Random number generation device, random number generation method, and electronic control device

Abstract

To perform continuous output of random numbers even when true random numbers do not have sufficient indeterminacy.SOLUTION: When a result of statistical tests for entropy from an entropy source 22 by a statistical test unit 26 is "NG", a seed generation unit 44 generates a seed on the basis of additional entropy provided by an entropy pool unit 42. A first PRNG unit 46 then generates a random number on the basis of that seed. Accordingly, a random number generation device 1 is configured to generate a random number by using the seed not based on an HSM random number but based on the additional entropy, in response to a situation in which the result of the statistical tests is "NG" and in which entropy indeterminacy is not ensured.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a random number generation device and method for generating random numbers, and to an electronic control device equipped with a random number generation device. [Background technology]

[0002] For example, Patent Document 1 discloses a method for generating entropy in a computing device. In the method, a first repeat timer is set to a first frequency, and a second repeat timer is set to a second frequency. A predetermined number of first bits are collected from a first entropy source at the first frequency, and a specific number of second bits are collected from a second entropy source at the second frequency. The collected first bits and second bits are respectively provided to a pseudorandom number generator. The pseudorandom number generator performs seeding using the first bits and the second bits.

[0003] In this way, in the method of Patent Document 1, multiple entropy sources are provided, and the pseudorandom number generator performs seeding using the first and second bits collected from these entropy sources. Therefore, even if the security of the first entropy source is compromised, messages encrypted with an encryption key generated by seeding bits from other entropy sources cannot be decrypted. This makes it possible to prevent an eavesdropper from decrypting all messages. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent Publication No. 2022-28727 Summary of the Invention [Problem to be solved by the invention]

[0005] If it is necessary to generate more perfect random numbers, a true random number generator may be used. A true random number generator generates random numbers by utilizing the randomness caused by unpredictable physical phenomena in physical sources, such as thermal noise generated by diodes and resistors, noise in wireless communication channels, and radioactive decay of isotopes.

[0006] However, true random numbers may sometimes have a bias in the frequency of bits that appear, or the same bit may be generated consecutively. For this reason, a statistical test may be performed to check whether the true random numbers generated by a true random number generator have sufficient uncertainty as entropy. If the true random numbers pass the statistical test, for example, a pseudorandom number generator may generate pseudorandom numbers using the generated true random number as a seed, and a function that uses random numbers, such as encryption, may be executed using the generated pseudorandom numbers.

[0007] On the other hand, if the true random numbers do not pass the statistical test, the pseudorandom number generator may not generate random numbers because no seed is provided to the pseudorandom number generator. Note that, as in Patent Document 1, even if multiple entropy sources are provided, if bits are collected from each entropy source at different frequencies, a similar problem may occur. In other words, if the bits collected from one entropy source are not suitable as a seed, the pseudorandom number generator may not be able to generate random numbers until bits used as seeds are collected from other entropy sources. In such a case, there is a risk that it may become impossible to execute a function that uses random numbers.

[0008] The present disclosure has been made in consideration of the above-mentioned points, and aims to provide a random number generation device and method that are capable of continuing to output random numbers even when true random numbers do not have sufficient uncertainty, as well as an electronic control device equipped with a random number generation device. [Means for solving the problem]

[0009] In order to achieve the above object, the random number generation device according to the present disclosure comprises: A first random number generation unit (24, 28, 44, 46) that generates a first random number based at least on a first entropy, which is a true random number generated from a physical phenomenon, in a first entropy source (22); a second random number generator (42, 44, 46) that generates a second random number based on a second entropy obtained from a second entropy source (30); A determination unit (26) that determines whether or not uncertainty as entropy is ensured for the first entropy. When the judgment unit judges that uncertainty is ensured, the first random number generation unit generates a first random number, and when the judgment unit judges that uncertainty is not ensured, the second random number generation unit generates a second random number.

[0010] The electronic control device is configured to include the random number generator described above.

[0011] A random number generation method according to the present disclosure is a random number generation method executed by at least one processor, comprising: generating a first random number based at least on a first entropy, which is a truly random number generated from a physical phenomenon, in a first entropy source (22) (S120); Determining whether or not uncertainty as entropy is ensured for the first entropy (S320, S330); When it is determined that the uncertainty of the first entropy is ensured, a first random number is generated, while when it is determined that the uncertainty of the first entropy is not ensured, a second random number is generated based on a second entropy obtained from a second entropy source (S510, S520, S530, S160, S220).

[0012] According to the above-mentioned random number generation device and method, and the electronic control device equipped with the random number generation device, in the first entropy source (22), it is determined whether the first entropy, which is a true random number generated from a physical phenomenon, ensures uncertainty as entropy. If it is determined that the uncertainty of the first entropy is not ensured, a second random number is generated based on the second entropy obtained from the second entropy source. In this way, the second random number is generated in response to a determination that the uncertainty of the first entropy is not ensured. Therefore, even if the true random number does not have sufficient uncertainty, it is possible to continue generating random numbers, that is, to prevent the occurrence of a situation in which a random number is not output.

[0013] The reference numbers in parentheses above are merely an example of a correspondence with a specific configuration in an embodiment described below, in order to facilitate understanding of the present disclosure, and are not intended to limit the scope of the present disclosure in any way.

[0014] In addition, technical features described in each claim in addition to the features of the present disclosure described above will become apparent from the description of the embodiments described below and the accompanying drawings. [Brief description of the drawings]

[0015] [Figure 1] 1 is a configuration diagram showing an example of the configuration of a random number generation device according to a first embodiment. [Diagram 2] 13 is a time chart for explaining a periodic process executed by an entropy pool unit to read a timer value of a free-run timer. [Diagram 3] 11 is a flowchart showing a process flow until a seed generation unit generates a seed based on an HSM random number from an HSM and additional entropy from an entropy pool unit at the time of booting of an ECU. [Figure 4] 13 is a flowchart showing the flow of a random number generation process. [Diagram 5] 13 is a flowchart showing the flow of an HSM random number generation process. [Figure 6] 13 is a flowchart showing the flow of an additional entropy acquisition process. [Figure 7] 13 is a flowchart showing the flow of a seed generation process. [Figure 8] FIG. 11 is a configuration diagram showing an example of the configuration of a random number generation device according to a second embodiment. [Figure 9] 13 is a flowchart showing the flow of an additional entropy acquisition process according to the second embodiment. [Figure 10] 13 is a flowchart showing the flow of an additional entropy acquisition process according to a modified example of the second embodiment. [Figure 11] 13 is a flowchart showing a process flow until a seed generation unit generates a seed based on an HSM random number from an HSM and additional entropy from an entropy pool unit at the start-up of an ECU according to a third embodiment. [Figure 12] FIG. 13 is a configuration diagram showing an example of the configuration of a random number generation device according to a fourth embodiment. [Figure 13] FIG. 13 is a configuration diagram showing an example of the configuration of a random number generation device according to a modified example. [Figure 14] FIG. 13 is a configuration diagram showing an example of the configuration of a random number generation device according to another modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, preferred embodiments of the present disclosure will be described with reference to the drawings. Note that the same or similar configurations may be omitted from description by assigning the same reference number across multiple drawings. When only a portion of a configuration is described in each embodiment, the configuration of another embodiment described above may be applied to the other portion of the configuration. In addition to the combination of configurations explicitly stated in the description of each embodiment, configurations of multiple embodiments may be partially combined together even if not explicitly stated, as long as there is no particular problem with the combination.

[0017] (First embodiment) Fig. 1 is a configuration diagram showing an example of the configuration of a random number generation device 1 according to this embodiment. As shown in Fig. 1, the random number generation device 1 can be configured using an electronic control unit (ECU) 10 having at least one processor. The ECU 10 shown in Fig. 1 has a hardware security module (HSM) 20, a free-running timer 30, and a central processing unit (CPU) 40 which is an example of at least one processor. Furthermore, although not shown, the ECU 10 also has memories such as RAM and ROM, and peripheral devices such as I / O, an AD converter, and a communication device.

[0018] The HSM 20 includes an entropy source 22, a true random number generator (TRNG unit) 24, and a second pseudorandom number generator (PRNG unit) 28. The entropy source 22 includes a sensor that detects a physical quantity in a physical phenomenon, such as thermal noise of a diode or resistor, noise in a wireless communication channel, or radioactive decay of an isotope. The entropy source 22 generates and outputs entropy from the physical quantity in the physical phenomenon detected by the sensor. In other words, the entropy source 22 corresponds to a first entropy source. The entropy generated by the entropy source 22 is provided to the TRNG unit 24.

[0019] When uncertainty as entropy is ensured for a given entropy, the TRNG unit 24 outputs the given entropy as a true random number. On the other hand, when uncertainty as entropy is not ensured for a given entropy, the TRNG unit 24 does not output the given entropy as a true random number. For this reason, the TRNG unit 24 has a statistical test unit 26 for testing whether uncertainty as entropy is ensured. The statistical test unit 26 performs a statistical test, for example, to check whether there is a bias in the frequency of occurrence of "1" bits and "0" bits in the entropy and / or whether the same bit is not generated consecutively a predetermined number of times or more. However, examples of the statistical test are not limited to these, and any statistical test capable of checking whether uncertainty as entropy is ensured can be applied.

[0020] Statistical test unit 26 provides the result of the statistical test to TRNG unit 24, and also outputs it to seed generation unit 44, which will be described later. Note that statistical test unit 26 does not need to be provided inside TRNG unit 24, and may be provided outside TRNG unit 24.

[0021] The second PRNG unit 28 generates HSM random numbers (pseudo-random numbers), which are bit strings with no regularity, according to a predetermined algorithm using the true random numbers generated by the TRNG unit 24 as seeds (i.e., initial values ​​of the internal state). As the predetermined algorithm, for example, an AES (Advanced Encryption Standard) encryption function that generates an output based on an encryption key and an internal state can be used. The second PRNG unit 28 can further generate another HSM random number by updating the internal state using, for example, the generated HSM random number. The HSM random numbers generated by the second PRNG unit 28 are output to a seed generation unit 44, which will be described later.

[0022] Here, it takes a certain amount of time for entropy source 22 to output entropy that can be used as true random numbers. In contrast, by having second PRNG unit 28, HSM 20 can instantly output HSM random numbers from second PRNG unit 28 when new random numbers are needed. Therefore, by using the true random numbers generated by TRNG unit 24 as a seed to generate HSM random numbers from second PRNG unit 28, random numbers can be generated quickly and security can be ensured.

[0023] The free-run timer 30 is reset to 0 when the ECU 10 is started or reset, and thereafter continues to count up at a predetermined cycle.

[0024] The CPU 40 executes a program stored in the ROM while using the RAM as a temporary storage area, thereby performing a predetermined process (control) according to the program. Therefore, it can be said that the CPU 40 constructs a plurality of functional units by executing a plurality of instructions included in the program. Some of the functional units constructed by executing the program are shown in blocks in FIG. 1. As shown in FIG. 1, the functional units include an entropy pool unit 42, a seed generation unit 44, a first PRNG unit 46, and a device authentication unit 48.

[0025] The CPU 40 may be singular or plural. The storage medium for the program is not limited to ROM. For example, various storage media such as HDD and SSD can be adopted. The CPU 40 is an example of a processor, and a processor such as MPU, GPU, DFP, etc. may be used instead of or in addition to the CPU. MPU is an abbreviation for Micro-Processing Unit. GPU is an abbreviation for Graphics Processing Unit. DFP is an abbreviation for Data Flow Processor. The ECU 10 may be realized by combining multiple types of arithmetic processing units such as a CPU, MPU, GPU, and DFP. The ECU 10 may be realized as an SoC. SoC is an abbreviation for System on Chip. Alternatively, the ECU 10 may be realized using an ASIC or FPGA. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0026] The entropy pool unit 42 executes a process for reading the timer value of the free-run timer 30, for example, periodically. Then, it acquires and pools, for example, one bit, the LSB, of the read timer value. Then, when the number of pooled bits reaches the number of bits required as entropy, it outputs the pooled bit string as additional entropy. In this example, the free-run timer 30 corresponds to the second entropy source, and the additional entropy corresponds to the second entropy.

[0027] For example, as shown in FIG. 2, the entropy pool unit 42 executes periodic processing to read the timer value of the free-run timer 30 each time the periodic processing start timing arrives. For example, as shown in FIG. 2, the timer value is read by the entropy pool unit 42 immediately before the end of the periodic processing. Here, in the CPU 40, various processes are executed in addition to the periodic processing to read the timer value. These various processes include interrupt processing, which is more important than the periodic processing and is processed with priority over other processes. For this reason, as shown in FIG. 2, even if the timer value is to be read by the periodic processing, the timing at which the timer value is actually read is not constant and varies due to delays caused by the interrupt processing. Therefore, additional entropy can be generated from the timer value of the free-run timer 30.

[0028] The seed generation unit 44 receives the result of the statistical test of the entropy from the statistical test unit 26. Furthermore, the seed generation unit 44 takes in the HSM random number from the second PRNG unit 28 and the additional entropy from the entropy pool unit 42 as input data for generating a seed to be given to the first PRNG unit 46. If the result of the statistical test of the entropy is "OK", the seed generation unit 44 executes a process of generating a seed based on the HSM random number and the additional entropy. For example, the seed generation unit 44 may use a one-way function such as the Miyaguchi Planell compression function to generate one output data compressed to an arbitrary number of bits from two input data. One-way functions are mainly used for generating hash values ​​due to their characteristics such as strong collision resistance. Therefore, one-way functions can be said to be a type of cryptographic hash function. Since the probability that the same output data is obtained from different input data is very low, the cryptographic hash function can prevent a decrease in entropy (uncertainty) when generating a seed from two input data. However, the process for generating the seed is not limited to using the cryptographic hash function described above. For example, the seed generator 44 may generate the seed by performing an XOR operation on the HSM random number and the additional entropy. Alternatively, the seed generator 44 may employ any other process that combines the HSM random number and the additional entropy to generate the seed.

[0029] On the other hand, if the result of the statistical test of the entropy is "NG", the seed generation unit 44 executes a process of generating a seed based only on the additional entropy. In this case, the seed generation unit 44 may provide the additional entropy as is as a seed to the first PRNG unit 46. Alternatively, the seed generation unit 44 may perform a predetermined process, such as an AES encryption process, on the additional entropy and provide the output after the predetermined process to the first PRNG unit 46 as a seed.

[0030] The first PRNG unit 46, like the second PRNG unit 28, generates random numbers (pseudo-random numbers) that are bit strings with no regularity according to a predetermined algorithm, using a seed from the seed generation unit 44 as the initial value of its internal state. Furthermore, the first PRNG unit 46 can also generate other random numbers by updating its internal state using, for example, the generated random numbers.

[0031] The device authentication unit 48 uses random numbers to authenticate whether or not a target device communicating with the ECU 10 is a legitimate device. In this case, the random numbers can be used, for example, to generate a challenge code when performing challenge-response authentication. However, the device authentication unit 48 is only an example of a case in which random numbers are used, and the random numbers can also be used for other purposes. For example, the random numbers can be used to create an encryption key for encryption when communicating with other devices, or to overwrite and erase a previous encryption key when updating the encryption key.

[0032] Thus, in this embodiment, if the result of the statistical test of the entropy in the statistical test unit 26 is "OK", i.e., if it is determined that the uncertainty of the entropy is ensured, the seed generation unit 44 generates a seed based on a true random number and additional entropy. Then, the first PRNG unit 46 generates random numbers based on that seed. Since the seed is generated based on at least a true random number in this way, the first PRNG unit 46 can generate random numbers with high entropy (i.e., high uncertainty).

[0033] On the other hand, if the result of the statistical test of the entropy in the statistical test unit 26 is "NG", that is, if it is determined that the uncertainty of the entropy is not ensured, the seed generation unit 44 generates a seed based on the additional entropy. Then, the first PRNG unit 46 can generate a random number based on the seed. In this way, the random number generation device 1 according to the present embodiment is configured to generate a random number using a seed based on the additional entropy, not an HSM random number, in response to a determination that the uncertainty of the entropy is not ensured. Therefore, according to the random number generation device 1 according to the present embodiment, even if the true random number does not have sufficient uncertainty, it is possible to continue generating random numbers, that is, to prevent the occurrence of a situation in which a random number is not output.

[0034] Next, the flow of processing of each functional unit shown by each block in FIG. 1 will be described in detail with reference to the flowcharts of FIG. 3 to FIG. 7. First, the flowchart of FIG. 3 will be described. The flowchart of FIG. 3 shows the flow of processing until the seed generation unit 44 generates a seed based on the HSM random number from the HSM 20 and the additional entropy from the entropy pool unit 42 when the ECU 10 is started (including restart by resetting). Note that the processing shown in the flowchart of FIG. 3 may be executed periodically to periodically update the seed and provide it to the first PRNG unit 46 for improving security. In this case, the first PRNG unit 46 may be configured to set a limit on the period during which random numbers are generated using a given seed, and to stop outputting the random numbers if the seed is not updated before the period has elapsed.

[0035] In the first step S110, since a seed has not yet been generated, CPU 40 sets a state in which random number generation is disabled. In this state in which random number generation is disabled, as described below, first PRNG unit 46 cannot generate random numbers. In the following step S120, HSM 20 executes a process for generating HSM random numbers. Details of this HSM random number generation process are shown in the flowchart of FIG.

[0036] In step S310 of the flowchart in FIG. 5, the TRNG unit 24 of the HSM 20 collects entropy from the entropy source 22. For example, the entropy may be collected bit by bit from the LSB of the detection value of the sensor. When the number of bits of the collected entropy reaches a predetermined number of bits, in step S320, the statistical test unit 26 performs a statistical test on the collected entropy. Then, in step S330, the statistical test unit 26 judges whether the test result is OK, i.e., whether the uncertainty of the entropy is ensured, or whether the test result is NG, i.e., whether the uncertainty of the entropy is not ensured. This judgment result is output to the seed generation unit 44 of the CPU 40, as described above.

[0037] The test result of the statistical test unit 26 is also provided to the TRNG unit 24. If the test result is OK, the TRNG unit 24 outputs the entropy to the second PRNG unit 28 as a true random number. Then, in step S340, the second PRNG unit 28 executes a process of generating a pseudo-random number using the input true random number as a seed. The generated pseudo-random number is provided to the seed generation unit 44 as an HSM random number. In the following step S350, the HSM 20 stores that the generation of the HSM random number was performed normally. On the other hand, if the test result is NG, the TRNG unit 24 does not output the true random number to the second PRNG unit 28. In this case, the second PRNG unit 28 cannot generate an HSM random number because no seed is provided. Therefore, in step S360, the HSM 20 stores that the generation of the HSM random number is abnormal.

[0038] Finally, in step S370, the HSM 20 sets the completion of the HSM random number generation process, and ends the process shown in the flowchart of Fig. 5. In this way, regardless of whether the HSM random number generation was performed normally or abnormally, in the final step S370, it is set that the HSM random number generation process itself has been completed.

[0039] The description will be continued by returning to the flowchart of Fig. 3. In step S130, which is executed following step S120, the entropy pool unit 42 of the CPU 40 executes a process for acquiring additional entropy. The details of this process for acquiring additional entropy are shown in the flowchart of Fig. 6.

[0040] In step S410 of the flowchart in FIG. 6, the entropy pool unit 42 periodically reads out the timer value from the free-run timer 30 by the periodic processing described above. The entropy pool unit 42 then pools, for example, one LSB bit of the timer value thus obtained. In step S420, the entropy pool unit 42 increments the count value of the pool counter by 1. In step S430, the entropy pool unit 42 determines whether the count value of the pool counter is equal to or greater than the number of bits required for additional entropy. If it is determined that the count value is equal to or greater than the number of bits required for additional entropy, the entropy pool unit 42 proceeds to step S440. If it is determined that the counter value is less than the number of bits required for additional entropy, the entropy pool unit 42 repeats the processing from step S410.

[0041] In step S440, the entropy pool unit 42 sets the pooled bit string as additional entropy. Then, in step S450, the entropy pool unit 42 sets a value indicating that the additional entropy acquisition process is completed, and ends the process shown in the flowchart in FIG.

[0042] Returning to the flowchart of Fig. 3, the explanation will be continued. In step S140 executed following step S130, the seed generation unit 44 of the CPU 40 judges whether or not the HSM random number generation process and the additional entropy acquisition process are completed. If the completion of the HSM arithmetic generation process is set in the above-mentioned step S370 and the completion of the additional entropy acquisition process is set in step S450, the seed generation unit 44 judges that the HSM random number generation process and the additional entropy acquisition process are completed, and proceeds to step S150. On the other hand, if it is determined that at least one of the HSM random number generation process and the additional entropy acquisition process is not completed, the seed generation unit 44 waits until both processes are completed.

[0043] In step S150, the seed generation unit 44 of the CPU 40 executes a seed generation process. Details of this seed generation process are shown in the flowchart of FIG.

[0044] In the first step S510 of the flowchart in Fig. 7, the seed generation unit 44 determines whether the generation of the HSM random number was performed normally or whether the generation of the HSM random number was abnormal. This determination can be made based on the processing result stored in step S350 or S360 described above. If it is determined that the generation of the HSM random number was performed normally, the seed generation unit 44 proceeds to step S520. On the other hand, if it is determined that the generation of the HSM random number was abnormal, the seed generation unit 44 proceeds to step S530.

[0045] In step S520, the seed generation unit 44 executes a process of generating a seed based on the HSM random number and the additional entropy according to the above-mentioned method. On the other hand, in step S530, the seed generation unit 44 executes a process of generating a seed based only on the additional entropy. Therefore, in this embodiment, the seed generation unit 44 can generate a seed regardless of whether the generation of the HSM random number was normal or abnormal.

[0046] Returning to the flowchart of Fig. 3, the explanation will be continued. In step S160 executed following step S150, the first PRNG unit 46 of the CPU 40 holds the seed provided by the seed generation unit 44 as (the initial value of) its internal state. This puts the first PRNG unit 46 in a state in which it can generate random numbers, for example, based on a predetermined encryption key and the held internal state. Therefore, in step S170, the CPU 40 (first PRNG unit 46) is set to a state in which random numbers can be generated. Thereafter, the processing shown in the flowchart of Fig. 3 ends.

[0047] In response to a request to output a random number from a device that uses the random number, such as device authentication unit 48 shown in FIG. 1, a random number generation process shown in the flowchart of FIG. 4 is executed.

[0048] 4, the first PRNG unit 46 determines whether or not the seed or the generated random number is held as an internal state and the first PRNG unit 46 is in a random number generation possible state. If it is determined that the random number generation possible state is reached, the first PRNG unit 46 proceeds to processing of step S220. On the other hand, if it is determined that the random number generation possible state is not reached, the first PRNG unit 46 proceeds to processing of step S250.

[0049] In step S220, a random number (pseudo-random number) that is an irregular bit string is generated according to a predetermined algorithm based on a predetermined encryption key and internal state. In the following step S230, the generated random number is held as the internal state of first PRNG unit 46. This keeps first PRNG unit 46 in a state where it can generate random numbers. Then, in step S240, first PRNG unit 46 outputs the generated random number to a target that has requested output of the random number, such as device authentication unit 48.

[0050] Second embodiment Next, a second embodiment of the present disclosure will be described. In the above-described first embodiment, the additional entropy is generated from the timer value of the free-running timer 30. However, the additional entropy can be generated by various methods. In this embodiment, some other examples of the generation method of the additional entropy will be described.

[0051] Fig. 8 is a configuration diagram showing an example of the configuration of a random number generation device 101 according to this embodiment. As shown in Fig. 8, the random number generation device 101 according to this embodiment has an AD converter 32 and an EEPROM or flash memory 36 added to the random number generation device 1 of the first embodiment.

[0052] The AD converter 32 receives analog data 50 from a sensor or the like, converts it into digital data, and generates and outputs an AD conversion value 34. The EEPROM or flash memory 36 stores control learning values ​​38 of system elements constituting a predetermined system controlled by the ECU 10.

[0053] For example, when the predetermined system is a drive system of a vehicle, an example of the system element can be a transmission. When the relationship between the hydraulic pressure used to change the gear of the transmission and the electric current for generating the hydraulic pressure deviates from the desired relationship, the ECU 10 that controls the transmission stores a correction value for correcting the deviation as a learning value. Alternatively, when the predetermined system is a shift-by-wire system, an example of the system element can be a detent plate that is rotated by an electric motor and switches the shift range depending on the rotational position. In the shift-by-wire system, positioning control of the electric motor may be performed to match the output count value of an encoder that detects the rotational position of the electric motor with the rotational position of the electric motor. In this positioning control, the electric motor is rotated until the detent plate attached to the output shaft of the electric motor abuts against a stopper wall set at the end of the movable range and stops. When the detent plate stops, the output of the encoder is no longer generated. Therefore, the rotational position of the electric motor is determined. In this state, a correction value for correcting the output count value of the encoder to a reference value is stored as a learning value.

[0054] The above-mentioned learning values ​​are merely examples, and the system to be controlled is not limited to a vehicle system. Regardless of the system, the learning values ​​used to control the system elements are usually different for each system. For this reason, by including the control learning values ​​of the system elements in the input data (additional entropy) for the seed generation unit 44 to generate the seed, it becomes possible to generate high-entropy random numbers.

[0055] Next, several methods for generating additional entropy from an AD conversion value, a timer value, and a control learning value will be described in more detail with reference to the flowchart of Fig. 9. In the additional entropy acquisition process shown in the flowchart of Fig. 9, the processes of steps S410, S420, and S440 are deleted from the additional entropy acquisition process shown in the flowchart of Fig. 6, and instead, the processes of steps S415, S425, and S445 are added. The other processes are common to both additional entropy acquisition processes. Therefore, the following description will focus on the points that are different from the additional entropy acquisition process shown in the flowchart of Fig. 6.

[0056] In step S415, the entropy pool unit 42 periodically reads out the timer value from the free-run timer 30 and reads out the AD conversion value from the AD converter 32. Here, the AD conversion value 34 of analog data from a sensor or the like contains variations due to quantization errors. For this reason, additional entropy can be generated from the AD conversion value 34. To generate additional entropy from the timer value and the AD conversion value, for example, the entropy pool unit 42 may acquire the timer value and the AD conversion value at approximately the same timing and pool two bits from each LSB of each value. Alternatively, the entropy pool unit 42 may acquire the timer value and the AD conversion value at different timings, for example, alternately, and pool one bit of the LSB of the timer value or the AD conversion value every time the timer value or the AD conversion value is acquired. The flowchart in FIG. 9 shows an example in which the timer value and the AD conversion value are acquired at approximately the same timing. Therefore, in step S415, the entropy pool unit 42 obtains the timer value and the AD converted value, and pools two bits from each LSB of the respective values. Then, in step S425, the entropy pool unit 42 increments the count value of the pool counter by 2.

[0057] In step S445, the entropy pool unit 42 generates additional entropy based on the pooled bit string and the learning value of the system element. The generation of additional entropy based on the pooled bit string and the learning value of the system element may be performed, for example, by obtaining some of the most significant bits of the additional entropy from the pooled bit string and obtaining the remaining least significant bits of the additional entropy from the learning value of the system element. Alternatively, the pooled bit string and the learning value of the system element may be used as two input data to generate one output data using the cryptographic hash function described above, and the output data may be used as the additional entropy.

[0058] The additional entropy does not need to be created based on all of the timer value, the AD conversion value, and the learning value of the system element described above, and may be created based on any combination of at least two values, for example. Furthermore, instead of the timer value of the free-run timer 30 in the first embodiment, the AD conversion value or the learning value of the system element may be used.

[0059] Here, an example of a method for generating additional entropy based on a combination of a timer value and an AD conversion value will be described with reference to the flowchart of Fig. 10. Note that the additional entropy acquisition process shown in the flowchart of Fig. 10 has steps S402 and S404 added to the additional entropy acquisition process shown in the flowchart of Fig. 6. The other processes are common to both additional entropy acquisition processes. Therefore, the following description will focus on the differences from the additional entropy acquisition process shown in the flowchart of Fig. 6.

[0060] In step S402, the entropy pool unit 42 periodically or irregularly acquires the AD-converted value 34 from the AD converter 32. Then, in step S404, the entropy pool unit 42 determines whether the LSB of the AD-converted value 34 is zero. If the LSB of the AD-converted value 34 is zero, the entropy pool unit 42 proceeds to step S410, acquires a timer value from the free-run timer 30, and pools the LSB.

[0061] In the first embodiment described above, the timer value of the free-run timer 30 is periodically acquired. In contrast, in the above example, the timer value of the free-run timer 30 is acquired at the timing when the LSB of the AD converted value becomes zero. This makes it possible to more reliably vary the timing of acquiring the timer value of the free-run timer 30 due to quantization error of the AD converted value, etc. As a result, it is possible to generate additional entropy with a higher entropy.

[0062] Third embodiment Next, a fourth embodiment of the present disclosure will be described. In the first embodiment described above, when it is determined that the generation of the HSM random number is abnormal, the seed generation unit 44 executes a process of generating a seed based on additional entropy.

[0063] Here, the uncertainty of the additional entropy is lower than that of true random numbers. Therefore, if the generation of HSM random numbers is abnormal, a seed with lower entropy is generated compared to when the generation is normal. Therefore, it may not be desirable to generate random numbers using a seed based on the additional entropy without limit in cases where high security is required.

[0064] Therefore, in this embodiment, if the generation of HSM random numbers is abnormal, the number of times that a seed based on additional entropy is successively generated is limited to a predetermined number. As a result, the number of times that random numbers are generated using a seed based on additional entropy is also limited to a number corresponding to the predetermined number. Note that the random number generation device according to this embodiment has a similar configuration to the random number generation device 1, 101 according to the first or second embodiment. Therefore, a description of the configuration of the random number generation device according to this embodiment will be omitted.

[0065] Fig. 11 is a flowchart showing a process flow according to this embodiment, in which the seed generation unit 44 generates a seed based on the HSM random number from the HSM 20 and the additional entropy from the entropy pool unit 42 when the ECU 10 is started. The flowchart shown in Fig. 11 adds the processes of steps S142, S144, S146, and S148 to the flowchart in Fig. 3. The other processes are common to both flowcharts. Therefore, the following description will focus on the points that are different from the flowchart in Fig. 3. Note that the process shown in the flowchart in Fig. 11 is not only executed when the ECU is started, but is also executed repeatedly thereafter.

[0066] In step S142 of the flowchart in FIG. 11, the CPU 40 (e.g., the seed generation unit 44) determines whether the generation of the HSM random number was performed normally. If the generation of the HSM random number was performed normally, the CPU 40 proceeds to step S144. On the other hand, if there was an abnormality in the generation of the HSM random number, the CPU 40 proceeds to step S146. In step S144, the CPU 40 resets to zero an abnormality counter that counts the number of times a seed based on additional entropy was generated. Thus, for example, even if it is determined that the generation of the HSM random number was abnormal at least once, if it is subsequently determined that the generation of the HSM random number was performed normally by repeating the processing shown in the flowchart in FIG. 11, the abnormality counter is reset from a value other than zero to zero.

[0067] In step S146, the CPU 40 increments the abnormality counter by 1. Then, the CPU 40 proceeds to step S148 to determine whether the count value of the abnormality counter is equal to or greater than the threshold value. If the count value of the abnormality counter is less than the threshold value, the CPU 40 proceeds to step S150. In this case, as described above, a seed is generated based on the additional entropy, and the seed is held in the first PRNG unit 46 as an internal state. On the other hand, if the CPU 40 determines in step S148 that the count value of the abnormality counter is equal to or greater than the threshold value, steps S150, S160, and S170 are skipped, and the process shown in the flowchart of FIG. 11 is terminated. This makes it possible to limit the number of times that a seed based on the additional entropy is continuously generated to a predetermined number of times less than the threshold value.

[0068] (Fourth embodiment) Next, a fourth embodiment of the present disclosure will be described. In the first embodiment described above, when it is determined that the generation of the HSM random number has been performed normally, the seed generation unit 44 executes a process of generating a seed based on the HSM random number and additional entropy.

[0069] In contrast, in this embodiment, if it is determined that the HSM random numbers have been generated normally, the seed generation unit 44 executes a process of generating a seed based only on the HSM random numbers. In this way, by generating a seed based only on the HSM random numbers, the processing load for seed generation can be reduced.

[0070] To execute a process of generating a seed based only on HSM random numbers when the generation of HSM random numbers has been performed normally, for example, the result of the statistical test from the statistical test unit 26 is also input to the entropy pool unit 42 as shown in the configuration diagram of Fig. 12. It is also possible to configure so that additional entropy is not output from the entropy pool unit 42 when the generation of HSM random numbers has been performed normally. And / or, regardless of whether additional entropy is input to the seed generation unit 44, the seed generation unit 44 may execute a process of generating a seed based only on HSM random numbers when the generation of HSM random numbers has been performed normally.

[0071] Although the above describes preferred embodiments of the present disclosure, the present disclosure is not limited to the above-described embodiments and can be modified in various ways without departing from the spirit and scope of the present disclosure.

[0072] For example, in each of the above-described embodiments, a configuration has been described in which the second PRNG unit 28 generates pseudo-random numbers using the true random numbers from the TRNG unit 24 as a seed in the HSM 20. However, for example, as shown in FIG. 13 , the second PRNG unit 28 may be omitted and the true random numbers from the TRNG unit 24 may be output to the seed generation unit 44.

[0073] In each of the above-described embodiments, the pseudo-random number generated by the second PRNG unit 28 of the HSM 20 is provided to the seed generation unit 44 as input data for generating a seed. However, for example, as shown in FIG. 14, the HSM random number generated by the second PRNG unit 28 may be output as a first random number to the device authentication unit 48 that uses the random number. In this case, the seed generation unit 44 forms a seed based on the additional entropy only when the statistical test result in the statistical test unit 26 is NG and an abnormality occurs in the generation of the HSM random number. The first PRNG unit 46 generates a random number as the second random number and outputs it to the device authentication unit 48 only when the seed generation unit 44 forms a seed based on the additional entropy.

[0074] Finally, this specification discloses the following technical ideas and combinations thereof. The combinations of the following technical ideas apply not only to the random number generation device but also to the random number generation method.

[0075] (Technical thought 1) A first random number generation unit (24, 28, 44, 46) that generates a first random number based at least on a first entropy, which is a true random number generated from a physical phenomenon, in a first entropy source (22); a second random number generator (42, 44, 46) that generates a second random number based on a second entropy obtained from a second entropy source (30); A determination unit (26) that determines whether or not uncertainty as entropy is ensured for the first entropy. A random number generation device configured such that, when the judgment unit judges that uncertainty is ensured, a first random number is generated by the first random number generation unit, and, when the judgment unit judges that uncertainty is not ensured, a second random number is generated by the second random number generation unit.

[0076] (Technical thought 2) The first random number generation unit is a first pseudo-random number generation unit (46) that uses the seed as an initial value of the internal state to generate a pseudo-random number corresponding to the internal state and determines a next internal state; The random number generation device described in Technical Idea 1, wherein the first random number is generated by the first pseudorandom number generation unit by providing a seed based on the first entropy to the first pseudorandom number generation unit.

[0077] (Technical Thought 3) The first random number generation unit is a seed generation unit (44) that generates a seed to be provided to the first pseudorandom number generation unit; The random number generation device described in Technical Idea 2, wherein the first random number is generated by the first pseudorandom number generation unit by providing the first pseudorandom number generation unit with a seed generated by the seed generation unit based on the first entropy and the second entropy.

[0078] (Technical Thought 4) The first random number generation unit is a first pseudo-random number generation unit (46) that uses the seed as an initial value of the internal state to generate a pseudo-random number according to the internal state and determines a next internal state; A second pseudorandom number generation unit (28) separate from the first pseudorandom number generation unit, a seed based on the first entropy is provided to the second pseudorandom number generator; The random number generation device described in Technical Idea 1, wherein the first random number is generated by the first pseudorandom number generation unit by providing the first pseudorandom number generation unit with a seed based on a random number generated by the second pseudorandom number generation unit.

[0079] (Technical Thought 5) The first random number generation unit is a seed generation unit that generates a seed to be provided to the first pseudorandom number generation unit; The random number generation device described in Technical Idea 4, wherein the first random number is generated by the first pseudorandom number generation unit by providing the first pseudorandom number generation unit with a seed generated by the seed generation unit based on the random number generated by the second pseudorandom number generation unit and the second entropy.

[0080] (Technical Thought 6) The random number generation device according to Technical Idea 3 or 5, wherein the seed generation unit uses a cryptographic hash function when generating a seed from two inputs.

[0081] (Technical Thought 7) the first pseudorandom number generation unit is shared by the first random number generation unit and the second random number generation unit; A random number generation device described in any one of Technical Ideas 2 to 6, wherein the second random number is generated by the first pseudorandom number generation unit by providing the first pseudorandom number generation unit with a seed based on the second entropy.

[0082] (Technical Thought 8) The random number generation device according to Technical Idea 7 further includes a limiting unit (S142, S146, S148) that limits the number of times that seeds are continuously generated based on the second entropy to a predetermined number of times.

[0083] (Technical Thought 9) A random number generating device according to any one of technical ideas 1 to 8, wherein the second entropy is generated based on at least one of a timer value of a free-running timer, a conversion value of an AD converter, and a control learning value.

[0084] (Technical Thought 10) A random number generating device described in technical idea 9, wherein the second entropy is generated based on the timer value of the free-running timer obtained each time the conversion value of the AD converter becomes a predetermined value.

[0085] (Technical Thought 11) An electronic control device equipped with a random number generating device according to any one of Technical Ideas 1 to 10. [Explanation of symbols]

[0086] 1: Random number generator, 10: ECU, 20: HSM, 22: Entropy source, 24: TRNG unit, 26: Statistical test unit, 28: Second PRNG unit, 30: Free-run timer, 32: AD converter, 36: Flash memory, 40: CPU, 42: Entropy pool unit, 44: Seed generation unit, 46: First PRNG unit, 48: Device authentication unit, 101: Random number generator

Claims

1. A first random number generation unit (24, 28, 44, 46) that generates a first random number based at least on a first entropy, which is a true random number generated from a physical phenomenon, in a first entropy source (22); a second random number generator (42, 44, 46) for generating a second random number based on a second entropy obtained from a second entropy source (30); A determination unit (26) that determines whether or not uncertainty as entropy is ensured for the first entropy. A random number generation device configured such that, when the judgment unit judges that uncertainty is ensured, a first random number is generated by the first random number generation unit, and, when the judgment unit judges that uncertainty is not ensured, a second random number is generated by the second random number generation unit.

2. The first random number generation unit is a first pseudo-random number generating unit (46) for generating a pseudo-random number according to the internal state by using the seed as an initial value of the internal state and for determining a next internal state; The random number generating device of claim 1 , wherein the first random number is generated by the first pseudorandom number generating unit by providing the first pseudorandom number generating unit with a seed based on the first entropy.

3. The first random number generation unit is A seed generation unit (44) for generating a seed to be provided to the first pseudorandom number generation unit, 3. The random number generation device according to claim 2, wherein the first random number is generated by the first pseudorandom number generation unit by providing the first pseudorandom number generation unit with a seed generated by the seed generation unit based on the first entropy and the second entropy.

4. The first random number generation unit is a first pseudo-random number generating unit (46) that uses the seed as an initial value of the internal state to generate a pseudo-random number according to the internal state and determines a next internal state; A second pseudorandom number generating unit (28) separate from the first pseudorandom number generating unit, a seed based on the first entropy is provided to the second pseudorandom number generator; 2. The random number generation device according to claim 1, wherein the first random number is generated by the first pseudorandom number generation unit by providing the first pseudorandom number generation unit with a seed based on a random number generated by the second pseudorandom number generation unit.

5. The first random number generation unit is a seed generation unit that generates a seed to be provided to the first pseudorandom number generation unit; 5. The random number generation device according to claim 4, wherein the first random number is generated by the first pseudorandom number generation unit by providing the first pseudorandom number generation unit with a seed generated by the seed generation unit based on the random number generated by the second pseudorandom number generation unit and the second entropy.

6. The random number generation device according to claim 3 or 5, wherein the seed generation unit uses a cryptographic hash function when generating the seed from the two inputs.

7. the first pseudorandom number generation unit is shared by the first random number generation unit and the second random number generation unit; The random number generation device according to claim 2 , wherein the second random number is generated by the first pseudorandom number generation unit by providing the first pseudorandom number generation unit with a seed based on the second entropy.

8. The random number generation device according to claim 7 , further comprising a limiting unit (S142, S146, S148) that limits the number of times that seeds are continuously generated based on the second entropy to a predetermined number of times.

9. The random number generation device according to claim 1 , wherein the second entropy is generated based on at least one of a timer value of a free-running timer, a conversion value of an AD converter, and a control learning value.

10. 10. The random number generation device according to claim 9, wherein the second entropy is generated based on a timer value of the free-running timer obtained each time the conversion value of the AD converter reaches a predetermined value.

11. An electronic control device comprising the random number generating device according to any one of claims 1 to 5.

12. 1. A method of random number generation executed by at least one processor, comprising: generating a first random number based at least on a first entropy, which is a truly random number generated from a physical phenomenon, in a first entropy source (22); Determining whether or not uncertainty as entropy is ensured for the first entropy (S320, S330); A random number generation method comprising: generating a first random number when it is determined that the uncertainty of the first entropy is ensured; and generating a second random number based on a second entropy obtained from a second entropy source when it is determined that the uncertainty of the first entropy is not ensured (S510, S520, S530, S160, S220).

Images