Springer Berlin Heidelberg, 2014, pp. 527-543. This method consists of sampling the output signal of the first oscillator with a D-type synchronous flip-flop clocked at the frequency of the second oscillator. The flip-flop's output signal is then a periodic signal whose average period Tm is inversely proportional to the difference between the periods of the two oscillators. More specifically, the length of the period Tm, in terms of the number Nm of periods of the oscillator signal, is such that Nm = T1 / (T1-T2), where T1 and T2 are the average values ​​of the periods of the first and second oscillators, respectively.Next, a variance is calculated on the result of an XOR operation between two values ​​of the flip-flop output signal separated by G periods of the second oscillator. The variance as a function of G then has two parts: one part varying linearly with G, which corresponds to thermal noise, and one part varying quadratically with G, which corresponds to flicker noise. In the same way as before, it is possible to characterize the entropy source, and therefore the jitter of the first oscillator, by performing a quadratic regression of the plotted variance as a function of G.

[0012] However, this second method has the disadvantage of being based on Nm / G frequency ratios which are not controlled but endured, and consequently the accuracy of this second method is low and uncontrollable between different circuits.

[0013] Moreover, in this second method, as in the first method, the characterization of the jitter of the first oscillator is implemented by a circuit arranged next to the processing of the entropy source, which requires a significant additional surface area.

[0014] A device to overcome the drawbacks of the two methods described above has been proposed in French patent application FR 3134795 and US patent application 202401954. The device proposed in these applications is similar to the device used in the second method. In other words, the proposed device is a random number generator based on a coherent-sampling oscillator (COSO-TRNG). In these applications, the oscillators are implemented using Semiconductor-on-Insulator (SOI) technology. In the device, a counter receives an output signal from a flip-flop that samples the first oscillator at the frequency of the second oscillator. Furthermore, the counter is configured to count N periods of the second oscillator during each period of the flip-flop's output signal.The device also includes a circuit for adjusting the period of at least one of the two oscillators, thus setting the average difference between the average period of each oscillator. In other words, it is possible to adjust the period of the flip-flop's output signal, and therefore the average output value Nm of the counter. A circuit characterizes the entropy of the entropy source from the output values ​​N of the counter by calculating an Allan variance on these output values ​​N. Once the entropy is characterized, an accumulation value K of the N output values ​​of the counter is chosen based on a target minimum entropy, so that a least significant bit with a value corresponding to the accumulation of K N output values ​​of the counter can be used as a random bit for generating random numbers.The system proposed in these applications also includes one or more alarm circuits to detect a malfunction of the entropy source.

[0015] Although this device solves at least some of the problems of the first and second methods described above, at least three different accumulation values ​​of the N output values ​​of the counter are used to characterize the entropy. Furthermore, once the entropy has been characterized, yet another accumulation value of the N output values ​​of the counter is selected and used to generate a random bit. This makes the device complex. Summary of the invention

[0016] There is a need to overcome all or part of the drawbacks of known devices comprising an entropy source based on the jitter of a ring oscillator.

[0017] An embodiment overcomes all or part of the drawbacks of known devices comprising an entropy source based on the jitter of a ring oscillator.

[0018] One embodiment provides an electronic device comprising: - a first ring oscillator and a second ring oscillator; - a synchronous flip-flop configured to provide an output signal corresponding to a sampling of an output of the first oscillator at a frequency of an output of the second oscillator; - a counter configured to provide, for each period of the flip-flop output signal, a value equal to a number of periods of the second oscillator counted during said period of the flip-flop output signal; - a first circuit configured to modify the period of at least one of the two oscillators so that the average difference between the periods of the two oscillators is equal to a target difference; and - a second circuit configured to: initialize a value of an integer K, calculate sums of K successive values ​​of the counter, calculate an Allan variance on the calculated sums, and set K to its current value if the calculated variance is greater than a first threshold and increment K otherwise, in which the first threshold is equal to the greater of a second threshold determined by a target entropy on a bit (OUT) of least weight of the calculated sums (VAL) and a third threshold determined by an autocorrelation threshold on said bit (OUT).

[0019] According to one embodiment, the first and second ring oscillators are identical, for example, by design.

[0020] According to one embodiment, the first circuit is configured to modify said period of said at least one of the two oscillators on the basis of the counter values.

[0021] According to one embodiment, the third threshold is equal to 0.25.

[0022] According to one embodiment, the second circuit comprises a storage circuit configured to receive the values ​​from the counter, an indication of the current value of the number K and to provide said sums in the form of a numeric word.

[0023] According to one embodiment, the device further includes a third circuit configured to provide a first alarm signal if the calculated variance is outside a range of values ​​determined by the first threshold, the range of values ​​including, for example, all values ​​greater than or equal to a first value determined by the first threshold, the first value being, for example, equal to 0.9 times the first threshold.

[0024] According to one embodiment, the device further includes a fourth circuit configured to provide a second alarm signal if a value of the counter is greater than a threshold determined by the target deviation.

[0025] According to one embodiment, the first and second ring oscillators are implemented using semiconductor-on-insulator technology, preferably using fully stripped semiconductor-on-insulator technology, and the first circuit is configured to control back grids of at least one delay element of said at least one of the two oscillators to modify the average difference between the periods of the two oscillators.

[0026] According to one embodiment, the first circuit is configured to modify said period of said at least one of the two oscillators during a first phase of a tuning step.

[0027] According to one embodiment, the second circuit is configured to fix the value of the number K during a second phase of the adjustment step, implemented after the first phase.

[0028] One embodiment provides a random number generator comprising the device as described, in which the random numbers are generated from the least significant bit of the calculated sums.

[0029] One embodiment provides a method implemented in an electronic device comprising a first ring oscillator (ROI) and a second ring oscillator, a synchronous flip-flop configured to provide an output signal corresponding to a sampling of an output of the first oscillator at a frequency of an output of the second oscillator, and a counter configured to provide, for each period of the flip-flop's output signal, a value equal to a number of periods of the second oscillator counted during said period of the flip-flop's output signal, the method comprising: modify with a first circuit a period of at least one of the two oscillators so that an average difference between the periods of the two oscillators is equal to a target difference; initialize with a second circuit a value of an integer K; calculate with the second circuit sums of K successive values ​​of the counter; calculate with the second circuit an Allan variance on the calculated sums; and with the second circuit, set K to its current value if the calculated variance is greater than a first threshold and increment K otherwise, in which the first threshold is equal to the greater of a second threshold determined by a target entropy on a least significant bit of the calculated sums and a third threshold determined by an autocorrelation threshold on said bit. Brief description of the drawings

[0030] These features and advantages, as well as others, will be described in detail in the following description of particular embodiments, given by way of non-limiting example, in relation to the accompanying figures, among which:

[0031] [Fig.1] represents, in the form of a block diagram, an embodiment of an electronic device;

[0032] [Fig.2] represents, in the form of an organizational chart, a method of implementing a process carried out in the device of [Fig.1];

[0033] [Fig.3] represents, in the form of a block diagram, a variant embodiment of the device of [Fig.1]. Description of the implementation methods

[0034] The same elements have been designated by the same reference numerals in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same reference numerals and may have identical structural, dimensional and material properties.

[0035] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been shown and are detailed. In particular, the usual methods and circuits using an entropy source for generating truly random numbers have not been detailed, as the embodiments and variants described here are compatible with these usual methods and circuits.

[0036] Unless otherwise specified, when referring to two elements connected together, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") together, this means that these two elements can be connected or linked through one or more other elements.

[0037] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "superior", "inferior", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made, unless otherwise specified, to the orientation of the figures.

[0038] Unless otherwise specified, the expressions "approximately", "roughly", and "on the order of" mean to within 10% or 10°, preferably to within 5% or 5°.

[0039] A device comprising identical first and second ring oscillators and a flip-flop sampling the first oscillator at the frequency of the second oscillator is considered here. In such a device, called a reference device, the output values ​​of the flip-flop are accumulated, and a least significant bit of the accumulated value is intended to be used as a random bit, for example, in a random number generator. As described previously, the accumulation value must be carefully selected to maintain a target minimum entropy on this bit and, moreover, typically, to be within the range of accumulation values ​​where the jitter is dominated by the thermal component and not by the flicker noise component.

[0040] However, in the reference device, it has been shown by L. Benea, M. Carmona, V. Fischer, F. Pebay-Peyroula, and R. Wacquez, in the article "Impact of the Flicker Noise on the Ring Oscillator-based TRNGs", published in 1ACR Transactions on Cryptography Hardware and Embedded Systems, vol. 2024, no. 2, Art. no. 2, March 2024, for example in relation to Figures 12, 13, 14 and 16 of that article, as is summarized for example on page 885 of the article, that the autocorrelation of the random bit related to the flicker noise can be considered as zero or negligible beyond a minimum accumulation value. This minimum accumulation value corresponds, for example, to the point at which the Allan variance of the jitter calculated on the accumulated values ​​becomes equal to the square of half the average period of the oscillators, and, preferably, equal to the square of half the average period of the sampling oscillator.

[0041] It is proposed here to take advantage of what has been shown in the aforementioned article, so as to simplify the entropy characterization apparatus and method. In particular, it is proposed here to take advantage of the fact that in the reference apparatus introduced above, the autocorrelation is zero beyond an accumulation value.

[0042] Fig. 1 illustrates schematically and in block form an example of an embodiment of a device 1.

[0043] Circuit 1 comprises two identical ring oscillators ROI and RO2. Oscillator ROI, respectively RO2, provides a periodic output signal SI, respectively S2.

[0044] Circuit 1 further includes a synchronous flip-flop (FF), for example of type D (D flip-flop). The flip-flop is configured to sample the signal S1 at the frequency of the signal S2.

[0045] In other words, the FF flip-flop is configured to update an output signal S3 at the beginning of each period of signal S2 with the binary value of signal S1, each beginning of period of signal S2 corresponding to an active edge of signal S2, for example, a rising edge. Between two successive updates of signal S3, signal S3 is maintained at its current value, that is, the value taken by signal S3 during the first of the two successive updates.

[0046] For example, the FF flip-flop includes a data input D configured to receive the S1 signal, a synchronization (timing) input C for updating the S3 signal configured to receive the S2 signal, and an output Q configured to provide the S3 signal.

[0047] The two oscillators ROI and RO2 and the FF flip-flop form an entropy source 100. The randomness extracted from the entropy source 100 is generated from the value of the period T of the signal S3. The signal S3 is a periodic signal having an average period Tm whose average duration Nm, expressed in periods of the signal S2, is inversely proportional to the difference between periods T1 and T2, according to the formula Nm = T1 / (T1-T2). Signal S3 has an instantaneous period T that varies with the jitter of signal SI. Thus, the measurement of the period T, that is, the duration of the period T, is representative of the jitter of signal SI.

[0048] The entropy source 100 is a structure for example designated by the acronym COSO (from the English "COherent Sampling ring Ocillator"), which is used in coherent sampling ring oscillator random number generator circuits (COSO TRNG from the English "COherent Sampling ring Ocillator True Random Number Generator").

[0049] To measure the period T of the signal S3, the circuit 1 includes a COUNTER circuit. The COUNTER circuit is configured to provide, for each period T of the signal S3, a value N, for example in the form of a numeric word, equal to the number of periods T2 of the signal S2 counted during the period T of the signal S3. In other words, the COUNTER circuit is configured to measure the duration of each period T of the signal S3 as a number N of periods T2 of the signal S2.

[0050] By way of example, the COUNTER circuit includes a reset input receiving the signal S3, a synchronization input C receiving the signal S2, and an output O providing the counted values ​​N. At the beginning of each period T2 of the signal S2, for example, at each rising edge of the signal S2, the COUNTER circuit increments the current count value by one. At the beginning of each period T of the signal S3, for example, at each rising edge of the signal S3, the COUNTER circuit resets the current count value to zero. Preferably, the value N available at the output O of the COUNTER circuit is updated from the current count value at the beginning of each period of the signal S3, just before this current count value is reset to zero.In other words, the value N available at the output of the COUNTER circuit is updated at the beginning of each period T of the signal S3 with the value of the number of periods T2 of the signal S2 counted during the previous period T.

[0051] Device 1 further includes an Nm CTRL circuit. The FB CTRL circuit is configured to control or modify the period of at least one of the two oscillators ROI and RO2 so that the difference between periods T1 and T2 is equal to a target difference. The modification of the period T1 of oscillator ROI and / or the period T2 of oscillator RO2 by the Nm CTRL circuit is implemented based on the output values ​​N of the COUNTER circuit. For example, for a target value Nmt of the average number of Nm periods T2 per period T of signal S3, if the output value N is less than Nmt, the difference between periods T1 and T2 is reduced, and if the output value N is greater than Nmt, the difference between periods T1 and T2 is increased.

[0052] According to one embodiment, the two oscillators ROI and RO2 are implemented using complementary metal-oxide-semiconductor (CMOS) technology. "Complementary Metal Oxide Semiconductor") on fully depleted semiconductor on insulator (FDSOI), preferably on fully depleted silicon on insulator ("Fully Depleted Silicon On Insulator"). In such an embodiment, preferably, the modification of the period T1 of the ROI oscillator, or of the period T2 of the RO2 oscillator, is implemented by driving the back gates of at least one delay element, for example an inverter, of the ROI oscillator, or RO2, respectively.

[0053] In alternative embodiments, whether or not the ROI and RO2 oscillators are implemented in CMOS on FDSOI, the modification of the period T1 of the ROI oscillator, respectively of the period T2 of the RO2 oscillator, is implemented differently, for example by selecting a propagation path of an oscillation from among several possible ones, or by modifying the supply conditions of the oscillator.As an example, the paper by A. Peetermans, V. Rozic, and I. Verbauwheden entitled "A Highly-Portable True Random Number Generator Based on Coherent Sampling", published in 2019 in the 29th International Conference on Field Programmable Logic and Applications (FPL), describes an example of tuning the relative periods of two ring oscillators that is not based on the use of back-grid at least one delay element, for example an inverter, of the ROI oscillator, respectively RO2.

[0054] However, the use of the back grids to modulate the period of at least one of the ROI and RO2 oscillators when these are implemented in CMOS on FDSOI allows for greater tuning dynamics and better tuning accuracy of the gap between the periods T1 and T2.

[0055] In the example of [Fig. 1], the Nm CTRL circuit controls only the period T2 of the RO2 oscillator by means of a CTRL T2 control signal. In an alternative embodiment, as illustrated by dashed lines in [Fig. 1], the Nm CTRL circuit also controls the period T1 of the ROI oscillator by means of a CTRL TL control signal. In another variant not shown, the Nm CTRL circuit controls only the period T1 of the ROI oscillator by means of the CTRL T2 signal.

[0056] In device 1, in each of the oscillators ROI and RO2, the ratio R between the oscillator period and its jitter is determinable and depends on the oscillator implementation technology. For example, when the oscillators are implemented in CMOS on FDSOI, this ratio R is on the order of 1000. In practice, for a given technology, this ratio can be obtained through a characterization phase, for example, of a plurality of circuits.

[0057] Furthermore, in device 1, the measurement accuracy is determined by the difference between the periods T1 and T2. More specifically, the measurement accuracy is equal to 1 / Nm.

[0058] Sufficient measurement accuracy is obtained, for example, when Nm is substantially equal to R. However, in other examples, a measurement accuracy where Nm is less than R may be sufficient; for example, a measurement accuracy where Nm is equal to R / 10 may be sufficient. A person skilled in the art is able to determine a target measurement accuracy based on the application. For example, for two oscillators ROI and RO2 having periods T1 and T2 equal to 2 ps, to obtain a measurement accuracy of 1 / 1000, the difference between the periods T1 and T2 must be fixed by the Nm CTRL circuit at 2 ns; that is to say, the Nm CTRL circuit must, for example, fix the period of the ROI oscillator at 2.002 ns and that of the RO2 oscillator at 2.000 ns.

[0059] It is then understood that the control accuracy of the T1 and / or T2 periods of the oscillators by the Nm CTRL circuit is determined by the target measurement accuracy. Returning to the case example described above, for ROI and RO2 oscillators implemented in CMOS on FDSOI, the CTRL T1 and CTRL T2 control signals of the back gates must be able to be modified with an accuracy on the order of mV to obtain the target deviation of 2 ns in this example.

[0060] In practice, adjusting the gap between the average periods of signals S1 and S2 allows the output values ​​N of the COUNTER circuit to vary around the value Nm as a function of the jitter of the ROI oscillator which is accumulated over Q equal to Nm periods of signal T2.

[0061] Adjusting the average value Nm of the output of the COUNTER by the Nm CTRL circuit corresponds, for example, to a first step in an adjustment phase.

[0062] Device 1 further includes a PROCESS circuit. Once the average period Tm has been set by the Nm CTRL circuit, the PROCESS circuit is configured to determine an accumulation value K for the output values ​​N of the COUNTER, such that the jitter accumulation Q (equal to K*Nm) is sufficient, firstly, for the entropy of a random bit generated from the accumulation of K successive N values ​​to be greater than a minimum entropy, and secondly, for the autocorrelation due to flicker noise to be zero or at least considered negligible. This determination of the value of the integer K corresponds, for example, to a second phase of the tuning step, which is implemented after the first phase of the tuning step.

[0063] More specifically, the PROCESS circuit is configured to first initialize the current value of the number K, that is, to set the current value of the number K to an initial value. For example, the initial value of the number K is between 1 and 1000, for example, equal to 10.

[0064] The PROCESS circuit is further configured to accumulate K successive N values. In other words, the PROCESS circuit is configured to calculate sums of K successive N values ​​of the COUNTER. For example, each time the COUNTER circuit provides a value N representing a number of periods of the signal S2 counted during a period of the signal S3, the PROCESS circuit adds this value N to previous N values, until K successive N values ​​have been summed.

[0065] For example, in [Fig. 1], in the PROCESS circuit, the accumulation function of K successive N values ​​is represented as an ACC function block receiving the N values ​​and an indication of the current value of the number K, for example, receiving the number K, and providing VAL values ​​corresponding to VAL sums (accumulations) of K successive N values. In other words, the ACC block is configured to calculate VAL sums of K successive N values. For example, each update of the VAL value corresponds to the result of an accumulation of K successive N values. As an example, each VAL value corresponds to the accumulation of the ROI oscillator jitter (signal SI) over the Q=Nm*K period of the signal S2.

[0066] By way of example, the output values ​​N of the counter are provided by the COUNTER circuit in the form of multi-bit digital words. Preferably, the calculated sums VAL are provided by the ACC block in the form of multi-bit digital words.

[0067] As an example, the ACC functional block is implemented by an accumulator circuit receiving the values ​​N and the indication of the current value of K, and providing the sums VAL.

[0068] The PROCESS circuit is further configured to calculate, from the VAL sums, an Allan variance. In other words, the PROCESS circuit is configured to calculate an Allan variance on the VAL sums. This function of the PROCESS circuit is represented in [Fig. 1] by a VAR CALC function block that receives the VAL values ​​and provides a VAR value of the Allan variance. As an example, this VAR CALC block is implemented by a corresponding circuit, for example, a corresponding digital circuit.

[0069] By way of example, to calculate the variance of Allan VAR on the VAL values, the VAR CALC block is configured to subtract a current VAL value from a VAL-1 value corresponding to the VAL value obtained before the current VAL value. This subtraction function is represented in [Fig. 1] as a SUB functional block receiving the two successive values ​​VAL and VAL-1, and providing the result RES of the subtraction between these two successive values. By way of example, the SUB block is implemented by a corresponding circuit, for example, a digital subtractor circuit.

[0070] By way of example, the VAL-1 values ​​are obtained by delaying the VAL values, as illustrated in [Fig. 1] by a DT functional block receiving the VAL values and providing the VAL-1 values. As an example, the DT block is implemented by a corresponding circuit, for example a shift register, for example a FIFO (First In First Out) type shift register of depth 1, in which the shifts are implemented at each update of the VAL signal.

[0071] By way of example, the VAR CALC circuit calculates the variance of Allan VAR from the differences RES between the values ​​VAL-1 and VAL, as illustrated in [Fig. 1] by a CALC functional block receiving the differences RES and providing the calculated variance of Allan VAR. For example, the CALC block is implemented by a corresponding circuit, for example, a corresponding digital circuit.

[0072] The PROCESS circuit is configured to compare the calculated Allan variance VAR on the VAL accumulations of K successive N output values ​​of the COUNTER circuit to a threshold TH, as illustrated in [Fig. 1], by a SUP TH functional block receiving the calculated variance VAR and providing an UP indication of the result of the comparison of the calculated variance to a threshold TH. By way of example, the SUP TH block is implemented by a corresponding circuit, preferably digital, receiving the VAR signal and providing the UP signal, for example in the form of a binary signal whose state indicates whether the variance VAR is greater than or less than the threshold TH.

[0073] More specifically, the TH threshold is equal to the largest threshold between a TH1 and TH2 threshold.

[0074] The TH1 threshold is determined by a target entropy of a random bit OUT provided by the PROCESS circuit. This OUT bit corresponds to the least significant bit of the sums VAL of K successive N values. For example, for a given target entropy value, the Allan variance corresponding to this target entropy is calculated, and the TH1 threshold is then equal to this calculated Allan variance. For example, the article by M. Baudet, D. Lubicz, J. Micolod, and A. Tassiaux, entitled "On the Security of Oscillator-Based Random Number Generators," published in J Cryptol, vol. 24, no. 2, pp. 398-425, April 2011, provides a reference model adapted to the N values ​​of the COUNTER circuit, which indicates that the VAR variance must be greater than the TH1 threshold for the entropy of the OUT bit to be greater than the target entropy.In other words, this model allows us to calculate, for the target entropy, the value of the TH1 variance threshold such that the entropy of the OUT bit is greater than the target entropy when the calculated VAR variance is greater than the TH1 threshold. For example, for a target entropy of 0.0997, the TH1 threshold is 0.538. As an example, having an OUT bit entropy greater than 0.997 is a requirement for complying with the AIS-31 standard.

[0075] The TH2 threshold is determined by an autocorrelation threshold on the OUT bit. Indeed, as previously indicated, the article "Impact of the Flicker Noise on the Ring Oscillator-based TRNGs" shows that the autocorrelation related to noise Flicker noise can be related to the Allan variance, and this autocorrelation is zero or negligible when the calculated variance (VAR) is greater than a certain threshold. For example, for a TH2 threshold of 0.25, the autocorrelation due to flicker noise is zero. The TH2 threshold is equal to the Allan variance on the accumulated values ​​when this Allan variance is greater than or equal to half the square of the mean period of the oscillators.

[0076] Taking the threshold TH equal to the largest of the thresholds TH1 and TH2, if the calculated variance VAR is greater than the threshold TH, this means that the accumulation Q equal to Nm.K, i.e. the current value of K, is sufficient for the autocorrelation of the bit OUT related to flicker noise to be zero or negligible and for the entropy of the bit OUT to be greater than the target entropy.

[0077] Thus, when the calculated Allan variance VAR is greater than the threshold TH, there is no need to modify the value of the number K, and the value of the number K is fixed at its current value. This marks, for example, the end of the second phase of the tuning step, or, more generally, the end of the tuning step. After this tuning step, the OUT bits provided by the PROCESS circuit can be used for random number generation, for example, by a random number generation circuit comprising device 1 and using the OUT bits to generate random numbers.

[0078] Conversely, when the calculated Allan variance VAR is less than the threshold TH, this means that at least one of the conditions on the entropy of the OUT bit and on the autocorrelation related to flicker noise is not met, and that the jitter accumulation value Q must be increased. This increase in the accumulation value Q is implemented by incrementing the current accumulation value K by a given step, for example, a unit step.

[0079] The PROCESS circuit is therefore configured to set K to its current value if the calculated variance VAR is greater than the threshold TH, and to increment K if the calculated variance VAR is less than the threshold TH. This function of the PROCESS circuit is represented in [Fig. 1] as a function block K CTRL configured to receive the indication UP that the calculated variance VAR is greater than or less than the threshold TH, and to increment the current value of the accumulation if the variance VAR is less than the threshold TH, and to set the accumulation K to its current value if the variance VAR is greater than the threshold TH. As an example, the function block K CTRL provides the indication of the current value of the accumulation K to the ACC block. As an example, the function block K CTRL is implemented as a digital circuit, for example, as a counter that includes the current value of K and increments this value when necessary.

[0080] The PROCESS circuit of Device 1 in [Fig. 1] is simpler to implement than the PROCESS circuit of the device described in applications FR 3134795 and US 202401954. In particular, in Device 1 presented here, it is not necessary to first characterize the entropy and then determine a value K for the accumulation of values ​​N for which an output bit meets a minimum target entropy. Furthermore, in Device 1 presented here, flicker noise can be a legitimate source of randomness, from which it follows that the rate of random OUT bits provided by Device 1 is higher than that which can be increased compared to that of the random bits provided by the device described in the aforementioned patent applications.

[0081] Figure 2 represents, in the form of a flowchart, one embodiment of a process implemented in device 1 of [Fig.1]. More specifically, [Fig.2] illustrates a step in adjusting device 1 prior to obtaining random OUT bits respecting the conditions of minimum target entropy and zero or negligible autocorrelation.

[0082] In a first phase or step 200 (block "SET Nm" in [Fig. 2]) of the adjustment step, the Nm CTRL circuit controls the period of at least one of the two oscillators ROI and RO2 so that the difference between the average periods of the two oscillators is equal to a target difference. In other words, the Nm CTRL circuit controls the period of at least one of the two oscillators ROI and RO2 so that the average Nm value of the period of signal S2 during one period of signal S3 is equal to a target value.

[0083] In a second phase or step 202 (block "SET K" in [Fig.2]) of the setting step, implemented after step 200, the PROCESS circuit sets the value of the accumulation K so that the two aforementioned conditions are met.

[0084] More specifically, at step 202, the current value of K is initialized at step 2020 (block "K INIT" in [Fig.2]). The initialization of the current value of K is implemented, for example, by the PROCESS circuit.

[0085] Then, still at step 202, at a step 2022 (block "CALC VAR" in [Fig.2]), the PROCESS circuit calculates sums (VAL in [Fig.1]) of K successive values ​​N of the counter COUNTER, and calculates an Allan variance (VAR in [Fig.1]) on these sums.

[0086] Steps 2020 and 2021 correspond to the steps implemented by the functional block or VAR CALC circuit of [Fig.1].

[0087] Still at step 202, the PROCESS circuit compares the variance of Allan calculated at the TH threshold, at a step 2024 (block "VAR > TH" in [Fig.2]). This step corresponds to the step implemented by the functional block or circuit SUP TH in [Fig.1].

[0088] If the calculated variance is greater than the TH threshold (output "YES" of block 2024), step 202, and, more generally, the device 1 adjustment step, is completed. The value of K is then fixed, and random bits OUT corresponding to the least significant bit of the Sums of K successive N values ​​are then provided by the PROCESS circuit. It can be understood from this that, once the current value of the accumulation K is fixed during the adjustment step, the PROCESS circuit continues to calculate sums of K successive N values.

[0089] Conversely, if the calculated variance is less than the TH threshold (output "NO" of block 2024), step 2024 continues to step 2026 (block "INC K" in [Fig. 2]) during which the current value of K is incremented. This step corresponds to the step implemented by the K CTRL functional block or circuit of [Fig. 1].

[0090] Step 2026 is followed by step 2022.

[0091] In the device 1 described above, in addition to implementing a simple adjustment step to obtain random OUT bits satisfying the two conditions relating to entropy and autocorrelation, it may be desirable to detect malfunctions of the entropy source 100. Indeed, once the value of K is fixed, the entropy source 100 may present various problems which lead to the OUT bits supplied by the PROCESS circuit no longer satisfying the two conditions relating to entropy and autocorrelation.

[0092] For example, the signal S3 may become blocked, that is, it may no longer vary periodically over time with an average period corresponding to a number Nm of periods of the signal S2. This blocking of the signal S3 may be the result of the oscillators ROI and RO2 locking onto each other. This blocking of the signal S3 may also be the result of an attack on device 1 by a hacker.

[0093] As another example, due to temperature variation or aging of device 1, the variance of Allan on the sums of K successive N output values ​​of the COUNTER circuit may again fall below the TH threshold after the value of K has been fixed during the adjustment step.

[0094] It would therefore be desirable, in device 1 of [Fig.1], to have means to detect at least one of a blockage of the S3 signal and a variation of the variance of Allan below the threshold TH.

[0095] Figure 3 represents, in block diagram form, an alternative embodiment of the device shown in Figure 1. Device 1 of Figure 3 shares many elements with Device 1 of Figure 1, and only the differences between these two devices are highlighted here. In particular, unless otherwise indicated, everything described for Device 1 of Figure 1 remains valid for Device 1 of Figure 3.

[0096] Device 1 of [Fig. 3] includes an ALARM1 circuit. The ALARM1 circuit is configured to detect when the Allan variance VAR calculated on the sums VAL of K successive values ​​N falls outside a range determined by the threshold TH. The ALARM1 circuit provides an alarm signal sigl indicating when the Allan variance VAR falls outside this range. The step of detecting that the variance VAR falls outside the range is preferably implemented after the tuning step that fixed the value of K.

[0097] By way of example, the range of values ​​determined by the TH threshold extends from a first value, preferably included in the range of values, to a second value, preferably included in the range of values. The first value is less than the TH threshold, for example equal to 0.7 times the TH threshold, preferably equal to 0.9 times the TH threshold, and the second value is greater than the TH threshold, for example equal to 1.3 times the TH threshold, preferably equal to 1.1 times the TH threshold.

[0098] As an alternative example, the value range includes all values ​​greater than or equal to a first value determined by the TH threshold. The first value is less than the TH threshold, for example equal to 0.7 times the TH threshold, preferably 0.9 times the TH threshold.

[0099] Rather than using the ALARM1 circuit to detect that the calculated variance VAR falls outside the range of values ​​defined above, one could have simply detected that the calculated variance VAR is below the threshold TH. However, during operation, the variance VAR may occasionally fall below the threshold TH without this being the result of a malfunction in the entropy source. Indeed, during operation, even in the absence of a malfunction in the entropy source, the calculated variance VAR may take values ​​close to the threshold TH, sometimes lower than the threshold TH, sometimes higher than the threshold TH. This is why using a range of values ​​is preferable.

[0100] By way of example, when the ALARM1 circuit provides the sigl signal to indicate that the calculated variance VAR has fallen outside the range of values ​​determined by the threshold TH, the adjustment step described in relation to Figures 1 and 2 can be reimplemented so as to fix a new value of K for which the OUT bits will satisfy the two conditions relating to entropy and autocorrelation.

[0101] It is understood from the operation of the ALARM1 circuit described above that, when the device 1 includes the ALARM1 circuit, the PROCESS circuit is configured to calculate the variance of Allan of the sums VAL of K successive values ​​N after the value of K has been fixed.

[0102] Device 1 of [Fig. 3] further includes an ALARM2 circuit. The ALARM2 circuit is configured to detect a blockage of the S3 signal. To this end, the ALARM2 circuit is configured to provide an alarm signal sig2 if a value N of the COUNTER is greater than a threshold determined by the average value Nm set by the Nm CTRL circuit during the adjustment step. In other words, the ALARM2 circuit is configured to provide an alarm signal sig2 if a value N of the COUNTER is greater than a threshold determined by the target difference between the average periods of the S1 and S2 signals. Preferably, the comparison of the values N at the threshold by the ALARM2 circuit is implemented after the end of the adjustment step described in relation to figures 1 and 2, that is to say after the Nm CTRL circuit has fixed the average value of the periods of the ROI and RO2 oscillators.

[0103] The threshold at which the ALARM2 circuit compares the output values ​​N of the COUNTER is greater than the fixed value Nm. If a value N exceeds this threshold, it means that the signal S3 is in a blocked state, and the ALARM2 circuit indicates this with the signal sig2. For example, this threshold is equal to 1.5 times Nm, for example, 2 times Nm.

[0104] By way of example, when the ALARM2 circuit detects a blockage of the S3 signal and indicates this by means of the sig2 signal, the circuit 1 is configured to reset the ROI and RO2 oscillators, for example by blocking the propagation of oscillations in these oscillators with a control signal before allowing this propagation again. After such a reset step of the ROI and RO2 oscillators, the adjustment step described in relation to Figures 1 and 2 is repeated.

[0105] Although a device 1 comprising both ALARM1 and ALARM2 circuits has been described above, in unillustrated variants, device 1 comprises only one of these two circuits, ALARM1 and ALARM2. Even in these variants where the device comprises only one of the two circuits, ALARM1 and ALARM2, device 1 has advantages over device 1 of [Fig. 1] lacking both ALARM1 and ALARM2 circuits.

[0106] By way of example, although not illustrated in [Fig. 3], the device 1 may include an alarm circuit configured to detect a change in the operation of the device 1, for example, resulting from the aging of the device 1. This alarm circuit is configured to calculate, at the end of the adjustment phase of the device 1, once the value K has been fixed, an average VARmeans value of the Allan variance over several VAR values ​​of the Allan variance. This alarm circuit is further configured, once the average VARmeans value has been calculated, to detect when an Allan variance VAR value falls outside a range of values ​​determined by the average VARmeans value. This range of values ​​extends from a first value, preferably within the range of values, to a second value, preferably within the range of values. The first value is less than the VARmeans value, for example, equal to 0.7 times the VARmeans value, preferably equal to 0.9 times the VARmeans value, and the second value is greater than the TH threshold, for example equal to 1.3 times the VARmeans value, preferably equal to 1.1 the VARmeans value.

[0107] By indicating when the variance of Allan falls outside the range of values ​​determined by the VARmeans value, this alarm indicates when the operation of device 1 deviates from the operation set at the end of the adjustment phase. However, this alarm can be triggered when the variance of Allan is still greater than the TH threshold, that is to say when the autocorrelation of the bit OUT linked to flicker noise is zero or negligible and the entropy of the bit OUT is greater than the target entropy.

[0108] For example, if we consider a TH threshold of 0.538 and, after setting the value of K, we obtain a VARmeans average value of 0.7, the range of values ​​determined by the VARmeans value extends, for example, from 0.9 times VARmeans to 1.1 times VARmeans. In this example, an Allan variance of 0.6 is less than 0.9 times VARmeans and triggers the alarm, whereas this same Allan variance is greater than the TH threshold, thus indicating that the autocorrelation of the OUT bit due to flicker noise is zero or negligible and that the entropy of the OUT bit is greater than the target entropy. Put another way, in this example, despite a drift in the operation of device 1, for example resulting from aging of device 1, this device 1 remains functional to provide random OUT bits with an entropy greater than the target entropy.

[0109] Various embodiments and variations have been described. A person skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will become apparent to a person skilled in the art.

[0110] Finally, the practical implementation of the embodiments and variants described is within the reach of a person skilled in the art, based on the functional indications given above.

Claims

Demands

1. Electronic device (1) comprising: - a first ring oscillator (ROI) and a second ring oscillator (RO2); - a synchronous flip-flop (FF) configured to provide an output signal (S3) corresponding to a sampling of an output (S1) of the first oscillator (ROI) at a frequency of an output (S2) of the second oscillator (RO2); - a counter (COUNTER) configured to provide, for each period of the output signal (S3) of the flip-flop (FF), a value (N) equal to a number of periods of the second oscillator (RO2) counted during said period of the output signal (S3) of the flip-flop (FF); - a first circuit (Nm CTRL) configured to modify a period of at least one of the two oscillators (ROI, RO2) so that an average difference between the periods of the two oscillators is equal to a target difference;and - a second circuit (PROCESS) configured to: initialize a value of an integer K, calculate sums (VAL) of K successive values ​​of the counter (COUNTER), calculate an Allan variance (VAR) on the calculated sums (VAL), and set K to its current value if the calculated variance is greater than a first threshold and increment K otherwise, in which the first threshold is equal to the greater of a second threshold determined by a target entropy on a least significant bit (OUT) of the calculated sums (VAL) and a third threshold determined by an autocorrelation threshold on said bit (OUT).;

2. Device according to claim 1, wherein the first and second ring oscillators (ROI, RO2) are identical, for example, by design.

3. Device according to any one of claims 1 or 2, wherein the first circuit (Nm CTRL) is configured to modify said period of said at least one of the two oscillators (ROI, RO2) on the basis of the values ​​(N) of the counter (COUNTER).

4. Device according to any one of claims 1 to 3, wherein the third threshold is equal to 0.

25.

5. Device according to any one of claims 1 to 4, wherein the second circuit (PROCESS) comprises an accumulator circuit (ACC) configured to receive the values ​​(N) from the counter (COUNTER), an indication of the current value of the number K and to provide said sums (VAL) in the form of a numeric word.

6. Device according to any one of claims 1 to 5, wherein the device further comprises a third circuit (ALARM1) configured to provide a first alarm signal (sigl) if the calculated variance is outside a range of values ​​determined by the first threshold, the range of values ​​comprising, for example, all values ​​greater than or equal to a first value determined by the first threshold, the first value being, for example, equal to 0.9 times the first threshold.

7. Device according to any one of claims 1 to 6, wherein the device further comprises a fourth circuit (ALARM2) configured to provide a second alarm signal (sig2) if a value (N) of the counter (COUNTER) is greater than a threshold determined by the target deviation.

8. Device according to any one of claims 1 to 8, wherein the first and second ring oscillators (ROI, RO2) are implemented in semiconductor-on-insulator technology, preferably in fully stripped semiconductor-on-insulator technology, and the first circuit (Nm CTRL) is configured to control (CTRL T1, CTRL T2) back gates of at least one delay element of said at least one of the two oscillators (ROI, RO2) to modify the average gap between the periods of the two oscillators.

9. Device (1) according to any one of claims 1 to 8, wherein the first circuit (Nm CTRL) is configured to modify said period of said at least one of the two oscillators (ROI, RO2) during a first phase of a tuning step.

10. Device (1) according to claim 9, wherein the second circuit (PROCESS) is configured to fix the value of the number K during a second phase of the setting step, implemented after the first phase.

11. Random number generator comprising the device according to any one of claims 1 to 10, wherein the random numbers are generated from the least significant bit of the calculated sums (VAL).

12. A method implemented in an electronic device (1) comprising a first ring oscillator (ROI) and a second ring oscillator (RO2), a synchronous flip-flop (FF) configured to provide an output signal (S3) corresponding to a sampling of an output (S1) of the first oscillator (ROI) at a frequency of an output (S2) of the second oscillator (RO2), and a counter (COUNTER) configured to provide, for each period of the output signal (S3) of the flip-flop (FF), a value (N) equal to a number of periods of the second oscillator (RO2) counted during said period of the output signal (S3) of the flip-flop (FF), the method comprising: modifying with a first circuit a period of at least one of the two oscillators (ROI, RO2) so that an average deviation between the periods of the two oscillators is equal to a target deviation; initialize with a second circuit (PROCESS) a value of an integer K; calculate with the second circuit (PROCESS) sums (VAL) of K successive values ​​of the counter (COUNTER); calculate with the second circuit (PROCESS) an Allan variance (VAR) on the calculated sums (VAL); and with the second circuit (PROCESS), set K to its current value if the calculated variance is greater than a first threshold and increment K otherwise, in which the first threshold is equal to the greater of a second threshold determined by a target entropy on a least significant bit (OUT) of the calculated sums (VAL) and a third threshold determined by an autocorrelation threshold on said bit (OUT).

Images