Random number generation

Abstract

The present disclosure relates to an apparatus and method for generating random numbers. It is desirable for the random number to have minimal or no bias toward any of its possible values, so that each possible value has the same or substantially the same likelihood. In some embodiments, the disclosed apparatus and method includes sampling two kTC noise signals from a capacitor and using the two sampled signals to generate a random number with minimal or no bias. In some other embodiments, the disclosed apparatus and method additionally or alternatively uses a scrambling circuit to generate a scrambled random number using a random number and a random or pseudo-random dither signal.

Description

[Technical Field]

[0001] The present disclosure relates to an apparatus and method for generating random numbers. [Background technology]

[0002] This disclosure relates to generating random numbers such that each time a new random number is generated, there is an equal, or substantially equal, likelihood that the random number has any one of its possible values. This may be referred to as a "dynamic" random number because it may change each time a new number is generated. This is in contrast to another type of random number, which may be referred to as a "static" or "persistent" random number, in which numbers generated by different copies of the same device are randomly different, but numbers generated by a particular copy of the device should ideally remain the same over time (e.g., numbers generated by a Physical Unclonable Function (PUF) should be static random numbers). Throughout this disclosure, the term "random number" is intended to mean "dynamic random number."

[0003] Random numbers are used for a variety of different purposes. Ideally, the likelihood of each possible value of a number should be equal so that each time a new number is generated, there is no bias toward numbers having one or more particular values. However, because of the physical characteristics of the circuit / device / system that generates the random numbers, there may be inadvertent inherent biases toward particular values, and care should be taken to minimize or eliminate them. Furthermore, for some uses of random numbers (e.g., encryption), malicious third parties may wish to manipulate the circuit / device / system that generates the random numbers so that the numbers they generate are no longer random. Therefore, it may be desirable for the design and / or operation of the circuit / device / system to be such that it is difficult for third parties to understand or influence the operation of the circuit / device / system, thereby improving the security and reliability of the generated random numbers. Summary of the Invention [Means for solving the problem]

[0004] The present disclosure relates to an apparatus and method for generating random numbers. It is desirable for the random number to have minimal or no bias toward any of its possible values, so that each possible value has the same or substantially the same likelihood. In some embodiments, the disclosed apparatus and method includes sampling two kTC noise signals from a capacitor and using the two sampled signals to generate a random number with minimal or no bias. In some other embodiments, the disclosed apparatus and method additionally or alternatively uses a scrambling circuit to generate a scrambled random number using a random number and a random or pseudo-random dither signal.

[0005] In a first aspect of the present disclosure, a random number generation device includes a first random number generator, the first random number generator including a first noise generator circuit, the first noise generator circuit including a first capacitor for use in generating kTC noise, and a first buffer coupled to the first capacitor for buffering a capacitor voltage including the kTC noise generated by the first capacitor and outputting a buffered voltage; and a determination unit, the determination unit determining the first buffered voltage including the first kTC noise generated by the first capacitor at a first time. A random number generator is provided that is configured to read a first buffered voltage from an output of the first buffer, the first buffered voltage being a buffered version of a first capacitor voltage, and read a second buffered voltage from the output of the first buffer, the second buffered voltage being a buffered version of the second capacitor voltage including second kTC noise generated by the first capacitor at a second time, and the random number generator is configured to generate a random number based on the first buffered voltage and the second buffered voltage.

[0006] The noise generator circuit may further include a first switch coupled to the first capacitor to form a first switched capacitor arrangement that changes the state of the first capacitor from a closed state to an open state to generate a capacitor voltage including the kTC noise across the first capacitor.

[0007] The first buffer may be configured to provide a gain to the capacitor voltage to generate a buffered voltage.

[0008] The determining unit may include a sampling circuit configured to sample the first buffered voltage (and optionally also the second buffered voltage), and an input capacitance of the sampling circuit may be greater than the capacitance of the first capacitor.

[0009] The sampling circuit may include an amplifier including at least one capacitor, and the sampling circuit may be configured to sample the first buffered voltage (and optionally the second buffered voltage) using the at least one capacitor. The amplifier may be an auto-zeroing amplifier.

[0010] The determination unit may include a comparator configured to compare the sampled first buffered voltage with the second buffered voltage, and the generation of the random number is based on an output of the comparator.

[0011] The sampling circuit may include an analog-to-digital (ADC) converter configured to convert the first buffered voltage to a first digital value and to convert the second buffered voltage to a second digital value, and the random number generator configured to generate a random number using the first digital value and the second digital value.

[0012] The first random number generator may further comprise a second noise generator circuit, the second noise generator circuit comprising: a second capacitor for use in generating the kTC noise; and a second buffer coupled to the second capacitor for buffering a capacitor voltage including the kTC noise generated by the second capacitor and outputting a buffered voltage; and the determination unit may determine a third buffered voltage, the third buffered voltage being a buffered version of the third capacitor voltage including the third kTC noise generated by the second capacitor at the first time, and the first buffered voltage and the third buffered voltage together forming a first differential signal (true / false). the second buffered voltage is a buffered version of the fourth capacitor voltage including the fourth kTC noise generated by the second capacitor at the second time, and the second buffered voltage and the fourth buffered voltage together form a second differential signal (which may be true / fully differential or pseudo differential); and the random number generator is configured to generate a random number based on the first differential signal and the second differential signal.

[0013] The determination unit may further comprise an auto-zeroing differential sampling circuit (which may be true / fully differential or pseudo-differential) configured to sample the first differential signal (and optionally the second differential signal). The determination unit may be configured to generate a random number based on determining a difference between the second differential signal (optionally the sampled second differential signal) and the sampled first differential signal.

[0014] The random number generation device may further include a scrambling circuit configured to receive the random number generated by the first random number generator and a dither signal, which is a random value signal or a pseudo-random value signal, and the scrambling circuit is configured to generate a scrambled random number based on the dither signal and the random number generated by the first random number generator.

[0015] The scrambling circuit may be configured to generate the scrambled random number by setting the scrambled random number equal to the random number generated by the first random number generator when the dither signal is a first value, and setting the scrambled random number to a value different from the random number generated by the first random number generator when the dither signal is a second value. For example, when the dither signal is a second value, the scrambled random number is set to the reciprocal of the random number generated by the first random number generator. Optionally, the random number generating device may further comprise a second random number generator for generating the random dither signal.

[0016] The random number generation device of the first aspect may further include one or more additional random number generators having the same design as the first random number generator, and a multi-bit random number unit configured to generate multi-bit random numbers based on random numbers generated using at least some of the one or more additional random number generators and the first random number generator. The first random number generator and the one or more additional random number generators may be configured to operate in parallel.

[0017] In a second aspect, a method for generating a random number is provided, the method including: a first noise generator circuit; the first noise generator circuit generating a first buffered voltage output from a buffer, the first buffered voltage including a first kTC noise generated by a capacitor at a first time; generating a second buffered voltage output from the buffer, the second buffered voltage including a second kTC noise generated by the capacitor at a second time; and generating a random number based on the first buffered voltage and the second buffered voltage.

[0018] In a third aspect, there is provided an apparatus for generating a scrambled random number, the apparatus comprising: a first random number generator configured to generate a first random number; and a scrambling circuit configured to receive the first random number and a first dither signal and to generate a scrambled random number based on the first random number and the first dither signal, wherein the first dither signal is a random value signal or a pseudo-random value signal.

[0019] The scrambling circuit may be configured to generate the scrambled random number by setting the scrambled random number equal to the value of the first random number when the first dither signal is at a first value, and by setting the scrambled random number to a value different from the first random number when the first dither signal is at a second value, for example, by setting the scrambled random number to the inverse of the first random number when the first dither signal is at a second value.

[0020] The apparatus may further include a first dither generator for generating a first dither signal. Optionally, the first dither generator may include a further random number generator configured to generate a further random number, the first dither generator configured to generate the first dither signal using the further random number. Still optionally, the first dither generator may further include a first pseudo-random number generator configured to use the further random number as a seed for generating the first dither signal, the first dither signal being the pseudo-random number output by the first pseudo-random number generator. Additionally or alternatively, the first dither generator may further include an entropy correction circuit configured to generate the first dither signal based on the further random number. For example, the entropy correction circuit may be a von Neumann corrector.

[0021] The apparatus may further comprise a plurality of random number generators, including a first random number generator, configured to generate a respective plurality of random numbers, and the apparatus may further comprise a first dither generator configured to generate a first dither signal, and the scrambling circuit is configured to receive the plurality of random numbers and the first dither signal and to generate a respective plurality of scrambled random numbers using the plurality of random numbers and the first dither signal.

[0022] The multiple random number generators and the first dither generator may be implemented in an integrated chip and spatially arranged in rows / columns. Optionally, the scrambling circuit may be configured to scramble at least two random numbers of the multiple random numbers using the first dither signal, the at least two random numbers being generated by two random number generators that are not spatially adjacent to a row. The first dither generator may occupy a position in a row that is not spatially adjacent to the two random number generators that generate the at least two random numbers.

[0023] The apparatus may further include a second dither generator configured to generate a second dither signal, wherein the scrambling circuit is configured to receive the second dither signal, generate a first set of scrambled random numbers using the first set of random numbers and the first dither signal, and generate a second set of scrambled random numbers using the second set of random numbers and the second dither signal, wherein the plurality of random numbers includes the first set of random numbers and the second set of random numbers, and wherein the plurality of scrambled random numbers includes the first set of scrambled random numbers and the second set of scrambled random numbers.

[0024] The scrambling circuit may be further configured to receive one or more further dither signals and to generate a scrambled random number based on the first random number, the first dither signal, and the one or more further dither signals. Optionally, the scrambling circuit may be further configured to generate an intermediate dither signal using the first dither signal and the one or more further dither signals, and to generate a scrambled random number using the first random number and the scrambled dither signals.

[0025] In a fourth aspect, there is provided a method for generating a scrambled random number, the method including: generating a first random number; and generating the scrambled random number based on the first random number and a first dither signal, wherein the first dither signal is a random value signal or a pseudo-random value signal.

[0026] In a fifth aspect, there is provided a system comprising a plurality of random number generators configured to generate a corresponding plurality of random numbers, and a multi-bit random number unit configured to receive at least two of the random numbers generated by the plurality of random number generators and generate a multi-bit random number using the received at least two random numbers, wherein the plurality of random number generators are configured to operate in parallel such that the plurality of random numbers are generated in parallel.

[0027] The plurality of random number generators may comprise a first set consisting of at least two of the random number generators that supply random numbers to the multi-bit random number unit, each of the first set of random number generators comprising a scrambling circuit configured to scramble the random numbers output to the multi-bit random number unit, and the plurality of random number generators further comprising a second set of random number generators that output random numbers to the first set of random number generators for use in scrambling the output random numbers.

[0028] Optionally, multiple random number generators may be implemented in an integrated chip and arranged as a series of adjacent columns / rows, and a first random number generator whose output random numbers are used for scrambling purposes by a second random number generator may be spatially separated from the second random number generator.

[0029] The multi-bit random number unit may be configured to generate a multi-bit random number by concatenating at least two received random numbers, the order of concatenation changing each time a new multi-bit random number is generated. [Brief explanation of the drawings]

[0030] Aspects of the present disclosure are now described, by way of example only, with reference to the following drawings.

[0031] [Figure 1] 1 shows an exemplary schematic depiction of a random number generator / system according to one aspect of the present disclosure. [Figure 2A] 1 shows an exemplary depiction of an RC filter circuit used to help explain the generation of kTC noise. [Figure 2B] 1 shows an exemplary depiction of a basic switched capacitor arrangement for generating kTC noise. [Figure 3A] 2 illustrates an exemplary implementation of a noise generation circuit of the random number generator of FIG. 1. [Figure 3B] 2 illustrates an exemplary implementation of a noise generation circuit of the random number generator of FIG. 1. [Figure 3C] 2 illustrates an exemplary implementation of a noise generation circuit of the random number generator of FIG. 1. [Figure 3D] 2 illustrates an exemplary implementation of a noise generation circuit of the random number generator of FIG. 1. [Figure 3E] 2 illustrates an exemplary implementation of a noise generation circuit of the random number generator of FIG. 1. [Figure 3F] 2 illustrates an exemplary implementation of a noise generation circuit of the random number generator of FIG. 1. [Figure 3G] 2 illustrates an exemplary implementation of a noise generation circuit of the random number generator of FIG. 1. [Figure 4] 2 illustrates an exemplary process by which the random number generator of FIG. 1 may determine a random number. [Figure 5] 2 illustrates an exemplary implementation of a determination unit of the random number generator of FIG. 1; [Figure 6] 2 illustrates an exemplary implementation of the random number generator of FIG. 1. [Figure 7A] 2 illustrates further exemplary implementation details of the random number generator of FIG. 1. [Figure 7B] 2 illustrates further exemplary implementation details of the random number generator of FIG. 1. [Figure 7C] 2 illustrates further exemplary implementation details of the random number generator of FIG. 1. [Figure 7D] 2 illustrates further exemplary implementation details of the random number generator of FIG. 1. [Figure 7E] 2 illustrates further exemplary implementation details of the random number generator of FIG. 1. [Figure 8] 1 shows a further exemplary schematic representation of a random number generator / system configured to generate scrambled random numbers. [Figure 9A] 1 shows a further exemplary schematic representation of a random number generator / system configured to generate scrambled random numbers. [Figure 9B] 1 illustrates an exemplary implementation of a dither generator. [Figure 10] 1 shows a further exemplary schematic representation of a random number generator / system configured to generate scrambled random numbers. [Figure 11] 1 shows a further exemplary schematic representation of a random number generator / system configured to generate scrambled random numbers. [Figure 12] 1 shows a further exemplary schematic representation of a random number generator / system configured to generate scrambled random numbers. [Figure 13] 1 shows a further exemplary schematic depiction of a random number generator / system. [Figure 14A] 10 shows details of a further exemplary random number generator / system configured to generate a plurality of scrambled random numbers. [Figure 14B] 10 shows details of a further exemplary random number generator / system configured to generate a plurality of scrambled random numbers. [Figure 14C] 10 shows details of a further exemplary random number generator / system configured to generate a plurality of scrambled random numbers. [Figure 14D] 10 shows details of a further exemplary random number generator / system configured to generate a plurality of scrambled random numbers. [Figure 15] 1 shows a further exemplary schematic representation of a random number generator / system configured to generate a plurality of scrambled random numbers. [Figure 16] 1 illustrates an exemplary process for generating scrambled random numbers. DETAILED DESCRIPTION OF THE INVENTION

[0032] The present disclosure includes many different implementations of random number generators configured to generate random numbers such that each time a new random number is generated, there is an equal or substantially equal likelihood that the random number has any one of its possible values. In some implementations, the random numbers are generated based on random kTC noise generated by one or more capacitors. While the kTC noise can be read from the capacitors, the inventors recognize that in addition to the kTC noise, the read signal contains other components, such as low-frequency noise in the kTC noise generation circuitry and / or the readout circuitry, signal offset / bias, etc. These other components mean that random numbers generated directly from the readout kTC noise signal are likely to be biased.

[0033] However, the inventors have recognized that if one creates two consecutive kTC noise events and reads out the kTC noise from each, the two readout signals should have the same, or substantially the same, low-frequency noise and signal offset / bias. Thus, subtracting one signal from the other (i.e., finding the difference) should substantially cancel out the non-kTC noise from the signal, leaving only the kTC noise, which is random. Thus, improved random numbers can be generated.

[0034] Also disclosed are implementations of random number generators that use scrambling to improve random numbers. In particular, random numbers can be scrambled by a scrambling circuit that uses one or more random or pseudo-random dither signals. In this way, regardless of how the random numbers are generated, the entropy of the scrambled random numbers should be the same as or greater than the entropy of the random numbers so that the scrambled random numbers are improved (i.e., the scrambled random numbers have little or no bias toward any of their possible values).

[0035] 1 shows an exemplary schematic depiction of a random number generation device / system 100 according to an embodiment of the present disclosure. It comprises a random number generator 102 comprising a noise generator circuit 110 and a decision unit 120. In some exemplary implementations, the random number generation device / system 100 comprises two or more random number generators 102, but for simplicity, a single random number generator 102 will be described first. The noise generator circuit 110 is configured to generate a buffered voltage 115 that is output to the decision unit 120. The decision unit 120 is configured to generate a random number 125 using the output buffered voltage 115.

[0036] In some implementations, the first noise generator circuit 110 may include a capacitor configured to generate random kTC noise, and the random buffered voltage 115 includes the kTC noise generated by the capacitor.

[0037] 2A shows an example depiction of an RC filter circuit used to help explain the kTC noise that can be generated by a capacitor. The RC filter circuit has a resistor R and a capacitor C to filter out thermal noise v in the signal V. n can be expressed as follows:

[0038]

number

[0039] During the ceremony, T=temperature kB = Boltzmann constant

[0040] Thermal noise v n is commonly referred to as kTC noise, and that is how it will be referred to in the remainder of this disclosure. kTC noise is random and

number

[0041] In one example, at a temperature of 27°C (300K), the kTC noise of capacitor C is: [Table 1]

[0042] FIG. 2B shows an example depiction of a basic switched capacitor arrangement for generating kTC noise. The switch SW can be modeled as a variable resistor depending on the state of the switch. The kTC noise generated by this circuit is the same as the noise of the RC filter circuit depicted in FIG. 2A. When the switch switches from an on (i.e., closed) state to an off (i.e., open) state, kTC noise is injected across the capacitor C. As a result, changing the state of the switch SW from a closed state to an open state can be viewed as generating a capacitor voltage V that includes kTC noise.

[0043] The inventors recognize that the generated kTC noise is random and can therefore be used to generate random numbers. For this purpose, it may be preferable for the noise to be as large as possible. The kTC noise can be increased by reducing the capacitance of capacitor C, as can be seen from the table above. However, a smaller capacitor will have less energy, making it more difficult to read and use the signal VOUT.

[0044] The present inventors have recognized that by buffering the capacitor voltage VOUT using a buffer, it is possible to read a very small capacitor voltage VOUT. By doing so, the capacitance of the capacitor C may be set to a very small value so that the kTC noise component of the capacitor voltage VOUT is relatively large. By maximizing the contribution of the kTC noise in the capacitor voltage VOUT, the randomness of any random numbers generated using the capacitor voltage VOUT may be improved. However, using a buffer to read the capacitor voltage VOUT poses additional challenges. For example, it may be desirable to use a buffer with low input capacitance because the buffer input capacitance may contribute to the capacitance of the switched capacitor circuit. Because it is desirable to have very small capacitance to maximize kTC noise, any additional capacitance from the buffer input may be undesirable. However, buffers with relatively small input capacitance tend to have a relatively large offset error, which may reduce the randomness of the buffered voltage output from the buffer and, therefore, the randomness of any random numbers generated based on the buffered voltage.

[0045] Faced with all of these challenges and considerations, the inventors configured the apparatus 100 such that the noise generator circuit 110 generates a first buffered output voltage 115 including a first kTC noise, and the decision unit 120 reads the first buffered output voltage 115. Subsequently, the noise generator circuit 110 generates a second buffered output voltage including a second kTC noise, and the decision unit 120 reads the second buffered output voltage 115. The decision unit 120 can then generate a random number 125 based on a comparison of the first buffered output voltage and the second buffered output voltage. By performing this two-step process of kTC noise generation, the signal resulting from the comparison can have reduced levels of undesirable persistent components such as DC bias, low-frequency noise, and buffer offset (i.e., non-random components that would thereby reduce the randomness of the random number), such that random numbers generated using the results of the comparison should have improved randomness.

[0046] Furthermore, because the buffer offset can be reduced or canceled by using two buffered output voltages, a buffer with a small input capacitance can be used, thereby increasing the size of the kTC noise component in the buffered output voltage.

[0047] 3A shows an example implementation of a noise generator circuit 110. The noise generator circuit 110 includes a switch 310 and a capacitor 320, and when the switch 310 is changed from a closed state to an open state, a bias voltage V BIAS and kTC noise is arranged to be sampled on capacitor 320. The bias voltage V BIAS V can be set to any voltage, including a positive voltage, a negative voltage, or 0 V. Switch 310 can be any suitable type of controllable switch, for example, V BIASThe noise generator circuit 110 may be a transistor, such as a MOS type transistor, which may be either p- or n-type depending on the level of V. The noise generator circuit 110 may be connected to a capacitor voltage V to generate a buffered voltage 115. C The buffer may be of any suitable type, for example a source follower.

[0048] FIG. 3B shows a further exemplary implementation of the noise generator circuit 110. It is the same design as shown in FIG. 3A, except that it has a different type of buffer 340. In this embodiment, the buffer 340 is a differential amplifier with negative feedback and can be of any suitable type, e.g., an operational amplifier. Both the buffer 330 and the buffer 340 serve the function of isolating the low capacitance circuit preceding the buffer from the potentially relatively high input capacitance at the input of the decision unit 120 (discussed in more detail below). Thus, they help maintain a small capacitance for generating the kTC noise, thereby increasing the size of the generated kTC noise. Furthermore, both the buffer 330 and the buffer 340 limit the drive strength of the kTC noise signal (i.e., the drive strength of the buffered voltage 115 is greater than the capacitor voltage V C (larger than kTc noise), which facilitates the use of kTc noise by decision unit 120 in generating random numbers. The main difference between the two buffers 330 and 340 is that buffer 330 may have a larger offset voltage than buffer 340, but that offset voltage should be largely or completely canceled by double-sampling capacitor 320 and by the operation of decision unit 120, as described below.

[0049] 3C and 3D show further exemplary implementations of noise generator circuit 110. In the implementation of FIG. 3C, a single-ended amplifier 350 (of any suitable type, e.g., a simple single-stage common-source amplifier) ​​is used. In the implementation of FIG. 3D, a differential amplifier 340 is used. In both implementations, noise generator circuit 110 is configured so that buffered output voltage 115 is a gained-up version of the capacitor voltage (including kTC noise), with the gain equal to the ratio of the input capacitance of amplifier 340 / 350 to the capacitance of capacitor 320.

[0050] 3E, 3F, and 3G show further exemplary implementations of noise generator circuit 110. These implementations are very similar to those of FIGS. 3C and 3D, except that they further include an additional capacitor 360 having a relatively large capacitance compared to capacitor 320 used for kTC noise generation. In all three implementations, noise generator circuit 110 is configured such that buffered output voltage 115 is a gained-up version of the capacitor voltage (including kTC noise), with the gain equal to the ratio of the capacitance of capacitor 360 to the capacitance of capacitor 320.

[0051] Although all voltages in Figures 3A, 3B, 3D, 3E, 3F, and 3G are shown relative to ground, the circuitry may alternatively be configured to use any other suitable reference voltage.

[0052] FIG. 4 shows an exemplary diagram of a process by which the random number generator 100 may determine a random number.

[0053] At a first time point, step S410, the noise generator circuit 110 generates a first capacitor voltage across the capacitor 320, the first capacitor voltage including the first kTC noise. A first buffered voltage, which is a buffered version of the first capacitor voltage, is output from the noise generator circuit 110. The noise generator circuit 110 may be controlled to do this by controlling the state of the switch 310 to change from a closed state to an open state. That control may be performed, for example, by a control unit that may be part of the decision unit 120 or external to the decision unit (e.g., a central controller that controls the operation of multiple random number generators 102 when the random number generation apparatus is configured with multiple random number generators 102, as described below). The control unit may take any suitable form well understood by those skilled in the art, and may be implemented, for example, by dedicated circuitry / logic, or an FPGA, or a microcontroller or processor, or any other type of logic configured to control the state of the switch 310.

[0054] In step S420, the determination unit 120 reads the first buffered voltage from the noise generator circuit 110. As will be described in more detail below, this first buffered voltage may be sampled by the determination unit 120 or may otherwise be retained / stored for later use in generating random numbers.

[0055] At a second time point, step S430, following the first time point, the noise generator circuit 110 generates a second capacitor voltage across the capacitor 320, the second capacitor voltage including the second kTC noise. A second buffered voltage, which is a buffered version of the second capacitor voltage, is output from the noise generator circuit 110. The noise generator circuit 110 may be controlled to do this by first returning the state of the switch 310 to a closed state and then changing the state of the switch 310 from a closed state to an open state at a second time point. Again, this control may be performed in any suitable manner, as described above.

[0056] In step S440, the determination unit 120 reads the second buffered voltage from the noise generator circuit 110. As will be described in more detail below, this second buffered voltage may be sampled by the determination unit 120 or may otherwise be retained / stored for later use in generating random numbers.

[0057] In step S450, the random number generator may generate a random number 125 based on the first buffered voltage and the second buffered voltage. For example, the first buffered voltage and the second buffered voltage may be compared to generate the random number 125. In one embodiment, the comparison may determine the value of the single-bit random number 125, e.g., randomly setting the single bit to 0 or 1. In particular, for example, if the first buffered voltage is greater than the second buffered voltage, the random number may be set to 0 (or alternatively 1), and if the first buffered voltage is less than the second buffered voltage, the random number may be set to 1 (or alternatively 0). In some embodiments, the determination unit 120 itself may perform this step and output the random number 125, as depicted in FIG. 1 . However, alternatively, this step may be performed elsewhere in the random number generator, with the determination unit 120 outputting values ​​indicative of the first and second buffered voltages to some other unit / module within the random number generator 100, where the random number 125 is determined.

[0058] 5 shows an exemplary implementation of the decision unit 120 when configured to generate a random number 125. In this example, a controller 550 is depicted for controlling the operation timing of the noise generator 110, the sampling circuit 510, and the ADC 520 to perform the functions described above with reference to FIG. 4. The controller 550 may optionally be part of the random number generation device 100 (not depicted in FIG. 4 for simplicity). The controller 550 may also be used to control the operation timing of one or more other random number generators 102 in the random number generation device 100 if the device 100 comprises more than one random number generator. Alternatively, the controller 550 may be part of the random number generator 102, such as part of the decision unit 120 (e.g., may form part of the random number calculation circuit 530).

[0059] The determination unit 120 includes a sampling circuit 510 configured to sample the first buffered voltage in step S420. The sampling circuit 510 may be implemented in any conventional manner well understood by those skilled in the art. The sampled voltage is then converted to a digital value by an analog-to-digital converter (ADC) 520 and then received by the random number calculation circuit 530. The ADC 520 may be of any suitable type, e.g., a flash ADC, a SAR AC, a sigma-delta ADC, a ramp ADC, etc. The random number calculation circuit 530 may then store a digital value representing the first buffered voltage in a memory 540. Again, the memory 540 may be of any suitable type, e.g., volatile or non-volatile. While the memory 540 is shown as part of the determination unit 120, it may alternatively be located anywhere within the random number generation device 100, e.g., shared by multiple random number generators 102.

[0060] Thereafter, the sampling circuit 510 resets and then samples the second buffered voltage in step S440, which may then be digitally converted by the ADC 520. Optionally, the random number calculation circuit 530 may store the digital value in memory 540.

[0061] Finally, the random number calculation circuit 530 may determine the random number 125 using the first stored digital value and the second digital value, for example, by setting the random number 125 to 0 or 1 depending on which digital value is greater (as described above). If the two digital values ​​are equal, the random number calculation circuit 530 may be configured to operate in several different ways. For example, it may repeat the steps of FIG. 4 until the two numbers are no longer equal, at which point the random number 125 is generated. Or, it may be configured to pseudo-randomly assign the random number 125 to 0 or 1 whenever the digital values ​​are equal, for example, using a received pseudo-random dither signal.

[0062] The random number calculation circuit 530 may be configured in any suitable way to perform this function, for example, it may be implemented in hardware such as dedicated circuitry or an FPGA, or it may be implemented by software running on logic such as on one or more processors such as a microprocessor or microcontroller.

[0063] Although the random number calculation circuit 530 is depicted as part of the decision unit 120, it may alternatively be located elsewhere in the random number generation device 100, for example shared by one or more other random number generators 102 if the device 100 comprises more than one random number generator 102. In this case, the decision unit 120 does not generate the random number 125. Instead, the first and second digital values ​​are output from the decision unit 120 to the random number calculation circuit 530, and the random number 125 is generated therein.

[0064] Alternatively, the determination unit 120 may be configured to compare two sampled voltages in the analog domain. For example, the determination unit 120 may include a circuit having first and second sampling capacitors, and the determination unit 120 is configured to sample the first buffered voltage onto the first sampling capacitor in step S420 and sample the second buffered voltage onto the second sampling capacitor in step S440. The differential ADC may then generate a multi-bit digital representation of the difference between the first buffered voltage and the second buffered voltage, based on which the random number 125 may be generated (e.g., the random number may be set to 0 (or 1) if the output of the ADC indicates that the first buffered voltage is greater than the second buffered voltage, and may be set to 1 (or 0) if the output of the ADC indicates that the second buffered voltage is greater than the first buffered voltage). Alternatively, the decision unit may not include a multi-bit ADC, but instead may include a comparator configured to compare two sampled voltages and output a single-bit digital representation of the comparison set to 0 or 1 depending on the comparison (e.g., the single-bit representation may indicate whether the first buffered voltage is greater than or less than the second buffered voltage). The output of the comparator may be single-ended or differential. In this example, the output of the comparator is the random number 125.

[0065] In each of the above embodiments, the random number generator 102 has a single noise generation circuit 110 (or "first noise generator") so that the signal received at and used by the decision unit 120 is a single-ended signal. However, in an alternative implementation, the random number generator 102 may include two noise generator circuits, each outputting a buffered voltage that together form a differential signal. The decision unit 120 then receives the differential signal and is used to generate the random number 125. In this case, and as described in more detail below, the decision unit 120 may be configured similarly to FIG. 5.

[0066] Alternatively, the determining unit 120 may not have an ADC 520 configured to digitally convert the first buffered differential voltage and the second buffered differential voltage, and the difference between the two is then determined in the digital domain. Instead, the determining unit 120 may be configured to determine the difference between the first buffered differential voltage and the second buffered differential voltage in the analog domain. The difference may then be converted to a digital representation that may be a multi-bit digital representation of the difference or a single-bit representation of the difference (e.g., a single-bit representation indicating whether the kTC noise generated by the first noise generator is greater than or less than the kTC noise generated by the second noise generator).

[0067] 6 shows an example implementation of the random number generator 102 having a first noise generator circuit 1101 and a second noise generator circuit 1102. The first and second noise generator circuits may be of identical design and may be implemented in any of the manners previously described, for example, any of the manners shown in FIGS. 3A-3F. Referring to the process described above with reference to FIG. 4, at a first time point, in step S410, the first noise generator circuit 1101 may generate a first capacitor voltage across its capacitor 3201 (the first capacitor voltage including the first kTC noise), and the second noise generator circuit 1102 may generate a third capacitor voltage across its capacitor 3202 (the third capacitor voltage including the third kTC noise) by controlling their respective capacitor switches as previously described. A first buffered voltage 1151 is output from the first noise generator circuit 1101, and a third buffered voltage 1152 is output from the second noise generator circuit 1102. These two buffered voltage signals together form a first differential signal. The term "differential" is used in this disclosure to include both true or fully differential (where the signals that make up the differential signal are both generated by a single structure centered around a common voltage) and pseudo-differential (where each of the two signals that make up the differential signal are not necessarily centered around a common-mode voltage, but are generated by a differential structure designed so that the two structures have the same DC bias, as in the example of FIG. 6).

[0068] In step S420, the decision unit 120 reads the first differential signal from the first and second noise generator circuits. The first differential signal may be sampled or otherwise retained / stored for later use in generating random numbers. For example, in the case of a decision unit 120 implemented as described above with reference to FIG. 5, the sampling circuit 510 may sample the differential signal in any suitable manner, and the ADC 520 may be configured to receive a single-ended signal or a differential signal for converting the sampled value, depending on the configuration of the sampling circuit 510. Alternatively, the decision unit 120 may not have an ADC 520 and instead may use a comparator, examples of which are described below.

[0069] At a second time point subsequent to the first time point, in step S430, the first noise generator circuit 1101 generates a second capacitor voltage across its capacitor 3201 (the second capacitor voltage including the second kTC noise), and the second noise generator circuit 1102 generates a fourth capacitor voltage across its capacitor 3202 (the fourth capacitor voltage including the fourth kTC noise) by controlling the respective capacitor switches as described above. A second buffered voltage 1151 is output from the first noise generator circuit 1101, and a fourth buffered voltage 1152 is output from the second noise generator circuit 1102. These two buffered voltage signals together form a second differential signal.

[0070] In step S440, the determining unit 120 reads the second differential signals from the first and second noise generator circuits. Optionally, the determining unit 120 may sample or otherwise hold / store the second differential signals.

[0071] In step S450, the random number generation device 100 may generate a random number 125 based on the first differential signal and the second differential signal. For example, the difference between the first differential signal and the second differential signal may be detected to generate the random number 125 in the same manner as described above and further below.

[0072] 7A shows an example implementation of first and second noise generators 1101 and 1102, it will be understood that any other suitable configuration may be used for each noise generator in which a capacitor voltage containing kTC noise is generated and a capacitor voltage containing a buffered signal output (e.g., any of the implementations of FIGS. 3A-3F or any other suitable implementation) may be used. Each switch 310 of the noise generators is implemented using a FET, the state of which is controlled by a control signal SW (which may be controlled using a controller that is part of the random number generator 102, or may be located anywhere else within the random number generator 100, or may actually be located external to the random number generator 100). Each buffer of the noise generators is implemented using a respective current source 11 and 12 and a respective FET MP1 and MP2. Differences in the components of each of the noise generators may contribute undesired signal components in the buffered voltages 1151 and 1152, which may reduce the randomness of numbers generated using the buffered voltages 1151 and 1152. For example, each of the generated capacitor voltages may have slightly different DC offsets due to differences in switches 3101 and 3102 and / or differences in capacitors 3201 and 3202, which will be transmitted to the buffered output voltages 1151 and 1152. Additionally or alternatively, each of the buffers may have different offsets due to differences in components, which would result in an offset between the buffered output voltages 1151 and 1152. However, because the differential signal at a first time point (first differential signal) is compared to the differential signal at a signal time point (second differential signal) to generate a random number, and each of those differential signals should have the same or very similar offset components, those undesired signals may be significantly reduced or canceled out entirely, leaving only the kTC noise useful for random number generation.

[0073] In all of Figures 6, 7A, 7B, 7C, and 7E, the two noise generating circuits 1101 and 1102 are depicted as differential structures, not necessarily centered around a common-mode voltage, such that signals 1151 and 1152 together form a pseudo-differential signal. However, they may alternatively be configured so that signals 1151 and 1152 together form a true / fully differential signal. For example, rather than using separate buffers for each kTC capacitor 320, a single differential buffer may be used, with the capacitor voltages (including kTC noise) of each of capacitors 3201 and 3202 received at the respective inputs to the differential buffer. Those skilled in the art will readily recognize various different types of suitable differential buffers that may be used. In this case, the first and second noise generating circuits may be considered to include first and second capacitors 3201 and 3202 and differential buffers configured to output differential signals based on the capacitor voltages of the first and second capacitors 3201 and 3202.

[0074] Figure 7B shows an example implementation of the determination unit 120 depicted in Figure 7A. Figure 7C shows an alternative example implementation of the determination unit 120 depicted in Figure 7A.

[0075] Starting with FIG. 7B , differential signals 1151 and 1152 are received and sampled by the sampling circuit 710, and the sampled differential signals 7151 and 7152 are received and converted by the ADC 720. The operation of this exemplary implementation is the same as that described above with reference to FIGS. 4 and 5. In particular, in step S410, a first differential signal is output from the first noise generator circuit 1101 and the second noise generator circuit 1102. In step S420, the determination unit 120 reads the first differential signal from the first and second noise generator circuits by sampling the first differential signal in any suitable manner well understood by those skilled in the art. Optionally, the sampling circuit 710 may also include a gain circuit or amplifier circuit, such as a preamplifier. The ADC 720 then digitally converts the sampled first differential signal, and the digital output of the ADC 720 is processed by the random number calculation circuit 530 in the same manner as described above with reference to FIG. 5. The first differential signal converted by the ADC 720 includes the difference between the kTC noise generated by the first noise generator circuit 1101 and the kTC noise generated by the second noise generator circuit 1102 at the first switching event of the noise generator capacitor, as well as any DC offset between the two signals that make up the differential signal (e.g., caused by one or more of low-frequency noise, offset in the drive voltage of the noise generator circuit, offset caused by the buffer of the noise generator circuit, amplifier offset if the sampling circuit 710 includes a preamplifier, etc.).

[0076] Subsequently, the sampling circuit 710 is reset, and in step S430, second differential signals are output from the first noise generator circuit 1101 and the second noise generator circuit 1102. In step S440, the determination unit 120 reads the second differential signals from the first and second noise generator circuits by sampling the second differential signals. The ADC 720 then digitally converts the sampled second differential signals, and the digital output of the ADC 720 is processed by the random number calculation circuit 530 in the same manner as described above with reference to FIG. 5. The second differential signal converted by the ADC 720 includes the difference between the kTC noise generated by the first noise generator circuit 1101 and the kTC noise generated by the second noise generator circuit 1102 at the second switching event of the noise generator capacitor, as well as a DC offset between the two signals constituting the differential signal.

[0077] Finally, in step S450, the random number generation device 100 generates a random number 125 based on the first and second digital outputs of the ADC 720. For example, the random number calculation circuit 520 may compare the first digital value and the second digital value, as described above with reference to FIG. 5, and set the random number 125 to 0 or 1 depending on whether the difference between the first digital value and the second digital value is positive or negative. By comparing the two digital values ​​(e.g., subtracting one from the other), the random number 125 is generated based on which the DC offset in the signal can be canceled so that only random kTC noise remains.

[0078] In the alternative depicted in FIG. 7C , the sampling circuit is implemented as an auto-zeroing sampling preamplifier including gain stage 730, auto-zero switch AZ1, and sampling capacitors C1a and C1b. Gain stage 730 can be any suitable type of differential amplifier gain stage well understood by those skilled in the art. If the differential signal formed by 1151 and 1152 is a pseudo-differential signal (as in the embodiment depicted in FIG. 7C ), the auto-zero sampling preamplifier (including gain stage 730) can alternatively be implemented as a pseudo-differential auto-zero sampling preamplifier. For example, it can be very similar to that depicted in FIG. 7C , but rather than having a differential gain stage 730, it can use two single-ended gain stages, one for each of signals 1151 and 1152, the outputs of which would then form a pseudo-differential signal input to comparator 740. Sampling capacitors C1a and C1b can have a capacitance larger (potentially significantly larger, such as at least an order of magnitude larger) than the capacitance of kTC capacitor 320 of the noise generator circuit. In this embodiment, the sampling circuit is a single-stage auto-zeroing preamplifier, but could alternatively be a multi-stage auto-zeroing preamplifier, as shown in FIG. 7E.

[0079] FIG. 7D shows a timing diagram depicting an exemplary operation of the circuit of FIG. 7C. Initially, in step S410, in the auto-zero state, auto-zero switch AZ1 is closed and the switches of noise generators 1101 and 1102 are closed to couple the first buffered differential signal to the auto-zeroing preamplifier. In step S420, switch signal SW then goes low so that the first buffered differential signal is sampled by capacitors C1a and C1b. Exemplary differential signals 1151 and 1152, as well as vin1 and vin2, are shown in FIG. 7D. It will be understood that these are merely examples, and that their magnitudes and relative polarities may vary depending on the kTC noise in the signal output by the noise generator circuit. The sampled first differential signal includes the difference between the kTC noise generated by the first noise generator circuit 1101 and the kTC noise generated by the second noise generator circuit 1102 at the first switching event of the noise generator capacitor, as well as any DC offset between the two signals that make up the differential signal (e.g., caused by one or more of low frequency noise, an offset in the drive voltage of the noise generator circuit, an offset caused by the buffer of the noise generator circuit, etc.).

[0080] The auto-zero state is then ended by opening the auto-zero switch AZ1, and in steps S430 and S440, the noise generator circuits are reset by closing the switch controlled by signal SW, and then a second switching event in the noise generator circuits occurs to generate new kTC noise in those capacitors, and the noise generator circuits are reopened so that a second buffered differential voltage is output from the noise generator circuits. The second buffered differential voltage includes the difference between the kTC noise generated by the first noise generator circuit 1101 and the kTC noise generated by the second noise generator circuit 1102 at the second switching event of the noise generator capacitors, as well as any DC offset between the two signals that make up the differential signal. The second buffered differential signal is sampled onto capacitors C1a and C1b. As a result, because both the first and second buffered differential signals are sampled onto capacitors C1a and C1b without resetting capacitors C1a and C1b, and because both sampled signals contain the same (or substantially the same) DC component, the differential signal at the input to comparator 740 represents the difference between the first buffered differential voltage and the second buffered differential voltage. As a result, the signal at the input to comparator 740 contains the difference between the total kTC noise generated by the first noise generating circuit at the first and second switching events and the total kTC noise generated by the second noise generating circuit at the first and second switching events. The output of comparator 740 indicates the polarity of the differential signal at its input, which indicates whether the combined kTC noise generated by the first noise generator 1151 due to its two switched capacitor kTC events is greater than or less than the combined kTC noise generated by the second noise generator 1152 due to its two switched capacitor kTC events. Therefore, the output of the comparator 740 is randomly 0 or 1. In step S450, the comparator 740 is latched so that its output Comp_out is held at the output. In this case, Comp_out is the random number 125.

[0081] By performing auto-zeroing in this manner, the residual offset and offset voltage of the preamplifier between the two buffers of the two noise generating circuits can also be significantly reduced. This can help reduce any bias in the random number 125, thereby improving the randomness of the number. Furthermore, auto-zeroing in this manner can also help reduce the 1 / f noise of the signal at the input of the comparator 740.

[0082] In each of the differential signal embodiments described with reference to Figures 6 and 7, by considering a differential voltage signal consisting of the outputs of two identical noise generating circuits, at least some DC components in signals 1151 and 1152 should be canceled out so that the differential signal includes kTC noise and any offset between the buffers of the noise generating circuits (this is then canceled out by determining a random number based on the two kTC noise events from each of the noise generating circuits, i.e., by determining the random number using the first and second differential signals).

[0083] Optionally, comparator 740 may not be a latching comparator, and its output may simply be set based on a comparison of the input voltages at that time. Additionally or alternatively, decision unit 120 may include a set / reset (SR) latch at the output of comparator 740 to hold the value output by comparator 740 at output 125. Furthermore, the output of comparator 740 may be single-ended or differential.

[0084] 7E shows an alternative implementation of the decision unit 120 of FIG. 7C, where rather than having a single-stage sampling preamplifier, there is instead a multi-stage sampling preamplifier. In this example, there are two amplifier stages, although any number of stages, e.g., three, four, etc., may be used.

[0085] The decision unit 120 is the same as that depicted in Figure 7C, except for the inclusion of a second gain stage 735 having a second auto-zero switch AZ2 and second sampling capacitors C2a and C2b. The second auto-zero switch AZ2 may be controlled in the same manner as the first auto-zero switch AZ1 (optionally with a small timing offset so that AZ1 and AZ2 do not open and close at exactly the same time), as described above with reference to Figure 7D.

[0086] Using a multi-stage preamplifier may slightly increase the cost and size of the decision unit 120, but may have the advantage of improving immunity to noise and reducing mismatch between charge injections caused by auto-zero switches.

[0087] Therefore, it may help to improve the randomness of the output number 125.

[0088] 1 and 5, there is a single noise generator 110. However, alternatively, there may be two or more noise generators, and the decision unit 120 may receive and use the output of any one of them. For example, the circuit may include a multiplexer that receives the output 115 from each of the multiple noise generators and passes any one of the outputs 115 to the decision unit 120.

[0089] Thus, the noise generator used by the decision unit 120 can be changed periodically or intermittently so that different noise generators can be used for different random numbers generated by the device 100. In this way, if there is a problem associated with a particular noise generator 110, such as residual bias in the signal 115 output by a particular noise generator 110, it should not affect all of the random numbers generated by the device 100. Such an arrangement also applies to differential implementations of the device 100, such as those shown in FIGS. 6 and 7A-7E. In these embodiments, there may be three or more noise generators, and the decision unit 120 can be configured to receive the outputs 115 of any two of them. Again, a multiplexer can be used to receive the three or more signals 115 and pass any two of them to the decision unit 120, with the two selected signals being changed periodically or intermittently.

[0090] Optionally, the decision units shown in Figures 7C and 7E may form part of any other circuit, for example they may be part of a SAR ADC or slope ADC coupled to the noise generator 110 for the purpose of generating the random number 125, or a serial interface.

[0091] Optionally, the random number generator 100 may further comprise one or more scrambling circuits configured to generate scrambled random numbers.

[0092] 8 illustrates an exemplary random number generation device 100 further comprising a scrambling circuit 810. The random number generator 102 may be implemented in any of the manners previously described and may generate the random number 125 in the same manner as described above. However, in this implementation, as well as in all of the following implementations in which the random number 125 is scrambled, the random number generator 102 may be implemented in any alternative manner well understood by those skilled in the art for generating the random number 125. Thus, the random number generator 102 in this and all subsequent implementations is not limited to the kTC capacitor implementation previously described, but may generate the random number 125 in any manner known to those skilled in the art, including techniques / systems that do not use kTC noise.

[0093] The scrambling circuit 810 receives the random number 125 and also receives a random or pseudo-random dither signal 815. For simplicity, the signal 815 will hereafter be referred to as the dither signal 815. The dither signal 815 may be a single-bit or multi-bit random number. The scrambling circuit 810 is configured to generate a scrambled random number 825 by scrambling the random number 125 using the dither signal 815. For example, the scrambling circuit 810 may set the scrambled random number 825 to the same value as the random number 125 when the dither signal 815 has a first value, and may set the scrambled random number 825 to a value different from the value of the internal random number 125 when the dither signal 815 has a second value. For example, the scramble circuit 810 may be an XOR gate or an XNOR gate, or a circuit / logic having the function of an XOR or XNOR gate, to which the internal random number 125 and the dither signal 815 are input, and the scrambled random number 825 is its output. As a result, the scrambled random number 825 may be set as follows:

[0094] [Table 2]

[0095] Alternatively, the scrambling circuit 810 may be any other form of circuitry / logic configured to generate a scrambled random number 825 by scrambling the internal random number 125 depending on the dither signal 815.

[0096] In one embodiment, the dither signal 815 may be generated by a second random number generator of the same design as the random number generator 102 .

[0097] FIG. 9A illustrates this embodiment in which the random number 1252 generated by the second random number generator 1022 is used as a dither signal for the scramble circuit 810 of the first random number generator 1021 .

[0098] In the alternative, the dither signal may be generated by a pseudo-random number generator. In a further alternative, the dither signal may be generated by a pseudo-random number generator seeded by the output of a further random number generator 1022 of the same design as the first random number generator 1021.

[0099] FIG. 9B illustrates one non-limiting example implementation of a dither generator 805 comprising a random number generator 102 and an entropy correction circuit 806. The random number generator 102 outputs a random number 125 to the entropy correction circuit 806, which uses the random number 125 to generate a dither signal 815. The entropy correction circuit 806 may be configured to generate the dither signal 815 in a manner that reduces or corrects any entropy problems in the random number 125 that prevent the random number from having equal likelihood for each of its possible values. In one embodiment, the entropy correction circuit 806 may be a Von Newmann corrector configured to operate according to the Von Neumann principle, which removes the 0 / 1 bias from the random number. In particular, the entropy correction circuit 806 may be configured to receive two consecutive values ​​from the random number generator 102. If the two consecutive values ​​from the random number generator 102 are "01," the dither signal 815 is set to 0 (or 1). If two consecutive values ​​from the random number generator 102 are "10," the dither signal 815 is set to 1 (or 0). If two consecutive values ​​from the random number generator 102 are "00" or "11," there is no output from the correction circuit 806 (i.e., the dither signal 815 has no value), and the process is repeated until the dither signal 815 is set to a value. Therefore, for each new value of the dither signal 815, at least two random values ​​need to be generated by the random number generator 102. However, that means that the dither signal 815 should not have a bias towards 1 or 0, which in turn should improve the randomness of the scrambled random number 825.

[0100] Alternatively, the dither generator 805 may not have the entropy correction circuit 806 and instead output the random number 102 as the dither signal 815. In a further alternative, the dither generator 805 may further comprise a pseudo-random number generator seeded by the random number 102 and configured to output a pseudo-random number as the dither signal 815. In a further alternative, it may be implemented in any other manner known to those skilled in the art.

[0101] 8 and 9A, the scrambling circuit 810 uses only two inputs to generate the scrambled random number 825. Therefore, to perform one-step scrambling, it may include only a single scrambler, e.g., a single XOR or XNOR gate. However, in the alternative, a more complex scrambler circuit may be used to generate the scrambled random number 825.

[0102] 10 shows an embodiment of a more complex scrambling circuit 1010 configured to generate a scrambled random number 825 using a random number 125 and two or more dither signals 1008. In this embodiment, the scrambling circuit 1010 performs cyclic scrambling using two or more scramblers (each of which may be configured to have an XOR or XNOR function, as described above).

[0103] The random number generating device comprises a random number generator 1002 and two dither generators 10151 and 10152 for generating two dither signals 10051 and 10052. The dither generator 1005 may be configured in any of the ways described above with reference to Figures 8 and 9. The scrambling circuit 1010 comprises three scramblers 10201, 10202, and 1030 (e.g., three XOR or XNOR gates). The first intermediate scrambler 10201 generates a first intermediate scrambled dither signal 10251 by scrambling the random number 125 using the first dither signal 10151 in the same way as described above with reference to Figures 8 and 9. The second intermediate scrambler 10202 then generates the second intermediate scrambled dither signal 10252 by scrambling the second dither signal 10252 with the first intermediate scrambled dither signal 10251 in the same manner as described above with reference to Figures 8 and 9. Finally, the final scrambler 1030 generates the scrambled random number 825 by scrambling the random number 125 with the second intermediate scrambled dither signal 10252 in the same manner as described above with reference to Figures 8 and 9.

[0104] It will be appreciated that in this embodiment, two dither signals 1015 and three scramblers are used, however, the principles of this circuit can be extended to any number of dither signals 1015 and scramblers 1020.

[0105] 11 shows a further exemplary scrambling circuit 1110 that includes multiple scramblers to perform more complex scrambling. In this embodiment, the scrambling circuit 1110 is configured to perform two-stage scrambling. Two-stage scrambling is very similar to the cyclic scrambling described above, except that a first intermediate scrambler 10201 scrambles first and second dither signals 10151 and 10152 to generate a first intermediate scrambled dither signal 10251. A final scrambler 1030 then generates a scrambled random number 825 by scrambling the random number 125 using the first intermediate scrambled dither signal 10251 in the same manner as described above with reference to FIGS. 8 and 9.

[0106] Figure 12 shows a further exemplary scrambling circuit 1210 that is very similar to that of Figure 11, except that it is configured to perform three-stage scrambling. It will be understood that Figures 11 and 12 show multi-stage scrambling that can be expanded to any number of scrambling stages, e.g., 2, 3, 4, etc.

[0107] Generating and using one or more intermediate dither signals in the manner described above may improve the entropy of the dither signal used by final scrambler 1030 to scramble random number 125 and generate scrambled random number 825. As a result, scrambled random number 825 may have improved entropy compared to the embodiments of Figures 8 and 9, and therefore may be more random (i.e., a more equal likelihood of having each possible value, e.g., a closer to 50:50 likelihood of being 0 or 1).

[0108] In each of these embodiments, each scrambler in the scrambling circuit 1110 uses two input signals to generate a scrambled output signal. However, alternatively, at least one of the scramblers may use more than two inputs to generate the scrambled output (e.g., it may be or have the functionality of a 3+ input XOR or XNOR gate). For example, considering the implementation of FIG. 11, rather than having two scramblers, a single three-input scrambler may be used that uses the random number 125, the first dither signal 10151, and the second dither signal 10152 to generate the scrambled random number.

[0109] Using a scrambling circuit in any of the ways described above with reference to FIGS. 8-12, and in any of the additional ways described below, can be useful in hiding the power signature of the random number generation device 100, thereby reducing the likelihood that a malicious external party can understand the device's operation from external operations. This can reduce the likelihood that the generated random numbers can be compromised by a malicious external party. Furthermore, scrambling results in a scrambled random number 825 that has increased entropy compared to the random number 125. Therefore, if there is a residual bias in the random number 125 such that the output does not have a 50:50 probability of 0 or 1, that bias should be reduced or eliminated in the scrambled random number 825 so that the scrambled random number ultimately generated and output should have a near 50:50 likelihood of 0 or 1. The scrambled random number 825 can then be output by the random number generation device 100 to any device / entity requiring a random number. For example, as shown in any of Figures 10-12, using an intermediate dither signal to scramble the random number 125 may further improve the entropy of the scrambled random number 825 such that its randomness is further improved.

[0110] FIG. 13 shows a plurality of random number generators 102 n 1 shows an exemplary schematic representation of a random number generator 100 including:N There are N random number generators numbered as follows: n can be implemented in any of the ways described above. n A random number generated by 125 n The multi-bit random number unit 1310 may be implemented in any suitable way to achieve the functions described below, for example in hardware such as hard circuitry or logic, or in software running on one or more processors such as microprocessors or microcontrollers.

[0111] The multi-bit random number generator 1310 generates the received random number 125 n The random number generators 102 may be configured to generate a multi-bit random number 1315 based on at least some of the n A random number generated by 125 n By generating the multi-bit random number 1315 using n Any systematic bias in either of the may be reduced or removed from the multi-bit random number 1315.

[0112] The multi-bit random number generator 1310 may generate the multi-bit random number 1315 in a number of different ways. For example, n In this case, each time a new multi-bit random number 1315 is generated, the newly generated random number 125 n may always be concatenated in the same order, or the order may change with each new multi-bit random number 1315. In a further embodiment, the received random number 125 may be combined to generate the multi-bit random number 1315, such as by XORing or hashing. n More complex operations can be performed on the received random number 125. n Only some of the random numbers 125 may be used to generate the multi-bit random numbers 1315, and optionally,n The order of concatenation and / or random number 125 may be changed for each new multi-bit random number 1315. n If there are variations that the random number generator 102 contributes to the multi-bit random number 1315, those variations may be random or pseudo-random. n One or more outputs of may not be used for the multi-bit random number 1315, but may instead be used to randomize the variation.

[0113] In some embodiments, the multi-bit random number 1315 is the random number 102 n In another embodiment, the multi-bit random number generator 1310 generates random numbers 102 over time. n , and then use those values ​​to generate the multi-bit random number 1315. In this way, the length of the multi-bit random number 1315 depends on the random number generator 102 whose output is used by the multi-bit random number generator 1310. n The number of lines may be longer than the number of lines.

[0114] Random Number Generator 102 n At least some of them will generate a new random number 125 n , 1315。 This may improve the speed at which the multi-bit random numbers 1315 can be generated compared to, for example, generating the multi-bit random numbers 1315 using a single random number generator. n Hiding the power signature and / or current footprint of the device 100 may improve the security of the device 100, thereby reducing the likelihood of side-channel attacks that could compromise the random numbers generated and output by the device 100.

[0115] In the embodiment of FIG. 13, a multi-bit random number generator 1310 generates a plurality of random numbers 125 n However, alternatively, a scramble circuit may be used to generate the random number 125n may be scrambled, and the multi-bit random number generator 1310 uses the scrambled random number to generate a multi-bit random number 1315.

[0116] 14A to 14D show a plurality of random numbers 125 n 14 shows an example implementation of a scrambling circuit 1410 used to scramble a respective random number 125 n a plurality of scramblers 1420 configured to scramble the n In this embodiment, the random number generator 102 n are spatially arranged in rows as a series of adjacent columns (equivalent to being arranged in columns as a series of adjacent rows). The apparatus 100 also includes a plurality of dither generators 1005 (in this example, four, although there could be any number, e.g., 1, 2, 3, 5, etc.) configured to output a dither signal 1015. The dither generators 1005 also include a random number generator 102 n Although included as part of the line, they do not have to be. For example, the random number generator 102 n and dither generator 1005 may all be implemented within the same integrated circuit (IC) and spatially arranged in rows, as can be seen in Figures 14A-14D. For clarity, in this embodiment (as with all scrambling embodiments disclosed herein), random number generator 102 n and dither generator 1005 may be implemented in any manner known to those skilled in the art, including but not limited to the methods described herein with reference to FIGS.

[0117] The apparatus 100 generates a first dither signal 1015 A are configured to be used by multiple scramblers 1420 to scramble their respective random numbers 125, and the random number generators 102 that generate those random numbers 125 are spatially separated (i.e., they are spaced apart in rows / columns such that there is at least one other random number generator 102 between them). n(They are not spatially adjacent to each other in the same row / column). For example, random numbers 1251, 1255, 1259, etc. are the first dither signal 1015 A 14B, the second dither signal 1015 is scrambled by scramblers 14201, 14205, 14209, etc. B are used by other scramblers 1420 to scramble their respective random numbers 125, and the random number generators 102 that generate those random numbers 125 are spatially separated (i.e., they are n (They are not spatially adjacent to each other in the same row / column). For example, the random numbers 1252, 1256, 125 1- etc. is the second dither signal 1015 B Use the Scrambler 14202, 14206, 1420 10 Similarly, as can be seen in FIG. 14C, the third dither signal 1015 C , and as can be seen in FIG. 14D, the fourth dither signal 1015 D The same is true for .

[0118] Additionally, all dither generators 1005 are connected to random number generators 102 whose output is scrambled using the dither signal generated by the dither generator. n occupy row positions that are not spatially adjacent to each other.

[0119] Performing scrambling using signals generated by units / elements that are not adjacent to each other in a row results in a scrambled random number 825 NThis can help improve the randomness of the dither signal. For example, there may be a manufacturing defect in one area of ​​an IC that can cause a bias in the random numbers generated in that area. By performing scrambling using random numbers / signals generated in non-adjacent positions in the row and therefore in different areas of the IC, it is necessary to reduce or eliminate the bias caused by the defect in a particular part of the IC. Additionally or alternatively, the correlation between the dither signal and the random numbers being scrambled by the dither signal should be reduced or eliminated, which has the advantage of reducing / preventing capacitive coupling between the unit / element generating the dither signal and the random numbers.

[0120] Figures 14A-14D show a simple form of scrambling similar to that depicted in Figures 8 and 9. However, alternatively, more complex scrambling similar to the example described above with reference to Figures 10-12 can be used.

[0121] FIG. 15 illustrates this embodiment, in which a scrambler 1510 includes an intermediate scrambler 1520 (which may include one or more intermediate scramblers 1020, each having two or more inputs and using those two or more inputs to generate their intermediate dither signals) and multiple final scramblers 1420. N The intermediate scrambler 1520 generates multiple dither signals 1015 (in this example, four dither signals 1015, although any other number may be used). A ~1015 D ), and one or more intermediate dither signals 1515 (in this example, four intermediate dither signals 1515, although any other number may be used). A ~1515 D ) is then fed to the scrambler 1420 of FIG. n is the dither signal 1015 A ~1015 D The same way as using the final scrambler 1420 N(i.e., spatially adjacent random number generators 102 may have their random numbers 125 scrambled by different intermediate dither signals 1515; in other words, each intermediate dither signal 1515 may be used to scramble two or more random numbers 125 output by spatially non-adjacent random number generators 102). D shows an exemplary way in which this can be used, which is shown in FIG. D .I the fourth dither signal 1015 D is used. It should be understood that other intermediate dither signals 1515 may be used in the same manner as the dither signals shown in Figures 14A-14C, and that they are not depicted in the drawings solely for clarity and simplicity.

[0122] The intermediate scrambler 1520 may perform one step of scrambling to generate the intermediate dither signal 1515 similar to Figure 11, or multiple steps of scrambling similar to Figure 12. For example, in a one intermediate step scrambling implementation (similar to that of Figure 11), the first intermediate dither signal 1515 A is the first dither signal 1015 A and a second dither signal 1015 B The second dither signal 1515 may be generated by the first intermediate scrambler using B is the second dither signal 1015 B and a third dither signal 1015 C The third dither signal 1515 may be generated by the second intermediate scrambler using C is the third dither signal 1015 C and a fourth dither signal 1015 D The fourth dither signal 1515 may be generated by a third intermediate scrambler using D is the fourth dither signal 1015 D and the first dither signal 1015 A The fourth intermediate scrambler may be generated using

[0123] Additionally or alternatively, intermediate scrambler 1520 may include one or more scramblers with three or more inputs, e.g., generating an intermediate dither signal based on at least three of dither signals 1015. Regardless of the number of scrambling steps performed by intermediate scrambler 1520 to generate intermediate dither signal 1515, scrambler 1420 N is a random number 125 N , and thus performs the same function as final scrambler 1030 in FIGS.

[0124] 16 shows an exemplary process for generating a scrambled random number using any of the implementations of the random number generator described above with reference to FIGS. 8-14. In step S1410, a first random number is generated. In step S1420, a scrambled random number is generated based on the first random number and a first dither signal, where the first dither signal is a random value signal or a pseudo-random value signal.

[0125] Those skilled in the art will readily appreciate that various changes or modifications can be made to the above-described aspects of the present disclosure without departing from the scope of the present disclosure.

[0126] As used herein, the term "coupled" encompasses both a direct electrical connection between two components and an indirect electrical connection, where two components are electrically connected to each other through one or more intermediate components. For example, in each of the above embodiments, the buffered voltage output 115 of each noise generator 110 is directly connected to the decision unit 120. However, alternatively, the buffered voltage output 115 of each noise generator 110 may first pass through one or more amplifiers such that the signal received at the input to the decision unit 120 (e.g., received by a sampling circuit at the input to the decision unit 120) is an amplified version of the buffered voltage 115 output by the noise generator 110.

[0127] Although not depicted in the figures, the differential implementations of FIGS. 6 and 7A-7E may optionally include means (e.g., a chop circuit, a shuffle circuit, a multiplexer, or the like) for swapping the couplings of the noise generators to the decision unit 120. In this manner, the couplings of the two noise generators 1101 and 1102 to the positive and negative inputs of the decision unit 120 may be periodically or intermittently swapped. For example, in the arrangement of FIG. 7C , the first noise generator 1101 is coupled to the positive input and the second noise generator 1102 is coupled to the negative input. If means for swapping is included, it may be used to periodically or intermittently switch the couplings so that the first noise generator 1101 is coupled to the negative input and the second noise generator 1102 is coupled to the positive input. There may be many reasons for this. In one embodiment, after the device is used to generate a random number (e.g., 0 or 1), the means for swapping may be used to swap over the inputs before the circuit is used to generate the next random number. Once that random number is generated, the means for swapping can be used to swap back the inputs before the circuit is used to generate the next random number, and so on. By alternating in this manner, if there is any residual bias in the signal 115 output by the noise generator 110, its effect can be reduced or eliminated across multiple random numbers generated. This is because across the generated random numbers, approximately half are based on a bias in one direction and approximately half are based on the inverse of the bias (i.e., a bias in the other direction), thereby reducing or eliminating the bias on average. This can be particularly effective when multiple consecutively generated random numbers are combined to form a multi-bit random number. In this example, the combinations are swapped with alternate random numbers, but they can be swapped at any other frequency, such as approximately half of the set of generated random numbers having one combination and the other half having the other combination (e.g., swapping every second or third random number).

[0128] In each of the exemplary implementations of the noise generator circuit 110 disclosed above, the capacitor 320 that generates the kTC noise is depicted as a separate component. However, alternatively, the capacitor in the noise generator circuit 110 may be parasitic capacitance at either the junction, gate, or metal overlap of a buffer in the noise generator circuit 110. Thus, the noise generator circuit 110 may not necessarily include an explicit capacitor component, but instead may include a buffer with parasitic capacitance that effectively forms a capacitor. This may have the advantage of the capacitor 320 having a very small capacitance (because parasitic capacitance tends to be very small), which is useful for kTC noise generation without requiring a capacitor component included in the noise generator circuit 110.

[0129] Aspects of the Disclosure Certain non-limiting aspects of the disclosure are described in the following numbered paragraphs.

[0130] 1. An apparatus for generating scrambled random numbers, comprising: a first random number generator configured to generate a first random number; a scrambling circuit configured to receive the first random number and the first dither signal and to generate a scrambled random number based on the first random number and the first dither signal; The apparatus, wherein the first dither signal is a random value signal or a pseudo-random value signal.

[0131] 2. The device of claim 1, wherein the scrambling circuit is configured to generate the scrambled random number by setting the scrambled random number equal to the value of the first random number when the first dither signal is a first value, and by setting the scrambled random number to a value different from the first random number when the first dither signal is a second value.

[0132] 3. The apparatus of claim 2, wherein when the first dither signal is at a second value, the scrambled random number is set to the inverse of the first random number.

[0133] 4. The device according to any one of items 1 to 3, further comprising a first dither generator for generating a first dither signal.

[0134] 5. The first dither generator comprises a further random number generator configured to generate further random numbers; Item 5. The apparatus of item 4, wherein the first dither generator is configured to generate the first dither signal using a further random number.

[0135] 6. The apparatus of clause 5, wherein the first dither generator further comprises a first pseudo-random number generator configured to use a further random number as a seed for generating the first dither signal, and the first dither signal is the pseudo-random number output by the first pseudo-random number generator.

[0136] 7. The apparatus of clause 5, wherein the first dither generator further comprises an entropy correction circuit configured to generate the first dither signal based on a further random number.

[0137] 8. The apparatus according to item 7, wherein the entropy correction circuit is a von Neumann corrector.

[0138] 9. A plurality of random number generators, including a first random number generator, configured to generate a respective plurality of random numbers; a first dither generator configured to generate a first dither signal; 9. The device of any one of claims 1 to 8, wherein the scrambling circuit is configured to receive a plurality of random numbers and a first dither signal, and to generate a respective plurality of scrambled random numbers using the plurality of random numbers and the first dither signal.

[0139] 10. The apparatus of claim 9, wherein the multiple random number generators and the first dither generator are implemented on an integrated chip and spatially arranged in rows.

[0140] 11. The apparatus of clause 10, wherein the scrambling circuit is configured to scramble at least two random numbers of the plurality of random numbers using a first dither signal, and the at least two random numbers are generated by two random number generators that are not spatially adjacent to a row.

[0141] 12. The apparatus of claim 11, wherein the first dither generator occupies a position in a row that is not spatially adjacent to two random number generators that generate at least two random numbers.

[0142] 13. Further comprising a second dither generator configured to generate a second dither signal; a scrambling circuit configured to receive a second dither signal, generate a first set of scrambled random numbers using the first set of random numbers and the first dither signal, and generate a second set of scrambled random numbers using the second set of random numbers and the second dither signal; the plurality of random numbers includes a first set of random numbers and a second set of random numbers; 13. The apparatus of any one of items 9 to 12, wherein the plurality of scrambled random numbers includes a first set of scrambled random numbers and a second set of scrambled random numbers.

[0143] 14. The scramble circuit receiving one or more further dither signals; 14. The apparatus of any one of claims 1 to 13, further configured to generate a scrambled random number based on the first random number, the first dither signal, and one or more further dither signals.

[0144] 15. The scramble circuit generating an intermediate dither signal using the first dither signal and one or more further dither signals; Item 15. The apparatus of item 14, configured to generate a scrambled random number using the first random number and a scrambled dither signal. [Explanation of symbols]

[0145] 110 Noise Generator 1101 First Noise Generator 1102 Second Noise Generator 120 Decision Unit 510 Sampling Circuit 530 Random Number Calculation Circuit 540 memory 550 Controller 710 Sampling Circuit 806 Entropy Correction Circuit 810 Scramble Circuit 8101 scramble circuit 10201 1st Intermediate Scrambler 10202 Second intermediate scrambler 1030 Final Scrambler

Claims

1. A random number generation device comprising a first random number generator, the first random number generator comprising: a first noise generator circuit, a first capacitor for use in generating kTC noise; a first buffer coupled to the first capacitor for buffering a capacitor voltage including kTC noise generated by the first capacitor and outputting a buffered voltage; a determination unit, wherein the determination unit: reading a first buffered voltage from an output of the first buffer, the first buffered voltage being a buffered version of a first capacitor voltage including a first kTC noise generated by the first capacitor at a first time; configured to read a second buffered voltage from the output of the first buffer, the second buffered voltage being a buffered version of the second capacitor voltage including second kTC noise generated by the first capacitor at a second time; The random number generator, wherein the random number generator is configured to generate a random number based on the first buffered voltage and the second buffered voltage.

2. the noise generator circuit:

2. The random number generator of claim 1, further comprising a first switch coupled to the first capacitor to form a first switched capacitor arrangement that changes the state of the first capacitor from a closed state to an open state to generate a capacitor voltage including kTC noise across the first capacitor.

3. 3. The random number generator of claim 1, wherein the first buffer is configured to provide a gain to the capacitor voltage to generate the buffered voltage.

4. The decision unit: The random number generator of any one of claims 1 to 3, comprising a sampling circuit configured to sample the first buffered voltage.

5. 5. The random number generator of claim 4, wherein the sampling circuit comprises an amplifier having at least one capacitor, and the sampling circuit is configured to sample the first buffered voltage using the at least one capacitor.

6. 6. The random number generator of claim 5, wherein the amplifier is an auto-zeroing amplifier.

7. The decision unit:

7. The random number generator of claim 4, further comprising a comparator configured to compare the sampled first buffered voltage with the second buffered voltage, and wherein the generation of the random number is based on an output of the comparator.

8. The first random number generator: a second noise generator circuit, the second noise generator circuit comprising: a second capacitor for use in generating kTC noise; a second buffer coupled to the second capacitor for buffering a capacitor voltage including the kTC noise generated by the second capacitor and outputting a buffered voltage; The decision unit: reading a third buffered voltage from the output of the second buffer, the third buffered voltage being a buffered version of the third capacitor voltage including third kTC noise generated by the second capacitor at the first time, the first buffered voltage and the third buffered voltage together forming a first differential signal; further configured to read a fourth buffered voltage from the output of the second buffer, the fourth buffered voltage being a buffered version of a fourth capacitor voltage that includes fourth kTC noise generated by the second capacitor at the second time, the second buffered voltage and the fourth buffered voltage together forming a second differential signal; The random number generation device according to any one of claims 1 to 7, wherein the random number generation device is configured to generate the random number based on the first differential signal and the second differential signal.

9. The decision unit:

9. The random number generator of claim 8, comprising an auto-zeroing differential sampling circuit configured to sample the first differential signal.

10. 10. The random number generator of claim 9, wherein the determination unit is configured to generate the random number based on determining a difference between the second differential signal and the sampled first differential signal.

11. the random number generation device further comprises a scramble circuit configured to receive the random number generated by the first random number generator and a dither signal, the dither signal being a random value signal or a pseudo-random value signal; The random number generation device according to any one of claims 1 to 10, wherein the scrambling circuit is configured to generate a scrambled random number based on the dither signal and the random number generated by the first random number generator.

12. 12. The random number generation device of claim 11, wherein the scrambling circuit is configured to generate the scrambled random number by setting the scrambled random number equal to the random number generated by the first random number generator when the dither signal is a first value, and by setting the scrambled random number to a value different from the random number generated by the first random number generator when the dither signal is a second value.

13. 13. The random number generator of claim 12, wherein when the dither signal is at the second value, the scrambled random number is set to the inverse of the random number generated by the first random number generator.

14. 1. A method for generating random numbers, the method including a first noise generator circuit, the first noise generator circuit comprising: generating a first buffered voltage output from the buffer, the first buffered voltage including a first kTC noise generated by the capacitor at a first time; generating a second buffered voltage output from the buffer, the second buffered voltage including a second kTC noise generated by the capacitor at a second time; generating a random number based on the first buffered voltage and the second buffered voltage.

15. 1. An apparatus for generating scrambled random numbers, comprising: a first random number generator configured to generate a first random number; a scrambling circuit configured to receive the first random number and a first dither signal and to generate the scrambled random number based on the first random number and the first dither signal; The apparatus, wherein the first dither signal is a random value signal or a pseudo-random value signal.

16. 16. The apparatus of claim 15, wherein the scrambling circuit is configured to generate the scrambled random number by setting the scrambled random number equal to a value of the first random number when the first dither signal is at a first value, and by setting the scrambled random number to a value different from the first random number when the first dither signal is at a second value.

17. a first dither generator for generating the first dither signal; the first dither generator comprises a further random number generator configured to generate further random numbers; 17. Apparatus according to claim 15 or 16, wherein the first dither generator is configured to generate the first dither signal using the further random number.

18. 18. The apparatus of claim 17, wherein the first dither generator further comprises an entropy correction circuit configured to generate the first dither signal based on the further random number.

19. a plurality of random number generators including the first random number generator, each configured to generate a respective plurality of random numbers; a first dither generator configured to generate the first dither signal; 19. The apparatus of claim 15, wherein the scrambling circuit is configured to receive the plurality of random numbers and the first dither signal, and to generate a respective plurality of scrambled random numbers using the plurality of random numbers and the first dither signal.

20. a plurality of random number generators and the first dither generator are implemented on an integrated chip and spatially arranged in rows / columns; the scrambling circuit is configured to scramble at least two random numbers of the plurality of random numbers using the first dither signal; 20. The apparatus of claim 19, wherein the at least two random numbers are generated by two random number generators that are not spatially adjacent to the row.

Images